INTEGRATING SECURITY PROTECTION TOOLS WITH COMPUTER DEVICE INTEGRITY AND PRIVACY POLICY

• US 20120102577A1
• Filed: 12/30/2011
• Published: 04/26/2012
• Est. Priority Date: 06/20/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kurien, Thekkthalackal Varugis, Hamblin, Jeffrey B., Nagampalli, Narasimha Rao, Brundrett, Peter T., Field, Scott
• Granted Patent: US 8,347,085 B2
• Time in Patent Office: Days
• US Class Current: 726/30
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine

Abstract

At computer device power on, the operating system of the computer device initiates a monitor. The monitor assigns a monitoring program to each program and object (collectively, “program”) running on the computer device to monitor the activities of the program. When the monitoring program is assigned to a program, the monitoring program is assigned an integrity and/or privacy label (collectively, “integrity label”) based on predetermined criteria applied to the monitored program. The monitoring program, in turn, assigns an integrity label to the program monitored by the monitoring program. The integrity label assigned to the monitored program is less than or equal to the integrity label of the monitoring program. The monitor enforces an integrity policy of the computer device based on the integrity label assigned to monitored programs and the integrity label associated with data, another program, or a remote network resource that the monitored program is seeking to access.

Claims

1. A method comprising:

assigning to a program an integrity label that allows the program to write to first data, wherein the privacy label is based on a first characteristic of the program;

assigning to the program a privacy label that allows the program to read from second data, wherein the privacy label is based on a second characteristic of the program; and

determining, by a computer in response to the program seeking to write to the first data, whether to grant or deny the seeking to write the first data based on the integrity label relative to a label associated with the first data, or

determining, by the computer in response to the program seeking to read from the second data, whether to grant or deny the seeking to read from the second data based on the privacy label relative to a label associated with the second data.

2. The method of claim 1 wherein the integrity label or the privacy label is implemented as a positive integer.

3. The method of claim 2 wherein, in response to the first data being associated with another integrity label that is greater than the integrity label, the determining whether to grant or deny the seeking to write the first data results in denying the seeking to write.

4. The method of claim 2 wherein, in response to the second data being associated with another privacy label that is greater than the privacy label, the determining whether to grant or deny the seeking to read the second data results in denying the seeking to read.

5. The method of claim 1 wherein the assignings are performed by a security program that comprises another privacy label and another integrity label, and wherein the security program is restricted from assigning privacy labels or integrity labels of a value greater than the another privacy label and the another integrity label respectively.

6. The method of claim 1 wherein the program is restricted from modifying another program and its data that has an integrity label that is of a value greater than that of the program'"'"'s integrity label.

7. The method of claim 1 wherein the program is restricted from accessing another program and its data that has a privacy label that is of a value greater than that of the program'"'"'s privacy label.

8. A system comprising:

a computing device configured for assigning to a program an integrity label that allows the program to write to first data, wherein the privacy label is based on a first characteristic of the program;

the computing device further configured for assigning by the computer to the program a privacy label that allows the program to read from second data, wherein the privacy label is based on a second characteristic of the program;

the computing device further configured for determining, in response to the program seeking to write to the first data, whether to grant or deny the seeking to write the first data based on the integrity label relative to a label associated with the first data; and

the computing device further configured for determining, in response to the program seeking to read from the second data, whether to grant or deny the seeking to read from the second data based on the privacy label relative to a label associated with the second data.

9. The system of claim 8 wherein the integrity label or the privacy label is implemented as a positive integer.

10. The system of claim 9 wherein, in response to the first data being associated with another integrity label that is greater than the integrity label, the determining whether to grant or deny the seeking to write the first data results in denying the seeking to write.

11. The system of claim 9 wherein, in response to the second data being associated with another privacy label that is greater than the privacy label, the determining whether to grant or deny the seeking to read the second data results in denying the seeking to read.

12. The system of claim 8 wherein the assignings are performed by a security program that comprises another privacy label and another integrity label, and wherein the security program is restricted from assigning privacy labels or integrity labels of a value greater than the another privacy label and the another integrity label respectively.

13. The system of claim 8 wherein the program is restricted from modifying another program and its data that has an integrity label that is of a value greater than that of the program'"'"'s integrity label.

14. The system of claim 8 wherein the program is restricted from accessing another program and its data that has a privacy label that is of a value greater than that of the program'"'"'s privacy label.

15. At least one computer storage media storing computer-executable instructions that, when executed by a computing device, cause the computing device to perform a method comprising:

assigning by a computer to a program an integrity label that allows the program to write to first data, wherein the privacy label is based on a first characteristic of the program;

assigning by the computer to the program a privacy label that allows the program to read from second data, wherein the privacy label is based on a second characteristic of the program;

determining, in response to the program seeking to write to the first data, whether to grant or deny the seeking to write the first data based on the integrity label relative to a label associated with the first data; and

determining, in response to the program seeking to read from the second data, whether to grant or deny the seeking to read from the second data based on the privacy label relative to a label associated with the second data.

16. The at least one computer storage media of claim 15 wherein the integrity label or the privacy label is implemented as a positive integer.

17. The at least one computer storage media of claim 16 wherein, in response to the first data being associated with another integrity label that is greater than the integrity label, the determining whether to grant or deny the seeking to write the first data results in denying the seeking to write.

18. The at least one computer storage media of claim 16 wherein, in response to the second data being associated with another privacy label that is greater than the privacy label, the determining whether to grant or deny the seeking to read the second data results in denying the seeking to read.

19. The at least one computer storage media of claim 15 wherein the assignings are performed by a security program that comprises another privacy label and another integrity label, and wherein the security program is restricted from assigning privacy labels or integrity labels of a value greater than the another privacy label and the another integrity label respectively.

20. The at least one computer storage media of claim 15 wherein the program is restricted from modifying another program and its data that has an integrity label that is of a value greater than that of the program'"'"'s integrity label, or wherein the program is restricted from accessing another program and its data that has a privacy label that is of a value greater than that of the program'"'"'s privacy label.