SECURE COMPUTING DEVICE USING DIFFERENT CENTRAL PROCESSING RESOURCES

• US 20140298454A1
• Filed: 04/01/2013
• Published: 10/02/2014
• Est. Priority Date: 04/01/2013
• Status: Active Application

• Current Assignee: Updraft LLC
• Original Assignee: UniqueSoft, LLC
• Inventors: Heng, Terrence Ming Swee, Davis, Walter Lee
• Granted Patent: US 10,275,593 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

A computing device includes central processing resources, memory, a network interface, and a security control module. The security control module determines when to change operation of a program of the computing device. When the operation of the program is to be changed, the security control module identifies a first processing resource of the central processing resources that is currently assigned to execute the program and selects a second processing resource of the central processing resources for subsequent execution the program. The security control module then ascertains first execution settings of the program as used by the first processing resource and facilitates conversion of the first execution settings into second execution settings for the second processing resource. The security control module then de-assigns the first processing resource from executing the program and assigns the second processing resource to execute the program.

Claims

1. A method for reducing adverse impact of malicious software in a computing device, the method comprises:

determining to change operation of a program of the computing device; and

when operation of the program is to be changed;

identifying a first processing resource of a plurality of processing resources of the computing device that is currently assigned to execute the program;

selecting a second processing resource of the plurality of processing resources for subsequent execution the program;

ascertaining first execution settings of the program as used by the first processing resource;

facilitating conversion of the first execution settings into second execution settings for the second processing resource; and

de-assigning the first processing resource from executing the program and assigning the second processing resource to execute the program.

2. The method of claim 1, wherein the determining to change the program comprises at least one of:

utilizing a pseudo random sequence to identify, at pseudo random time intervals, the program from a plurality of programs;

determining when the program has been evoked a predetermined number of time or a pseudo random number of times;

determining that the program is operating outside of anticipated normal operating parameters; and

receiving a command from a trusted management device.

3. The method of claim 1 further comprises:

the plurality of processing resources including a plurality of central processing units (CPUs) and a plurality of corresponding operating systems (OSs), wherein the first processing resource includes a first CPU of the plurality of CPUs and a first corresponding OS of the plurality of corresponding OSs and the second processing resource includes a second CPU of the plurality of CPUs and a second corresponding OS of the plurality of corresponding OSs; and

the program including one of a plurality of user applications or one of a plurality of system applications.

4. The method of claim 1 further comprises:

the first processing resource including a first central processing unit (CPU) of a plurality of CPUs and a first operating system (OS) of the plurality of OSs;

the second processing resource includes at least one of a different CPU of the plurality of CPUs and a different OS of the plurality of OSs than the first processing resource; and

the program including one of a plurality of user applications or one of a plurality of system applications.

5. The method of claim 1, wherein the selecting a second processing resource comprises at least one of:

utilizing a pseudo random sequence to select, at pseudo random time intervals, the second processing resource;

utilizing a process load distribution function to select the second processing resource;

determining that the first processing resource is operating outside of anticipated normal operating parameters; and

receiving a command from a trusted management device.

6. The method of claim 1, wherein the ascertaining first execution settings of the program comprises at least one of:

ascertaining memory management information regarding the program as used by the first processing resource;

ascertaining file system information regarding the program as used by the first processing resource;

ascertaining process management information regarding the program as used by the first processing resource;

ascertaining security information regarding the program as used by the first processing resource; and

ascertaining an instruction set type for the first processing resource.

7. The method of claim 1, wherein the facilitating conversion of the first execution settings into the second execution settings comprises at least one of:

determining a difference between memory management function of the first processing resource and the second processing resource and converting, based on the memory management difference, memory management information regarding execution of the program by the first processing resource into memory management information regarding execution of the program by the second processing resource;

determining a difference between file system management function of the first processing resource and the second processing resource and converting, based on the file system management difference, file system information regarding execution of the program by the first processing resource into file system information regarding execution of the program by the second processing resource;

determining a difference between process management function of the first processing resource and the second processing resource and converting, based on the process management difference, process management information regarding execution of the program by the first processing resource into process management information regarding execution of the program by the second processing resource;

determining a difference between security management function of the first processing resource and the second processing resource and converting, based on the security management difference, security information regarding execution of the program by the first processing resource into security information regarding execution of the program by the second processing resource; and

determining an instruction set type of the second processing resource and converting, based on the instruction set type of the second processing resource, operational instructions of the program into machine language for a processor of the second processing resource.

8. The method of claim 1, wherein the determining to change operation of a program comprises:

determining to change operation of a portion of the program, wherein the program includes;

an operating system (OS) that includes a plurality of OS functions, wherein each OS function includes one or more OS function sub-routines and wherein a portion of the OS includes one of the OS functions or the corresponding one or more OS function sub-routines;

a user application that includes a plurality of user application functions, wherein one of the user application functions includes one or more user application function sub-routines, wherein a portion of the user application includes the one of the user application functions or the one or more user application function sub-routines;

or

a system application that includes a plurality of system application functions, wherein one of the system application functions includes one or more system application function sub-routines, wherein a portion of the system application includes the one of the system application functions or the one or more system application function sub-routines.

9. A method for reducing adverse impact of malicious software in a computing device, the method comprises:

determining to change operation of a program of the computing device; and

when operation of the program is to be changed, determining whether to change the program and a processing resource of a plurality of processing resources currently assigned to execute the program;

when the program and the processing resource are to be changed;

facilitating a change of the program to produce a changed program;

selecting a second processing resource of the plurality of processing resources to execute the changed program;

ascertaining first execution settings of the program as used by a first processing resource for executing the program;

facilitating conversion of the first execution settings into second execution settings for the second processing resource; and

de-assigning the first processing resource from executing the program and assigning the second processing resource to execute the new program.

10. The method of claim 9, wherein the facilitating a change of the program comprises at least one of:

determining to select a new version of the program from a plurality of versions of the program;

determining to generate new code for the program;

determining to select a new version of a portion of the program from a plurality of versions of the portion of the program; and

determining to generate new code for a portion of the program.

11. The method of claim 9, wherein the facilitating conversion of the first execution settings into second execution settings comprises at least one of:

determining storage location of the changed program and updating pointers to point to the change program instead of pointing to the program;

determining a difference between memory management function of the first processing resource and the second processing resource and converting, based on the memory management difference, memory management information regarding execution of the program by the first processing resource into memory management information regarding execution of the changed program by the second processing resource;

determining a difference between file system management function of the first processing resource and the second processing resource and converting, based on the file system management difference, file system information regarding execution of the program by the first processing resource into file system information regarding execution of the changed program by the second processing resource;

determining a difference between process management function of the first processing resource and the second processing resource and converting, based on the process management difference, process management information regarding execution of the program by the first processing resource into process management information regarding execution of the changed program by the second processing resource;

determining a difference between security management function of the first processing resource and the second processing resource and converting, based on the security management difference, security information regarding execution of the program by the first processing resource into security information regarding execution of the changed program by the second processing resource; and

determining an instruction set type of the second processing resource and converting, based on the instruction set type of the second processing resource, operational instructions of the program into machine language for a processor of the second processing resource.

12. A computing device comprises:

a plurality of central processing resources;

memory operably coupled to at least one of the plurality of central processing resources;

a network interface operably coupled to at least one of the plurality of central processing resources; and

a security control module operable to;

determine to change operation of a program of the computing device; and

when operation of the program is to be changed;

identify a first processing resource of the plurality of central processing resources that is currently assigned to execute the program;

select a second processing resource of the plurality of central processing resources for subsequent execution the program;

ascertain first execution settings of the program as used by the first processing resource;

facilitate conversion of the first execution settings into second execution settings for the second processing resource; and

de-assign the first processing resource from executing the program and assign the second processing resource to execute the program.

13. The computing device of claim 12, wherein the security control module is further operable to determine to change the program by at least one of:

utilizing a pseudo random sequence to identify, at pseudo random time intervals, the program from a plurality of programs;

determining when the program has been evoked a predetermined number of time or a pseudo random number of times;

determining that the program is operating outside of anticipated normal operating parameters; and

receiving a command from a trusted management device.

14. The computing device of claim 12 further comprises:

the plurality of central processing resources including one or more of;

a plurality of processing modules;

a plurality of memory control units;

a plurality of input/output interface control units;

a plurality of peripheral control units; and

a plurality of video graphics processing units;

additional memory including one or more of;

a plurality of main memories; and

a plurality of external memories; and

the program including one of a plurality of user applications or one of a plurality of system applications.

15. The computing device of claim 12 further comprises:

the first processing resource including a first central processing unit (CPU) of a plurality of CPUs and a first operating system (OS) of the plurality of OSs;

the second processing resource includes at least one of a different CPU of the plurality of CPUs and a different OS of the plurality of OSs than the first processing resource; and

the program including one of a plurality of user applications or one of a plurality of system applications.

16. The computing device of claim 12, wherein the security control module is further operable to select the second processing resource by at least one of:

utilizing a pseudo random sequence to select, at pseudo random time intervals, the second processing resource;

utilizing a process load distribution function to select the second processing resource;

determining that the first processing resource is operating outside of anticipated normal operating parameters; and

receiving a command from a trusted management device.

17. The computing device of claim 12, wherein the security control module is further operable to ascertain the first execution settings of the program by at least one of:

ascertaining memory management information regarding the program as used by the first processing resource;

ascertaining file system information regarding the program as used by the first processing resource;

ascertaining process management information regarding the program as used by the first processing resource;

ascertaining security information regarding the program as used by the first processing resource; and

ascertaining an instruction set type for the first processing resource.

18. The computing device of claim 12, wherein the security control module is further operable to facilitate conversion of the first execution settings into the second execution settings by at least one of:

determining a difference between memory management function of the first processing resource and the second processing resource and converting, based on the memory management difference, memory management information regarding execution of the program by the first processing resource into memory management information regarding execution of the program by the second processing resource;

determining a difference between file system management function of the first processing resource and the second processing resource and converting, based on the file system management difference, file system information regarding execution of the program by the first processing resource into file system information regarding execution of the program by the second processing resource;

determining a difference between process management function of the first processing resource and the second processing resource and converting, based on the process management difference, process management information regarding execution of the program by the first processing resource into process management information regarding execution of the program by the second processing resource;

determining a difference between security management function of the first processing resource and the second processing resource and converting, based on the security management difference, security information regarding execution of the program by the first processing resource into security information regarding execution of the program by the second processing resource; and

determining an instruction set type of the second processing resource and converting, based on the instruction set type of the second processing resource, operational instructions of the program into machine language for a processor of the second processing resource.

19. The computing device of claim 12, wherein the security control module is further operable to determine to change operation of a program by:

determining to change operation of a portion of the program, wherein the program includes;

an operating system (OS) that includes a plurality of OS functions, wherein each OS function includes one or more OS function sub-routines and wherein a portion of the OS includes one of the OS functions or the corresponding one or more OS function sub-routines;

a user application that includes a plurality of user application functions, wherein one of the user application functions includes one or more user application function sub-routines, wherein a portion of the user application includes the one of the user application functions or the one or more user application function sub-routines;

or

a system application that includes a plurality of system application functions, wherein one of the system application functions includes one or more system application function sub-routines, wherein a portion of the system application includes the one of the system application functions or the one or more system application function sub-routines.

20. A computing device comprises:

a plurality of central processing resources;

memory operably coupled to at least one of the plurality of central processing resources;

a network interface operably coupled to at least one of the plurality of central processing resources; and

a security control module operable to;

determine to change operation of a program of the computing device; and

when operation of the program is to be changed, determine whether to change the program and a first processing resource of a plurality of processing resources currently assigned to execute the program;

when the program and the processing resource are to be changed;

facilitate a change of the program to produce a changed program;

select a second processing resource of the plurality of central processing resources to execute the changed program;

ascertain first execution settings of the program as currently used by a first processing resource of the plurality of central processing resources for executing the program;

facilitate conversion of the first execution settings into second execution settings for the second processing resource; and

de-assign the first processing resource from executing the program and assign the second processing resource to execute the changed program.

21. The computing device of claim 20, wherein the security control module is further operable to facilitating a change of the program by at least one of:

determining to select a new version of the program from a plurality of versions of the program;

determining to generate new code for the program;

determining to select a new version of a portion of the program from a plurality of versions of the portion of the program; and

determining to generate new code for a portion of the program.

22. The computing device of claim 20, wherein the security control module is further operable to facilitating conversion of the first execution settings into second execution settings by at least one of:

determining storage location of the changed program and updating pointers to point to the change program instead of pointing to the program;

determining a difference between memory management function of the first processing resource and the second processing resource and converting, based on the memory management difference, memory management information regarding execution of the program by the first processing resource into memory management information regarding execution of the changed program by the second processing resource;

determining a difference between file system management function of the first processing resource and the second processing resource and converting, based on the file system management difference, file system information regarding execution of the program by the first processing resource into file system information regarding execution of the changed program by the second processing resource;

determining a difference between process management function of the first processing resource and the second processing resource and converting, based on the process management difference, process management information regarding execution of the program by the first processing resource into process management information regarding execution of the changed program by the second processing resource;

determining a difference between security management function of the first processing resource and the second processing resource and converting, based on the security management difference, security information regarding execution of the program by the first processing resource into security information regarding execution of the changed program by the second processing resource; and

determining an instruction set type of the second processing resource and converting, based on the instruction set type of the second processing resource, operational instructions of the program into machine language for a processor of the second processing resource.

23. The computing device of claim 20 further comprises:

the plurality of processing resources including one or more of;

a plurality of processing modules;

a plurality of memory control units;

a plurality of input/output interface control units;

a plurality of peripheral control units; and

a plurality of video graphics processing units;

additional memory including one or more of;

a plurality of main memories; and

a plurality of external memories; and

the program including one of a plurality of user applications or one of a plurality of system applications.