Method of improving computer security through sandboxing

• US 20060021029A1
• Filed: 06/29/2004
• Published: 01/26/2006
• Est. Priority Date: 06/29/2004
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Brickell, Ernie F., Uhlig, Richard, Cihula, Joseph F., Hall, Clifford D.
• Granted Patent: US 7,908,653 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy

Abstract

Improving security of a processing system may be accomplished by at least one of executing and accessing a suspect file in a sandbox virtual machine.

Claims

1. A method of improving security of a processing system comprising:

at least one of executing and accessing a suspect file in a sandbox virtual machine.

2. The method of claim 1, further comprising at least one of executing and accessing the suspect file according to a sandbox policy defining allowable actions to be taken during at least one of execution and accessing of the suspect file.

3. The method of claim 2, wherein the sandbox policy includes preventing at least one of sending electronic mail messages, deleting or modifying files on the processing system, and sending messages through a network interface, all being initiated from within the sandbox virtual machine.

4. The method of claim 1, further comprising identifying a file to be marked as suspect.

5. The method of claim 4, wherein identifying a file to be marked as suspect comprises evaluating the file according to a file identification policy.

6. The method of claim 5, wherein identifying the file to be marked as suspect comprises identifying the file by a virtual machine monitor.

7. The method of claim 4, further comprising marking the suspect file to identify the file as suspect.

8. The method of claim 1, further comprising creating the sandbox virtual machine for at least one of executing and accessing the suspect file.

9. The method of claim 1, further comprising creating the sandbox virtual machine for processing at least one of executing and accessing one or more suspect files in the processing system.

10. The method of claim 1, further comprising creating the sandbox virtual machine by forking the sandbox virtual machine from a user virtual machine.

11. The method of claim 7, further comprising changing the marking of a suspect file when monitoring of at least one of execution and accessing of the suspect file indicates that the file is not malicious.

12. The method of claim 7, further comprising changing the marking of a suspect file from suspect to not suspect from within a user virtual machine.

13. The method of claim 1, further comprising determining if a file is marked as suspicious prior to attempting executing or accessing the file in a user virtual machine.

14. An article comprising:

a storage medium having a plurality of machine readable instructions, wherein when the instructions are executed by a processor, the instructions provide for improving security of a processing system by at least one of executing and accessing a suspect file in a sandbox virtual machine.

15. The article of claim 14, further comprising instructions for at least one of executing and accessing the suspect file according to a sandbox policy defining allowable actions to be taken during at least one of execution and accessing of the suspect file.

16. The article of claim 15, wherein the sandbox policy includes preventing at least one of sending electronic mail messages, deleting or modifying files on the processing system, and sending messages through a network interface, all being initiated from within the sandbox virtual machine.

17. The article of claim 14, further comprising instructions for identifying a file to be marked as suspect.

18. The article of claim 17, wherein instructions for identifying a file to be marked as suspect comprise instructions for evaluating the file according to a file identification policy.

19. The article of claim 18, wherein instructions for identifying the file to be marked as suspect comprise instructions for identifying the file by a virtual machine monitor.

20. The article of claim 17, further comprising instructions for marking the suspect file to identify the file as suspect.

21. The article of claim 15, further comprising instructions for creating the sandbox virtual machine for at least one of executing and accessing the suspect file.

22. The article of claim 15, further comprising instructions for creating the sandbox virtual machine for processing at least one of executing and accessing all suspect files in the processing system.

23. The article of claim 15, further comprising instructions for creating the sandbox virtual machine by forking the sandbox virtual machine from a user virtual machine.

24. The article of claim 20, further comprising instructions for changing the marking of a suspect file when monitoring of at least one of execution and accessing of the suspect file indicates that the file is not malicious.

25. The article of claim 20, further comprising instructions for changing the marking of a suspect file from suspect to not suspect from within a user virtual machine.

26. The article of claim 14, further comprising instructions for determining if a file is marked as suspicious prior to attempting executing or accessing the file in a user virtual machine.

27. A processing system comprising:

a virtual machine monitor to identify and mark files that are suspect; and

a sandbox virtual machine to at least one of execute and access a suspect file.

28. The processing system of claim 27, wherein the sandbox virtual machine is adapted to at least one of execute and access the suspect file according to a sandbox policy defining allowable actions to be taken during at least one of execution and accessing of the suspect file.

29. The processing system of claim 28, wherein the sandbox policy includes preventing at least one of sending electronic mail messages with the suspect file as an attachment and deleting files on the processing system, both being initiated from within the sandbox virtual machine.

30. The processing system of claim 27, wherein the virtual machine monitor identifies a file to be marked as suspect by evaluating the file according to a file identification policy.

31. The processing system of claim 27, wherein the virtual machine monitor changes the marking of a suspect file when monitoring of at least one of execution and accessing of the suspect file by the sandbox virtual machine indicates that the file is not suspect.

32. A processing system comprising:

a sandbox virtual machine to at least one of execute and access a suspect file; and

a policy enforcer virtual machine to identify and mark files that are suspect, and to enforce a sandbox policy defining allowable actions to be taken by the sandbox virtual machine during at least one of execution and accessing of the suspect file.

33. The processing system of claim 32, wherein the sandbox policy includes preventing, by the policy enforcer virtual machine, at least one of sending electronic mail messages with the suspect file as an attachment and deleting files on the processing system, both being initiated from within the sandbox virtual machine.

34. The processing system of claim 32, wherein the policy enforcer virtual machine identifies a file to be marked as suspect by evaluating the file according to a file identification policy.

35. The processing system of claim 32, wherein the policy enforcer virtual machine changes the marking of a suspect file when monitoring of at least one of execution and accessing of the suspect file by the sandbox virtual machine indicates that the file is not suspect.

36. A method of improving security of a processing system comprising:

identifying files to be marked as suspect;

marking the identified files;

accepting a request to at least one of execute and access a file by a user virtual machine;

at least one of executing and accessing the file in the user virtual machine when the file is not marked as suspect; and

creating a sandbox virtual machine and at least one of executing and accessing the file in the sandbox virtual machine according to a policy when the file is marked as suspect.

37. The method of claim 36, wherein the policy includes preventing at least one of sending electronic mail messages with the suspect file as an attachment and deleting files on the processing system, both being initiated from within the sandbox virtual machine.

38. The method of claim 36, wherein identifying a file to be marked as suspect comprises evaluating the file according to a file identification policy.

39. The method of claim 38, wherein identifying the file to be marked as suspect comprises identifying the file by a virtual machine monitor.