Protected execution environments within a computer system
First Claim
1. A method of providing a protected execution environment on a computer comprising:
- categorizing each application installed on the computer as authorized or not authorized to modify the protected execution environment. intercepting an input/output request for a file from an application;
determining if the application is authorized to modify the protected execution environment;
creating a redirected input/output request to an alternate environment when the application is not authorized to modify the protected execution environment and the file is within the protected execution environment; and
submitting the redirected input/output request to a file system manager.
19 Assignments
0 Petitions
Accused Products
Abstract
A protected execution agent installs itself within a file system manager on the computer to control modifications to a protected execution environment by intercepting I/O requests from applications. If an unauthorized application attempts to modify the protected execution environment, the protected execution agent terminates the original I/O request and creates a redirected I/O request that specifies a corresponding directory path within an alternate environment. The requested I/O operation is a carried out by the file system against the alternate environment. A configuration utility is responsible for determining which installed applications are authorized to change the protected execution environment. The configuration utility also establishes a parent-child relationship between an unauthorized application that invokes or “spawns” an authorized application, with the authorized child application being considered unauthorized when performing processes on behalf of the unauthorized parent application.
-
Citations
34 Claims
-
1. A method of providing a protected execution environment on a computer comprising:
-
categorizing each application installed on the computer as authorized or not authorized to modify the protected execution environment. intercepting an input/output request for a file from an application;
determining if the application is authorized to modify the protected execution environment;
creating a redirected input/output request to an alternate environment when the application is not authorized to modify the protected execution environment and the file is within the protected execution environment; and
submitting the redirected input/output request to a file system manager. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A method for operating a computer system with a protected execution environment comprising:
-
executing a configuration utility to categorize a plurality of applications installed on the computer system as authorized or not authorized to modify the protected execution environment;
defining the protected execution environment based on the authorized applications; and
installing a protected execution agent in a file system to intercept input/output requests submitted by the applications, wherein the protected execution agent directs an input/output request to an alternate environment if the application that submitted the request is not authorized and the request is directed to the protected execution environment, and wherein the alternate environment is defined by the configuration utility when categorizing the plurality of applications. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22)
-
-
23. A method of determining a category for an application on a computer comprising:
-
categorizing the application as a first type;
creating a directory in a second directory structure for the application when it is a first type, wherein the second directory structure mirrors a first directory structure that contains an executable for the application;
creating a null entry for the executable for the application in the directory in the second directory structure when the application is the first type; and
querying the existence of the executable for the application in the second directory structure, wherein the application is determined to be the first type when the executable exists.
-
-
24. A computer-readable medium having stored thereon computer-executable instructions for performing a method comprising:
-
categorizing each application installed on the computer as authorized or not authorized to modify the protected execution environment. intercepting an input/output request for a file from an application;
determining if the application is authorized to modify the protected execution environment;
creating a redirected input/output request to an alternate environment when the application is not authorized to modify the protected execution environment and the file is within the protected execution environment, and submitting the redirected input/output request to a file system manager. - View Dependent Claims (25, 26, 27, 28, 29, 30)
-
-
31. The computer-readable medium of claim 31 having further computer-readable instructions comprising:
-
maintaining an association between an executing application and a directory path for the executable for the executing application; and
specifying the directory path for the executable associated with the executing application when querying for the existence of the executable in the mirror data structure.
-
-
32. A computer system comprising:
-
a processing unit;
a memory coupled to the processing unit through a system bus;
a computer-readable medium coupled to the processing through the system bus; and
a protected environment agent executing from the computer-readable medium, wherein the protected environment agent causes the processing unit to intercept input/output requests submitted by applications executing on the computer system, causes the processing unit to redirect each input/output request to an alternate environment if the application that submitted the request is not authorized to modify a protected execution environment and the request is directed to the protected execution environment and further categorizes each application installed on the computer as authorized or not authorized to modify the protected execution environment.
-
-
33. The computer system of claim 33 further comprising:
a configuration utility executing from the computer-readable medium, wherein the configuration utility causes the processing unit to categorize each application installed on the computer system as authorized or not authorized to modify the protected execution environment and further to cause the processing unit to define the protected execution environment to contain directories associated with the authorized applications.
-
34. A computer system comprising:
-
a first means for processing;
a second means coupled to the first means through a system bus;
a third means coupled to the first means through the system bus; and
a fourth means for executing from the computer-readable medium, wherein the fourth means causes the first means to intercept input/output requests submitted by applications executing on the computer system, causes the first means to redirect each input/output request to an alternate environment if the application that submitted the request is not authorized to modify a protected execution environment and the request is directed to the protected execution environment and further categorizes each application installed on the computer as authorized or not authorized to modify the protected execution environment.
-
Specification