Manifest-based trusted agent management in a trusted operating system environment

• US 7,634,661 B2
• Filed: 08/18/2005
• Issued: 12/15/2009
• Est. Priority Date: 11/16/2001
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Simon, Daniel R., England, Paul, Peinado, Marcus, Benaloh, Josh D.
• Primary Examiner(s): Abrishamkar; Kaveh
• Application Number:
  US11/206,585
• Publication Number:
  US 20060005230A1
• Time in Patent Office: 1,580 Days
• Field of Search: None
• US Class Current: 713/176
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Manifest-based trusted agent management in a trusted operating system environment includes receiving a request to execute a process is received and setting up a virtual memory space for the process. Additionally, a manifest corresponding to the process is accessed, and which of a plurality of binaries can be executed in the virtual memory space is limited based on indicators, of the binaries, that are included in the manifest.

Claims

1. A computer readable storage medium having stored thereon instructions that, when executed by a computing device, cause the computing device to:

obtain a source manifest associated with a trusted application of the computing device that relates to a secret associated with the trusted application to be exported to a destination application of the computing device, the source manifest comprising;

data sufficient to associate the source manifest with the secret; and

an export statement list having;

a first portion including an identifier of the source manifest associated with the trusted application;

a second portion including an identifier of a destination manifest associated with the destination application;

a third portion derived from the identifiers in both the first portion and the second portion by generating a digital signature over the first and second portions; and

use the source manifest at the computing device to enable export of the secret to the destination application.

2. A computer readable storage medium as recited in claim 1, wherein the export statement list further comprises:

a fourth portion including an identification of one or more particular computing devices on which the source manifest can be used to export the secret.

3. A computer readable storage medium as recited in claim 1, wherein the second portion includes identifiers of a plurality of manifests associated with a plurality of additional applications of the computing device to which the secret can be exported.

4. A computer readable storage medium as recited in claim 3, wherein each of the plurality of additional applications is a newer version of the destination application.

5. A computer readable storage medium as recited in claim 1, wherein the secret enables the destination application to make use of one or more binaries associated with the trusted application.

6. A computer readable storage medium as recited in claim 1, wherein the secret is securely stored by a trusted core component provided by an operating system of the computing device.

7. A computer readable storage medium as recited in claim 6, wherein the trusted core component is configured to process the source manifest to determine whether to allow the destination application to retrieve the securely stored secret.

8. A computer readable storage medium as recited in claim 1, wherein the data sufficient to associate the source manifest with the secret comprises a key, a unique name, and a version number corresponding to the source manifest.

9. A computer readable storage medium as recited in claim 1, wherein the instructions, when executed by the computing device, further cause the computing device to:

obtain a request to export the secret associated with the source manifest to the destination application;

detect the identifier associated with the destination manifest in the source manifest in response to the request; and

enable the destination application to access the secret when the identifier is detected.

10. A method comprising:

using a computing device to export one or more secrets associated with a trusted application from the trusted application to a destination application by;

storing the one or more secrets in memory associated with the computing device;

exposing a source manifest associated with the trusted application that relates to the one or more secrets, the source manifest including;

data sufficient to associate the source manifest with the one or more secrets stored in the memory; and

an identifier corresponding to a destination manifest associated with the destination application to enable the destination application to retrieve the one or more secrets from the memory;

when the destination application attempts to retrieve the one or more secrets, examining the source manifest to detect the identifier associated with the destination manifest; and

enabling the destination application to retrieve the one or more secrets when the identifier is detected in the source manifest.

11. A method as recited in claim 10, wherein one of said one or more secrets enables the destination application to make use of one or more binaries associated with the trusted application.

12. A method as recited in claim 10, wherein the one or more secrets are securely stored in the memory by a trusted core component provided by an operating system of the computing device.

13. A method as recited in claim 12, wherein the trusted core component is configured to perform the examining to determine whether to allow the destination application to retrieve the one or more secrets.

14. A method as recited in claim 10, wherein the data sufficient to associate the source manifest with the secret comprises a key, a unique name, and a version number corresponding to the source manifest.

15. A method as recited in claim 10, wherein the data sufficient to associate the source manifest with the one or more secrets comprises a bash of one or more portions of the source manifest.