Dynamic software wrapper

• US 6,587,888 B1
• Filed: 12/15/1999
• Issued: 07/01/2003
• Est. Priority Date: 12/15/1999
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Hollingworth, Dennis, Chieu, David Pai-wei
• Primary Examiner(s): Oberley, Alvin
• Assistant Examiner(s): ZHEN, LI B
• Application Number:
  US09/464,375
• Time in Patent Office: 1,294 Days
• Field of Search: 709/316, 709/310, 709/313
• US Class Current: 719/313
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

The present invention is directed at the implementation of a dynamic wrapper for discovery of non-exported functions and subsequent method interception. A practical usage of dynamic wrappers is for security software packages to augment access controls applied to the wrapped modules. The invention permits interception of distributed component object model (DCOM) client initiated method calls at a DCOM server during runtime. The interceptor of the method call denies or grants access to the DCOM method to be executed. The actual logic to determine access permissions need not be part of the interceptor. The interceptor runs as part of the DCOM server. It contains logic to distinguish at runtime the identity of the principal associated with the DCOM client requesting the execution of the function call. The technique works with commercial-off-the-shelf (COTS) software and does not require modification of the application source code.

Claims

1. In a distributed component object model server, a method for intercepting a non-exported function in an application software module, comprising:

intercepting an operating system defined exported function to obtain a runtime class identifier for a class in which the non-exported function is defined;

locating the non-exported function; and

constructing interception code for the non-exported function;

wherein the non-exported function at least in part lacks compiler produced information in the application software module.

2. The method of claim 1, wherein the steps of intercepting, locating and constructing comprise initializing the distributed component object model server.

3. The method of claim 2, further comprising initializing a service control manager to control executing of the distributed component object model server.

4. The method of claim 3, wherein the step of initializing the distributed component object model server further comprises attaching the interception code to the distributed component object model server.

5. The method of claim 4, wherein the step of initializing the distributed component object model server further comprises registering the non-exported function with the service control manager.

6. The method of claim 5, wherein the step of registering comprises invoking a kernel function for registering the class with the service control manager such that the non-exported function can be accessed with a method call invoked by the client by means of locating the registration in the service control manager.

7. The method of claim 1, further comprising enforcing an access control policy by selectively granting access to a client of the distributed component object model server to the non-exported function by intercepting execution of the non-exported function by means of the interception code.

8. The method of claim 7, wherein the step of enforcing comprises the interception code invoking an access control subroutine for selectively granting access to the non-exported function.

9. The method of claim 8, wherein the step of enforcing occurs when the client accesses the non-exported function.

10. The method of claim 1, wherein the step of locating comprises the steps of:

identifying an interface identifier for the non-exported function by searching the operating system registry using the class identifier; and

retrieving a memory location for the function by searching a table of pointers to functions in the operating system corresponding to a runtime object for the class identifier and the interface identifier.

11. The method of claim 1, comprising intercepting a plurality of non-exported functions in a plurality of application software modules, comprising the steps of:

intercepting an operating system defined exported function to obtain a plurality of runtime class identifiers for a plurality of classes in which the non-exported functions are defined;

locating the non-exported functions; and

constructing interception code for each non-exported function.

12. The method of claim 11, further comprising enforcing a plurality of access control policies by selectively granting access to a plurality of clients of the distributed component object model server to the plurality of non-exported functions by intercepting execution of the each of the plurality of non-exported functions by means of the interception code for each of the plurality of non-exported functions.

13. A system for intercepting a non-exported function in an application software module on a distributed component object model server comprising:

a distributed component object model server comprising a processor and an addressable memory unit for storing the non-exported function, and a registry for storing an identifier identifying the non-exported function;

an exported function stored in the memory unit, the exported function adopted to retrieve the identifier by scanning the registry;

a table for storing a memory address where the non-exported function is stored in the memory unit, the identifier further for identifying the memory address in the table; and

an interceptor software program for intercepting the exported function and for executing the exported function to retrieve the identifier from the registry, the interceptor software program further for locating the non-exported function in the memory unit by locating the memory address of the non-exported function in the table using the identifier, the interceptor software program further comprising interception code for intercepting the non-exported function;

wherein the non-exported function at least in part lacks compiler produced symbol information in the application software module.

14. The system of claim 13, wherein the interceptor software program is for creating an object for scanning the registry for the identifier, and for locating the memory address in the registry.

15. The system of claim 13, the interceptor software program further comprising an access control subroutine for selectively granting access to the non-exported function to a client of the distributed component object model server.

16. The system of claim 13, wherein the memory unit is for storing a plurality of non-exported functions.

17. The system of claim 16, wherein the registry is for storing an identifier corresponding to each of a related group of non-exported functions.

18. The system of claim 17, wherein the table is for storing memory addresses for the related non-exported functions indexed by corresponding identifiers.

19. The system of claim 18, wherein the exported function is adopted to retrieve the corresponding identifiers for the non-exported functions from the registry.

20. The system of claim 19, wherein the interceptor software program is for executing the exported function to retrieve the identifiers, and for locating the corresponding non-exported functions in the memory unit by locating the corresponding memory addresses for the non-exported functions in the registry by locating the identifiers in the table, the interceptor software program further comprising interception code for intercepting the corresponding non-exported functions.

21. A system for intercepting a non-exported function in an application software module on a distributed component object model server comprising:

a distributed component object model server comprising a processor and an addressable memory unit for storing the non-exported function, and a registry for storing an identifier identifying the non-exported function;

an exported function stored in the memory unit, the exported function adopted to retrieve the identifier by scanning the registry;

a table for storing a memory address where the non-exported function is stored in the memory unit, the identifier further for identifying the memory address in the table; and

an interceptor software program for intercepting the exported function and for executing the exported function to retrieve the identifier from the registry, the interceptor software program further for locating the non-exported function in the memory unit by locating the memory address of the non-exported function in the table using the identifier, the interceptor software program further comprising interception code for intercepting the non-exported function;

wherein the non-exported function at least in part lacks compiler produced symbol information in the application software module;

wherein the interceptor software program further comprises an access control subroutine for selectively granting access to the non-exported function to a client of the distributed component object model server;

wherein the memory unit is for storing a plurality of non-exported functions;

wherein the registry is for storing an identifier corresponding to each of a related group of non-exported functions;

wherein the table is for storing memory addresses for the related non-exported functions indexed by corresponding identifiers;

wherein the exported function is adopted to retrieve the corresponding identifiers for the non-exported functions from the registry;

wherein the interceptor software program is for executing the exported function to retrieve the identifiers, and for locating the corresponding non-exported functions in the memory unit by locating the corresponding memory addresses for the non-exported functions in the registry by locating the identifiers in the table, the interceptor software program further comprising interception code for intercepting the corresponding non-exported functions.