METHOD AND SYSTEM FOR CONTAINMENT OF USAGE OF LANGUAGE INTERFACES

• US 20110077948A1
• Filed: 11/15/2010
• Published: 03/31/2011
• Est. Priority Date: 12/17/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sharma, Rosen, Shah, Bakul, Sebes, E. John
• Granted Patent: US 8,549,546 B2
• Time in Patent Office: Days
• US Class Current: 704/275
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 8/20 Software design
• CPC Class Codes: G06F 8/30 Creation or generation of source code
• CPC Class Codes: G06F 8/40 Transformation of program code
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: H04N 21/8133 specifically related to the content, e.g. biography of the actors in a movie, detailed information about an article seen in a video program

Abstract

Client software is modified by a translator to use unique variant of linguistic interface of a service. An interceptor pre-processes subsequent client service requests from translated unique linguistic interface to standard linguistic interface implemented by service. Usage of linguistic interfaces of service is contained, rendering service incapable of executing arbitrary input, even if such input is crafted specifically for the service interface.

Claims

1-51. -51. (canceled)

52. A method, comprising:

identifying a first constant data of a first client program, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation; and

determining a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data;

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

53. The method of claim 52, wherein the substitution code comprises a second constant data.

54. The method of claim 53, wherein the determining a substitution code includes:

searching a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

identifying a mapping string of the plurality of mapping strings as the second constant data, the mapping string corresponding to an arbitrary string of the plurality of arbitrary strings, wherein the arbitrary string matches an input string of the first constant data.

55. The method of claim 53, wherein the determining a substitution code includes:

searching a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

creating a new entry in the mapping table if none of the arbitrary strings of the plurality of arbitrary strings matches an input string of the first constant data,

wherein the new entry includes a new arbitrary string matching the input string of the first constant data, and wherein a new matching string is generated to correspond to the new arbitrary string.

56. The method of claim 52, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns a second constant data as the expression in the second grammar type directed to the second linguistic interface.

57. The method of claim 56, wherein the second constant data is a mapping string of a plurality of mapping strings, the plurality of mapping strings corresponding respectively to a plurality of arbitrary strings in a mapping table;

wherein the mapping string is identified by finding a corresponding arbitrary string of the plurality of arbitrary strings that matches an input string of the first constant data.

58. The method of claim 52, further comprising the step of generating a second client program including the first client program with the first constant data replaced by the substitution code.

59. A method, comprising:

receiving a request for executing a first program, the first program comprising a first constant data, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation;

determining a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data;

generating a second program including the first program with the first constant data replaced by the substitution code; and

executing the second program,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

60. The method of claim 59, wherein the substitution code comprises a second constant data.

61. The method of claim 60, wherein the determining a substitution code includes:

searching a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

identifying a mapping string of the plurality of mapping strings as the second constant data, the mapping string corresponding to an arbitrary string of the plurality of arbitrary strings, wherein the arbitrary string matches an input string of the first constant data.

62. The method of claim 60, wherein the determining a substitution code includes:

searching a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

creating a new entry in the mapping table if none of the arbitrary strings of the plurality of arbitrary strings matches an input string of the first constant data,

wherein the new entry includes a new arbitrary string matching the input string of the first constant data, and wherein a new matching string is generated to correspond to the new arbitrary string.

63. The method of claim 59, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns a second constant data as the expression in the second grammar type directed to the second linguistic interface.

64. The method of claim 63, wherein the second constant data is a mapping string of a plurality of mapping strings, the plurality of mapping strings corresponding respectively to a plurality of arbitrary strings in a mapping table;

wherein the mapping string is identified by finding a corresponding arbitrary string of the plurality of arbitrary strings that matches an input string of the first constant data.

65. The method of claim 59, further comprising examining a manifest, the manifest indicating whether the first program is authorized to use the first service implementation.

66. The method of claim 65, further comprising:

determining if an integrity data of the manifest has changed; and

blocking all programs from executing if the integrity data of the manifest has changed.

67. The method of claim 65, further comprising:

determining if an integrity data of the first program in the manifest has changed;

blocking the first program from executing if the integrity data of the first program in the manifest has changed.

68. A method, comprising:

identifying a calling code in a first program, the calling code for submitting a service parameter data to a first service implementation having a first linguistic interface configured to interpret requests that conform to a first grammar type;

identifying a first constant data in the first program, wherein the service parameter data is determined using the first constant data via at least one code path in the first program;

defining a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation; and

generating a second program, the second program comprising the substitution code;

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

69. The method of claim 68, wherein the substitution code comprises a second constant data.

70. The method of claim 68, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns a second constant data as the expression in the second grammar type directed to the second linguistic interface.

71. The method of claim 70, wherein the second constant data is a mapping string of a plurality of mapping strings, the plurality of mapping strings corresponding respectively to a plurality of arbitrary strings in a mapping table;

wherein the mapping string is identified by finding a corresponding arbitrary string of the plurality of arbitrary strings that matches an input string of the first constant data.