Inter-Process Message Security

• US 20090260052A1
• Filed: 04/11/2008
• Published: 10/15/2009
• Est. Priority Date: 04/11/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hudson, Brian, Alexander, Jimmy, Bathula, Avinashreddy, Lyons, Matthew G., Shell, Scott R., Coles, Neil L., Miller, John Mark, Rogers, Andrew M., Bentley, Keith C., Sandadi, Upender R., Vincent, Jon
• Granted Patent: US 9,418,219 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

An inter-process messaging security management may be provided. A message comprising an operation to be performed may be sent from a process operating in a process chamber to a second process operating in another chamber. Before the message is allowed to be delivered, the validity of the operation contained in the message may be verified and a security policy may be examined to determine whether the message is permitted to be sent from the first process to the second process. If the security policy permits the second process to execute the operation requested by the first process, the message may be delivered to the second process. If the operation is not permitted, the message may not be delivered and an error message may be returned to the first process.

Claims

1. A method for providing inter-process messaging security, the method comprising:

receiving a message from a first process associated with a first process chamber;

determining a destination process for the message;

determining whether the destination process is associated with a second process chamber;

in response to determining that the destination process is associated with the second process chamber, determining whether at least one security policy permits interaction between the first and second process chambers;

in response to determining that the at least one security policy permits interaction between the first and second process chambers, sending the message to the destination process.

2. The method of claim 1, wherein receiving the message from the first process comprises receiving a message comprising an operation request.

3. The method of claim 2, wherein receiving a message comprising the operation request comprises receiving a message comprising at least one of a set data request, a get data request, and a create user input event request.

4. The method of claim 1, further comprising:

prior to determining whether at least one security policy permits interaction between the first and second process chambers, determining whether the message is of a type which is unable to be delivered; and

in response to determining that the message is of a type unable to be delivered, discarding the message.

5. The method of claim 4, wherein determining whether the message is of a type which is unable to be delivered comprises determining whether the message comprises at least one of a window creation message, an initialize dialog box message, and an edit window message.

6. The method of claim 4, further comprising:

in response to determining that the message is of a type unable to be delivered, sending an error message to the source process.

7. The method of claim 1, further comprising:

in response to determining that the at least one destination process is not associated with the second process chamber, determining whether the at least one destination process is associated with the first process chamber;

in response to determining that the at least one destination process is associated with the first process chamber, determining whether at least one intra-chamber security policy permits sending the message; and

in response to determining whether the at least one intra-chamber security permits sending the message, sending the message.

8. The method of claim 1, wherein determining whether at least one security policy permits interaction between the first and second process chambers comprises:

determining whether at least one security policy is associated with the first and second process chambers; and

determining whether the at least one security policy associated with the first and second process chambers has been configured by at least one of an operating system, an administrator, and a user.

9. The method of claim 1, wherein the first process chamber is associated with a plurality of processes.

10. The method of claim 1, wherein the first process comprises at least one of a game application, a financial application, a document processing application, a personal information management application, an internet access application, and an operating system process.

11. The method of claim 1, further comprising:

determining whether the message requires the second process to send a second message to at least one other process, wherein the at least one other process is associated with at least one other process chamber;

in response to determining that the message requires the second process to send the second message to the at least one other process, determining whether at least one security policy permits interaction between the second process chamber and the at least one other process chambers;

in response to determining that the at least one security policy associated with the second process chamber and the at least one other process chamber permits interaction between the second process chamber and the at least one other process chamber, determining whether at least one security policy permits interaction between the first process chamber and the at least one other process chamber;

in response to determining that the at least one security policy permits interaction between the first process chamber and the at least one other process chambers, sending the message to the third process.

12. A computer-readable medium which stores a set of instructions which when executed performs a method for providing inter-process message security, the method executed by the set of instructions comprising:

receiving a message from a first process associated with a first process chamber for a second process;

determining whether the second process is associated with a second process chamber;

in response to determining that the second process is associated with the second process chamber, determining whether at least one security policy is associated with the first and second process chambers;

in response to determining that the at least one security policy is associated with the first and second process chambers, determining whether the at least one security policy associated with the first and second process chambers permits the message to be sent from the first process chamber to the second process chamber; and

in response to determining that the at least one security policy associated with the first and second process chambers permits the message to be sent from the first process chamber to the second process chamber, sending the message to the second process.

13. The computer-readable medium of claim 12, wherein the set of instructions further comprises:

in response to determining that at least one security policy is not associated with the first and second process chambers, requesting authorization to deliver the message.

14. The computer-readable medium of claim 12, wherein the set of instructions further comprises returning a value to the first process.

15. The computer-readable medium of claim 12, wherein the set of instructions further comprises:

prior to determining whether the at least one security policy is associated with the first and second process chambers, determining whether the message is of a type which is unable to be delivered; and

in response to determining that the message is of a type unable to be delivered, discarding the message.

16. The computer readable-medium of claim 15, wherein the set of instructions further comprises returning an error to the first process.

17. The computer readable-medium of claim 12, wherein each of a plurality of processes is associated with a unique process chamber.

18. The computer readable-medium of claim 12, wherein the set of instructions further comprises:

prior to determining whether the destination process is associated with the second process chamber, determining whether the destination process is the same as the first process; and

sending the message to the destination process.

19. The computer readable-medium of claim 12, wherein the set of instructions further comprises:

determining whether the message requires the second process to send a second message to at least one other process, wherein the at least one other process is associated with at least one other process chamber;

in response to determining that the message requires the second process to send the second message to the at least one other process, determining whether at least one security policy permits interaction between the second process chamber and the at least one other process chambers;

in response to determining that the at least one security policy associated with the second process chamber and the at least one other process chamber permits interaction between the second process chamber and the at least one other process chamber, determining whether at least one security policy permits interaction between the first process chamber and the at least one other process chamber;

in response to determining that the at least one security policy permits interaction between the first process chamber and the at least one other process chambers, sending the message to the third process.

20. A system for providing inter-process message security, the system comprising:

a memory storage; and

a processing unit coupled to the memory storage, wherein the processing unit is operative to;

receive a message comprising an operation request from a first process;

determine a process chamber associated with the first process;

determine a process chamber associated with at least one destination process;

if the process chamber associated with the first process is the same as the process chamber associated with the at least one destination process, send the message to the at least one destination process;

if the process chamber associated with the first process is not the same as the process chamber associated with the at least one destination process and the operation request is unable to be performed unless the first process and the destination process are associated with the same process chamber, discard the message;

determine whether at least one security policy is associated with the process chamber associated with the first process and the process chamber associated with the at least one destination process;

in response to determining that the at least one security policy is associated with the process chamber associated with the first process and the process chamber associated with the at least one destination process, determine whether the at least one security policy associated with the process chamber associated with the first process and the process chamber associated with the at least one destination process permits the message to be sent from the first process to the destination process; and

in response to determining whether the at least one security policy associated with the process chamber associated with the first process and the process chamber associated with the at least one destination process permits the message to be sent from the first process to the destination process, send the message to the destination process.