Operating system process identification

• US 7,788,637 B2
• Filed: 04/29/2005
• Issued: 08/31/2010
• Est. Priority Date: 12/06/2004
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Abadi, Martin, Wobber, Edward P, Jones, Michael B., Hunt, Galen C., Larus, James R., DeTreville, John D., Chilimbi, Trishul A.
• Primary Examiner(s): Kendall; Chuck O
• Application Number:
  US11/118,690
• Publication Number:
  US 20060123418A1
• Time in Patent Office: 1,950 Days
• Field of Search: None
• US Class Current: 717/110
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Described herein is an implementation of a technology for the construction, identification, and/or optimization of operating-system processes. At least one implementation, described herein, constructs an operating-system process having the contents as defined by a process manifest. Once constructed, the operating-system process is unalterable.

Claims

1. One or more processor-readable storage media storing processor-executable instructions that, when executed by at least one processor, perform acts comprising:

generating a processor-executable instruction stream from one or more constituent components; and

constructing an operating-system process comprising the generated processor-executable instruction stream, the operating-system process with its generated processor-executable instruction stream being unalterable once the operating-system process is constructed;

based on, at least in part, the generated processor-executable instruction stream, creating at least one fixed identity for the operating-system process and associating the created fixed identity with the operating-system process, the fixed identity identifying the constructed and unalterable operating-system process, the fixed identity being based, at least in part, upon inherent properties of the constructed operating-system process, the fixed identity being representative of the constructed operating-system process, the fixed identity being associated with the constructed operating-system process, and the fixed identity being unalterable once the operating-system process is constructed;

confirming the fixed identity of the generated processor-executable instruction stream of the constructed operating-system process;

responsive to the confirming,

when the fixed identity is confirmed, executing the generated processor-executable instruction stream of the constructed operating-system process;

when the fixed identity is unconfirmed, blocking execution of the generated processor-executable instruction stream of the constructed operating-system process.

2. One or more processor-readable storage media as recited in claim 1, wherein the one or more constituent components comprises one or more load modules.

3. One or more processor-readable storage media as recited in claim 1 further comprising executing the generated processor-executable instruction stream of the constructed operating-system process, the generated processor-executable instruction stream and its fixed identity being unalterable while operating-system process is executing.

4. One or more processor-readable storage media as recited in claim 1 further comprising confirming the fixed identity of the generated processor-executable instruction stream of the constructed operating-system process.

5. One or more processor-readable storage media as recited in claim 3 further comprising identifying the constructed operating-system process while it is executing by its associated fixed identity.

6. One or more processor-readable storage media as recited in claim 1, wherein the creating act is carried out, at least in part, by applying a function to one or more of the constituent components.

7. One or more processor-readable storage media as recited in claim 1, wherein the creating act is carried out, at least in part, by applying a function to at least a portion of the generated processor-executable instruction stream of the operating-system process.

8. One or more processor-readable storage media as recited in claim 1, wherein all components necessary for construction of the operating-system process are named in a process manifest and the creating act is carried out, at least in part, by applying a function to at least a portion of the process manifest.

9. One or more processor-readable storage media as recited in claim 1, wherein the fixed-identity of the operating-system process comprises additional identifying information selected from a group consisting of process publisher identification information, process authorship identification information, process access authorization information, publication information, copyright information, licensing information, information identifying constituent components of the operating-system process, and information related to membership in one or more classes of processes.

10. One or more processor-readable storage media storing processor-executable instructions that, when executed by at least one processor, perform acts comprising:

generating a processor-executable instruction stream from one or more constituent components;

constructing an operating-system process comprising the generated processor-executable instruction stream, the operating-system process with its generated processor-executable instruction stream being unalterable once the operating-system process is constructed;

creating at least one fixed identity for the operating-system process and associating the created fixed identity with the operating-system process, the fixed identity identifying and being representative of the constructed and unalterable operating-system process, the fixed identity being based, at least in part, upon the generated processor-executable instruction stream, and the fixed identity being unalterable once the operating-system process is constructed.

11. One or more processor-readable storage media as recited in claim 10, wherein the creating act creates the fixed identity based at least in part upon a process manifest for the operating-system process, the process manifest defining content used in construction of an operating-system process.

12. One or more processor-readable storage media as recited in claim 10, wherein the creating act creates the fixed identity based as at least in part upon one or more selected from a group consisting of constituent components used in construction of an operating-system process, load modules used in construction of an operating-system process, typed-code representations used in construction of an operating-system process.

13. One or more processor-readable storage media as recited in claim 10, wherein the creating act creates the fixed identity based at least in part upon a processor-executable instruction stream comprising the operating-system process.

14. One or more processor-readable storage media as recited in claim 10 further comprising executing the constructed operating-system process, the operating-system process and its fixed identity being unalterable while the operating-system process is executing.

15. One or more processor-readable storage media as recited in claim 10 further comprising confirming the fixed identity of the constructed operating-system process.

16. One or more processor-readable storage media as recited in claim 10 further comprising:

confirming the fixed identity of the constructed operating-system process;

if confirmed, then executing the constructed operating-system process.

17. One or more processor-readable storage media as recited in claim 10, wherein the creating act is carried out, at least in part, by applying a function to one or more of constituent components of the constructed operating-system process.

18. One or more processor-readable storage media as recited in claim 10, wherein the fixed-identity of the operating-system process comprises additional identifying information selected from a group consisting of process publisher identification information, process authorship identification information, process access authorization information, publication information, copyright information, licensing information, information identifying constituent components of the operating-system process, and information related to membership in one or more classes of processes.

19. One or more processor-readable storage media storing processor-executable instructions that, when executed by at least one processor, perform acts comprising:

obtaining a constructed operating-system process, which is unalterable once constructed, the constructed operating-system process having constructed-process fixed identity that identifies, is representative of, and is associated with the constructed operating-system process;

confirming the constructed-process fixed identity of the constructed operating-system process;

if confirmed, then executing the constructed operating-system process.