Fine-grained security in federated data sets

• US 20130031364A1
• Filed: 07/29/2011
• Published: 01/31/2013
• Est. Priority Date: 07/19/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Gerrity, Daniel A., Tegreene, Clarence T.
• Granted Patent: US 8,943,313 B2
• Time in Patent Office: Days
• US Class Current: 713/162
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 21/87 by means of encapsulation, e.g. for integrated circuits

Abstract

A data processing system, a server such as a federated server, a computer system, and like devices, and associated operating methods can be configured to support fine-grained security including resource allocation and resource scheduling. A data processing system can comprise a federated server operable to access data distributed among a plurality of remote data sources upon request from a plurality of client users and applications; and logic executable on the federated server. The logic can be operable to enforce fine-grained security operations on a plurality of federated shared data sets distributed among the plurality of remote data sources.

Claims

1. A data processing system comprising:

a federated server operable to access data distributed among a plurality of remote data sources upon request from a plurality of client users and applications; and

logic executable on the federated server, the logic operable to enforce fine-grained security operations on a plurality of federated shared data sets distributed among the plurality of remote data sources.

2. The data processing system according to claim 1 wherein the fine-grained security operations are operations on data elements more fine-grained than a memory page or virtual page size.

3. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to perform hardware scheduling and enforce fine-grained security operations on selected hardware devices and components.

4. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to manage access of virtual memory and enforce fine-grained security operations on selected memory regions in the virtual memory.

5. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to manage running of applications on a computer selected from among a plurality of computers networked to the federated server and enforce fine-grained security operations on the selected computer.

6. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to execute a control flow integrity instruction specified to verify changes in control flow and respond to verification failure by trap or exception.

7. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to execute a control flow integrity instruction specified to verify changes in control flow comprising conditions of instruction length or instruction alignment.

8. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to execute a control flow integrity instruction specified to verify changes in control flow comprising changes resulting from direct branches, indirect branches, direct calls, indirect calls, returns, and exceptions.

9. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to execute a control flow integrity instruction comprising an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and a trap or exception is generated if none of the at least one condition matches, the immediate constant bitmask comprising bitmask bits operable to identify conditions selected from a group consisting of;

whether the control flow integrity instruction is reachable through sequential execution from a previous instruction;

whether the control flow integrity instruction is target of an unconditional direct branch;

whether the control flow integrity instruction is target of a conditional direct branch;

whether the control flow integrity instruction is target of a non-relative direct branch;

whether the control flow integrity instruction is target of an indirect branch;

whether the control flow integrity instruction is target of a relative function call;

whether the control flow integrity instruction is target of a non-relative or absolute function call;

whether the control flow integrity instruction is target of an indirect function call; and

whether the control flow integrity instruction is target of a function return instruction.

10. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to manage access to memory and enforce fine-grained security operations on selected start and end boundaries and selected granularity in the memory with selected permissions.

11. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to manage access to memory and enforce fine-grained security operations in the memory with permissions selected from a group consisting of write enablement, read enablement, execution enablement, and duration of enablement.

12. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to manage access to memory in memory blocks and enforce fine-grained security operations by individually protecting selected memory blocks.

13. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to manage running of applications in a plurality of virtual machines and enforce fine-grained security operations including assigning data to a selected virtual machine.

14. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to perform channel encryption operations on a communication channel that communicates information between a selected processor and a selected memory, wherein the logic operable to enforce fine-grained security operations is further operable to perform an operation selected from a group consisting of;

decrypting information encrypted by the selected processor;

decrypting address and data information encrypted by the selected processor and store data at the address;

partially decrypting information encrypted by the selected processor;

performing stream encryption of information communicated on the communication channel wherein processor and memory sides of the communication channel are assigned a key;

performing channel encryption operations on the communication channel for information that is storage encrypted wherein the storage-encrypted information is encrypted by the selected processor, stored in the selected memory, accessed from the selected memory, and decrypted by the selected processor; and

performing time-varying encryption.

15. The data processing system according to claim 1 wherein the logic operable to enforce fine-grained security operations includes:

logic operable to create at least one cryptographic security perimeter enclosing at least one selected region of memory and manage information communication between a processor and the at least one selected region of memory.

16. A federated system comprising:

a federated server operable to access data via distributed queries over data stored in a plurality of remote data sources; and

at least one wrapper operable for communicating among the plurality of remote data sources, the at least one wrapper containing characteristics and determining fine-grained security operations for selected ones of the remote data sources.

17. The federated system according to claim 16 wherein the fine-grained security operations are operations on data elements more fine-grained than a memory page or virtual page size.

18. The federated system according to claim 16 wherein the wrapper includes:

a software module containing characteristics about the plurality of remote data sources.

19. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to set permissions defining fine-grained security operations for selectively accessing data on the plurality of remote data sources.

20. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to set hardware scheduling and fine-grained security operations on selected hardware devices and components.

21. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to set access to virtual memory and fine-grained security operations on selected memory regions in the virtual memory.

22. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to determine applications running on a computer selected from among a plurality of computers networked to the federated server and fine-grained security operations on the selected computer.

23. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify a control flow integrity instruction to verify changes in control flow and respond to verification failure by trap or exception.

24. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify a control flow integrity instruction to verify changes in control flow comprising conditions of instruction length or instruction alignment.

25. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify a control flow integrity instruction to verify changes in control flow comprising changes resulting from direct branches, indirect branches, direct calls, indirect calls, returns, and exceptions.

26. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify a control flow integrity instruction comprising an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and a trap or exception is generated if none of the at least one condition matches, the immediate constant bitmask comprising bitmask bits operable to identify conditions selected from a group consisting of;

whether the control flow integrity instruction is reachable through sequential execution from a previous instruction;

whether the control flow integrity instruction is target of an unconditional direct branch;

whether the control flow integrity instruction is target of a conditional direct branch;

whether the control flow integrity instruction is target of a non-relative direct branch;

whether the control flow integrity instruction is target of an indirect branch;

whether the control flow integrity instruction is target of a relative function call;

whether the control flow integrity instruction is target of a non-relative or absolute function call;

whether the control flow integrity instruction is target of an indirect function call; and

whether the control flow integrity instruction is target of a function return instruction.

27. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify access to memory and fine-grained security operations on selected start and end boundaries and selected granularity in the memory with selected permissions.

28. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify access to memory and fine-grained security operations in the memory with permissions selected from a group consisting of write enablement, read enablement, execution enablement, and duration of enablement.

29. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify access to memory in memory blocks and fine-grained security operations by individually protecting selected memory blocks.

30. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify applications to run in a plurality of virtual machines and fine-grained security operations including assigning data to a selected virtual machine.

31. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify channel encryption operations on a communication channel that communicates information between a selected processor and a selected memory, wherein the wrapper portion is further operable to specify an operation selected from a group consisting of;

decrypting information encrypted by the selected processor;

decrypting address and data information encrypted by the selected processor and store data at the address;

partially decrypting information encrypted by the selected processor;

performing stream encryption of information communicated on the communication channel wherein processor and memory sides of the communication channel are assigned a key;

performing channel encryption operations on the communication channel for information that is storage encrypted wherein the storage-encrypted information is encrypted by the selected processor, stored in the selected memory, accessed from the selected memory, and decrypted by the selected processor; and

performing time-varying encryption.

32. The federated system according to claim 16 wherein the wrapper includes:

a wrapper portion operable to specify at least one cryptographic security perimeter enclosing at least one selected region of memory and information communication between a processor and the at least one selected region of memory.

33. A computer system comprising:

a network interface operable to communicate data among a plurality of remote data sources and a plurality of client users and applications;

a processor operatively coupled to the network interface and operable to control fine-grained security operations on a plurality of federated shared data sets distributed among the plurality of remote data sources.

34. The computer system according to claim 33 wherein the processor includes:

a process operable to perform fine-grained security operations on data elements more fine than a memory page or virtual page size.

35. The computer system according to claim 33 wherein the processor includes:

a process operable to access data distributed among the plurality of remote data sources upon request from the plurality of client users and applications.

36-83. -83. (canceled)