System for reverse sandboxing

• US 6,836,888 B1
• Filed: 03/17/2000
• Issued: 12/28/2004
• Est. Priority Date: 03/17/2000
• Status: Expired due to Fees

• Current Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Basu, Anindya, Mittra, Suvo
• Primary Examiner(s): An, Meng-Al T.
• Assistant Examiner(s): ALI, SYED J
• Application Number:
  US09/528,381
• Time in Patent Office: 1,747 Days
• Field of Search: 713/160-161, 713/164-165, 713/187, 713/200-202, 718/1, 718/100, 718/102-108, 717/114, 717/116-118, 709/1, 709/100, 709/102-108
• US Class Current: 718/104
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A reverse sandbox extends a private computing environment onto a standalone host in a public environment. The reverse sandbox includes a service director that receives service requests, classifies the service requests in accordance with security policies, selects a processing stack based on the classification and communicates the service request to the selected processing stack. A reverse sandbox embodiment may also include a compliance supervisor that constructs processing stacks with mediation modules based upon security policies. The mediation modules of the selected processing stack modify the service request and provide the modified service request to the resources of the standalone host.

Claims

1. A system including a processor, and a collection of resources interacting with said processor, said resources including at least a memory and a library of executable modules that are supported by an operating system, the improvement comprising:

a plurality of processing stacks for dividing the system'"'"'s computing environment into an unprotected portion and a protected portion, where the protected portion is protected from interloping processes in accord with an administratively specified schema, by mediating interactions between executing processes within said system and said resources, each of said stacks including a predefined set of at least one mediation module that processes a request by at least one of said executing processes, which request is to be applied a resource of said collection of resources to form a signal, if appropriate pursuant to and in accord with such schema, that is applied to said resource of said collection of resources; and

a service director module that intercepts requests of different types that are directed to said resources, classifies said requests in accordance with said types of said requests, each different one of said resources being responsive to requests of a different type, and directs said requests to different ones of said processing stacks, based on said classifying.

2. The system of claim 1 wherein said at least one resource to which said signal is applied develops an output signal that is accepted by said at least one mediation modules.

3. The system of claim 1, wherein at least one processing stack of said plurality of processing stacks comprises an ordered sequence of at least two mediation modules.

4. The system of claim 1, wherein said service director receives a request from an application that is active on said system and applies said request to said at least one mediation module.

5. The system of claim 4, wherein said mediation module receives a return signal from said at least one resource of said collection of resources, processes said return signal to form a processed ret signal, and sends said processed return signal to said application.

6. The system of claim 5 wherein said at least one resource of said collection of resources sends said processed return signal via said service director.

7. The system of claim 1, wherein said at least one mediation module is based upon a chosen security policy.

8. The system of claim 1, wherein said at least one mediation module in said processing stack performs encryption.

9. The system of claim 1, wherein said mediation module is a namespace manager.

10. The system of claim 1, wherein said mediation module performs authentication.

11. The system of claim 1 wherein said mediation module is a secure file system.

12. The system of claim 1, wherein said service director includes:

a service request classifier that classifies a received service request; and

a processing stack selector that selects a processing stack based upon said classification, and communicates said service request to said selected processing stack.

13. The system of claim 1, wherein said service director includes a service request classifier that classifies a service request based upon the type of service request and arguments of the service request.

14. The system of claim 1 further comprising a connection to a network.

15. The system of claim 14 wherein said connection is secure.

16. The system of claim 14, wherein said network is a virtual private network.

17. The system of claim 16 wherein said connection is secured.

18. The system of claim 17 wherein said connection is secured through encryption.

19. The system of claim 1 further comprising a compliance supervisor that is coupled to said processing stacks, and to said service director, and is adapted for receiving security policy information from outside said system.

20. The system of claim 19, wherein said compliance supervisor receives said security policy information from a virtual private network.

21. The system of claim 19, wherein said compliance supervisor includes a processing stack modifier that modifies said processing stack based upon a received security policy.

22. The system of claim 19, wherein said compliance supervisor includes a processing stack creator that creates a processing stack based upon said security policy.

23. The system of claim 1, wherein said at least one mediation module includes at least one authentication code retriever that retrieves an authentication code and a validation system that validates said service request against said authentication code.

24. The system of claim 1 wherein said operating system includes means to prevent implication of an operating system breach from an administrative user breach.

25. The system of claim 1 wherein said service director and said processing stacks are embedded in a loadable library of C language executable modules.

26. The system of claim 1 further comprising a read-only program store that is read by said system upon boot-up.

27. A system including a processor, and a collection of resources interacting with said processor, said resources including at least a memory and a library of executable modules that are supported by an operating system, the improvement comprising:

a plurality of processing stacks, each including a predefined set of at least one mediation module that processes an applied signal to form a signals that is applied to said at least one resource of said collection of resources;

a service director module that intercepts requests of different types that are directed to said resources, classifies said requests in accordance with said types of said requests, each different one of said resources being responsive to requests of a different type, and directs said requests to different ones of said processing stacks, based on said classifying; and

a read-only program store that is read by said system upon boot-up;

wherein said system includes an operating system, and said read-only program store contains a program module for verifying the operating system, and authentication program modules for authenticating software present in said memory of said system.

28. The system of claim 27 where said software that is authenticated by said authentication program modules includes software that forms an operating system of said system.

29. The system of claim 28 where said authentication program modules develop a cryptographic hash of software to be authenticated.

30. A storage medium that stores a control routine for use by a system to assure security of said system, the control routine including instructions that, when said storage medium is coupled to said system, the instructions are adapted to:

boot said system with an authenticated operating system (AOS) located on said storage medium;

verifying an operating system of said system that is resident on said system (VOS);

transferring control of said system from said AOS to said VOS when said VOS is verified, said transfer being sufficiently effective to allow intended operation of said system with said storage medium being decoupled from said system.

31. The storage medium of claim 30, wherein said instructions, when they boot said system, verify said operating system of said system by reading executable modules of said operating system of said system, determining a cryptographic hash for said executable modules, and comparing said cryptographic hash to a known value.

32. The storage medium of claim 30 where said control routine further includes steps for;

verifying software that implements a reverse sandbox on said system; and

transferring control of said standalone host to said reverse sandboxing software.

33. The storage medium of claim 30 further comprising reverse sandbox software to be installed in said system.

34. The storage medium of claim 33 wherein said reverse sandbox software includes a service director, a compliance supervisor, and a processing stack including at least one mediation module.