RESTRICTING COMMUNICATION OF SELECTED PROCESSES TO A SET OF SPECIFIC NETWORK ADDRESSES

• US 20090049193A1
• Filed: 02/04/2008
• Published: 02/19/2009
• Est. Priority Date: 02/14/2000
• Status: Abandoned Application

• Current Assignee: Longhorn HD LLC (Alpha Alpha Intellectual Partners LLC)
• Original Assignee: Digital Asset Enterprises LLC (Intellectual Ventures LLC)
• Inventors: Goyal, Pawan
• Application Number:
  US12/025,723
• Publication Number:
  US 20090049193A1
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/4843 by program, e.g. task dispatcher, supervisor, operating system
• CPC Class Codes: G06F 9/544 Buffers; Shared memory; Pipes

Abstract

Selected processes are associated with sets of specific network addresses, and the associations are stored. When a selected process creates a child process, an association between the child process and the set of network addresses with which the parent process is associated is stored. When a selected process is deleted, the association between the selected process and its set of network addresses is deleted. Each selected process is restricted to network address-based communication via its associated set of network addresses. Certain communication protocol subroutines associated with network address-based communication are intercepted by an interception module. The interception module detects attempts by selected processes to communicate via network addresses. If a selected process attempts to communicate via an unassociated network addresses, the attempted communication is prohibited.

Claims

1-95. -95. (canceled)

96. A computer-readable storage medium storing instructions that, when executed, perform a method comprising:

associating at least one selected process with at least one network address;

determining whether an attempted network address-based communication of a selected process is via an associated address; and

in response to a determination that the communication is via an associated address, allowing the communication to proceed.

97. An apparatus, comprising:

means for associating at least one selected process with at least one network address;

means for determining whether an attempted network address-based communication of a selected process is via an associated address; and

means for allowing the communication to proceed in response to a determination that the communication is via an associated address.

98. An apparatus, comprising:

a component configured to associate at least one selected process with at least one network address; and

a component configured to determine whether an attempted network address-based communication of a selected process is via an associated address and to allow the communication to proceed if the communication is via the associated address.