Resource authorizations dependent on emulation environment isolation policies

• US 8,495,708 B2
• Filed: 03/22/2007
• Issued: 07/23/2013
• Est. Priority Date: 03/22/2007
• Status: Active Grant

• Current Assignee: MEC Management, LLC (Three Affiliated Tribes of the Fort Berthold Reservation, North Dakota)
• Original Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Inventors: Cohen, Alexander J., Lord, Robert W., Jung, Edward K. Y., Malamud, Mark A., Levien, Royce A., Rinaldo, Jr., John D., Wood, JR., Lowell L.
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Gregory, Shaun
• Application Number:
  US11/728,309
• Publication Number:
  US 20080235764A1
• Time in Patent Office: 2,315 Days
• Field of Search: None
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system

Abstract

A system, method, computer program product, and carrier are described for obtaining a resource authorization dependent upon apparent compliance with a policy of causing an emulation environment to isolate a first software object type from a second software object type and signaling a decision whether to comply with the policy of causing the emulation environment to isolate the first software object type from the second software object type.

Claims

1. A method comprising:

creating multiple emulation environments including at least a virtual environment and a physical environment;

selecting an emulation environment from the multiple emulation environments in response to an identified event category;

obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type;

signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type; and

receiving the decision whether to comply with the policy of causing the selected emulation environment to isolate the first software object type form the second software object type, wherein the receiving the decision is indicated by accepting a code implementing a conditional resource authorization, by taking no action, or by transmitting a device setting configuration indicating the policy compliance, and wherein at least one of obtaining a resource authorization, signaling a decision, or receiving the decision whether to comply is at least partially implemented using one or more processing components.

2. The method of claim 1 in which obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

configuring the resource authorization at least in response to an indication of a potential defect in an object of the second software object type.

3. The method of claim 1 in which obtaining a resource authorization dependent upon apparent compliance with a policy of causing the emulation environment to isolate a first software object type from a second software object type comprises:

configuring the resource authorization at least in response to an indication of a potential vulnerability in an object of the first software object type.

4. The method of claim 1 in which signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

transmitting a negative response as the decision whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type.

5. The method of claim 1 in which obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

expressing and displaying on a user interface a human-readable explanation of the policy of causing the selected emulation environment to isolate the first software object type from the second software object type.

6. The method of claim 1 in which signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

seeking a pattern in an instance of the first software object type.

7. The method of claim 1 in which signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

hosting the second software object type in a portion of the selected emulation environment not directly addressable from at least one instance of the first software object type.

8. The method of claim 1 further comprising:

causing another emulation environment to isolate a first instance of the first software object type from a second instance of the first software object type.

9. A system comprising:

circuitry for creating multiple emulation environments including at least a virtual environment and a physical environment;

circuitry for selecting an emulation environment from the multiple emulation environments in response to an identified event category;

circuitry for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type;

circuitry for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type; and

circuitry for receiving the decision whether to comply with the policy of causing the selected emulation environment to isolate the first software object type form the second software object type, wherein the receiving the decision is indicated by accepting a code implementing a conditional resource authorization, by taking no action, or by transmitting a device setting configuration indicating the policy compliance.

10. The system of claim 9 in which the circuitry for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

circuitry for executing an instance of the second software object type natively.

11. The system of claim 9 in which the circuitry for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

circuitry for receiving the resource authorization from an external source.

12. The system of claim 9 in which the circuitry for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

circuitry for evaluating whether the first software object type is apparently isolated from the second software object type.

13. The system of claim 9 in which the circuitry for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

circuitry for causing the second software object type to include at least a third software object type and a fourth software object type, the circuitry implemented using a syntactic joining expression.

14. The system of claim 9 in which the circuitry for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

circuitry for implementing the policy in logic for causing an application to be hosted in a composite environment containing the selected emulation environment hosting at least one instance of the first software object type.

15. The system of claim 9 in which the circuitry for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

circuitry for recognizing a version of the first software object type or the second software object type.

16. The system of claim 9 in which the circuitry for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

circuitry for evaluating an option of complying with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type, wherein the evaluating is performed utilizing a model logic, the model logic generating one or more valuations arithmetically or logically distilled by a cost evaluation logic.

17. The system of claim 9 in which the circuitry for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

circuitry for causing the selected emulation environment to contain at least a portion of the first software object type and to exclude the second software object type.

18. The system of claim 9 in which the circuitry for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

circuitry for hosting at least one instance of the first software object type in an address space not directly addressable from the selected emulation environment.

19. The system of claim 9 further comprising:

circuitry for isolating a resource in response to an indication of a native execution of an instance of the second software object type.

20. The system of claim 9 further comprising:

circuitry for determining whether an instruction sequence of the first software object type is identical to another instruction sequence.

21. A system comprising:

means for creating multiple emulation environments including at least a virtual environment and a physical environment;

means for selecting an emulation environment from the multiple emulation environments in response to an identified event category;

means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type;

means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type; and

means for receiving the decision whether to comply with the policy of causing the selected emulation environment to isolate the first software object type form the second software object type, wherein the means for receiving the decision are indicated by accepting a code implementing a conditional resource authorization, by taking no action, or by transmitting a device setting configuration indicating the policy compliance.

22. The system of claim 21 in which the means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

means for configuring the resource authorization at least in response to an indication of a potential defect in an object of the second software object type.

23. The system of claim 21 in which the means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

means for executing an instance of the second software object type natively.

24. The system of claim 21 in which the means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

means for configuring the resource authorization at least in response to an indication of a potential vulnerability in an object of the first software object type.

25. The system of claim 21 in which the means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

means for receiving the resource authorization from an external source.

26. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for transmitting a negative response as the decision whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type.

27. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for evaluating whether the first software object type is apparently isolated from the second software object type.

28. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for causing the second software object type to include at least a third software object type and a fourth software object type.

29. The system of claim 21 in which the means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

means for implementing the policy in logic for causing an application to be hosted in a composite environment containing the selected emulation environment hosting at least one instance of the first software object type.

30. The system of claim 21 in which the means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

means for expressing a human-readable explanation of the policy of causing the selected emulation environment to isolate the first software object type from the second software object type.

31. The system of claim 21 in which the means for obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type comprises:

means for recognizing a version of the first software object type or the second software object type.

32. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for evaluating an option of complying with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type.

33. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for seeking a pattern in an instance of the first software object type.

34. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for causing the selected emulation environment to contain at least a portion of the first software object type and to exclude the second software object type.

35. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for hosting at least one instance of the first software object type in an address space not directly addressable from the selected emulation environment.

36. The system of claim 21 in which the means for signaling a decision comprising one or more instances of an identifier, the decision configured to signal whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type comprises:

means for hosting the second software object type in a portion of the selected emulation environment not directly addressable from at least one instance of the first software object type.

37. The system of claim 21 further comprising:

means for isolating a resource in response to an indication of a native execution of an instance of the second software object type.

38. The system of claim 21 further comprising:

means for causing another emulation environment to isolate a first instance of the first software object type from a second instance of the first software object type.

39. The system of claim 21 further comprising:

means for determining whether an instruction sequence of the first software object type is identical to another instruction sequence.

40. A method comprising:

creating multiple emulation environments including at least a virtual environment and a physical environment;

selecting an emulation environment from the multiple emulation environments in response to an identified event category;

obtaining a resource authorization dependent upon apparent compliance with a policy of causing the selected emulation environment to isolate a first software object type from a second software object type; and

signaling a decision whether to comply with the policy of causing the selected emulation environment to isolate the first software object type from the second software object type, the signaling the decision comprising seeking one or more instances of a provider identifier or version identifier to identify a sequence of instructions as being of the first software object type, and wherein at least one of obtaining a resource authorization or signaling a decision whether to comply is at least partially implemented using one or more processing components.