Method and system for containment of usage of language interfaces

• US 8,549,546 B2
• Filed: 11/15/2010
• Issued: 10/01/2013
• Est. Priority Date: 12/17/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sharma, Rosen, Shah, Bakul, Sebes, E. John
• Primary Examiner(s): Wu, Qing
• Application Number:
  US12/946,081
• Publication Number:
  US 20110077948A1
• Time in Patent Office: 1,051 Days
• Field of Search: None
• US Class Current: 719/330
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 8/20 Software design
• CPC Class Codes: G06F 8/30 Creation or generation of source code
• CPC Class Codes: G06F 8/40 Transformation of program code
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: H04N 21/8133 specifically related to the content, e.g. biography of the actors in a movie, detailed information about an article seen in a video program

Abstract

Client software is modified by a translator to use unique variant of linguistic interface of a service. An interceptor pre-processes subsequent client service requests from translated unique linguistic interface to standard linguistic interface implemented by service. Usage of linguistic interfaces of service is contained, rendering service incapable of executing arbitrary input, even if such input is crafted specifically for the service interface.

Claims

1. A method to be executed by at least one processor in an electronic environment, comprising:

identifying a first constant data of a first client program, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation;

determining a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data;

searching a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

creating a new entry in the mapping table if none of the arbitrary strings of the plurality of arbitrary strings matches an input string of the first constant data, wherein the new entry includes a new arbitrary string matching the input string of the first constant data, wherein a new matching string is generated to correspond to the new arbitrary string, wherein the new matching string is a second constant data created in the new entry as the expression in the second grammar type directed to the second linguistic interface,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

2. The method of claim 1, wherein the substitution code comprises the second constant data.

3. The method of claim 2, further comprising

identifying a mapping string of the plurality of mapping strings as the second constant data if a corresponding arbitrary string of the plurality of strings matches the input string of the first constant data.

4. The method of claim 1, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns the second constant data as the expression in the second grammar type directed to the second linguistic interface.

5. The method of claim 1, further comprising generating a second client program including the first client program with the first constant data replaced by the substitution code.

6. A method, comprising:

receiving a request for executing a first program, the first program comprising a first constant data, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation;

determining a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data;

generating a second program including the first program with the first constant data replaced by the substitution code; and

executing the second program,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

7. The method of claim 6, wherein the substitution code comprises a second constant data.

8. The method of claim 7, wherein the determining a substitution code includes:

searching a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

identifying a mapping string of the plurality of mapping strings as the second constant data, the mapping string corresponding to an arbitrary string of the plurality of arbitrary strings, wherein the arbitrary string matches an input string of the first constant data.

9. The method of claim 7, wherein the determining a substitution code includes:

searching a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

creating a new entry in the mapping table if none of the arbitrary strings of the plurality of arbitrary strings matches an input string of the first constant data,

wherein the new entry includes a new arbitrary string matching the input string of the first constant data, and wherein a new matching string is generated to correspond to the new arbitrary string.

10. The method of claim 6, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns a second constant data as the expression in the second grammar type directed to the second linguistic interface.

11. The method of claim 10, wherein the second constant data is a mapping string of a plurality of mapping strings, the plurality of mapping strings corresponding respectively to a plurality of arbitrary strings in a mapping table;

wherein the mapping string is identified by finding a corresponding arbitrary string of the plurality of arbitrary strings that matches an input string of the first constant data.

12. The method of claim 6, further comprising examining a manifest, the manifest indicating whether the first program is authorized to use the first service implementation.

13. The method of claim 12, further comprising:

determining if an integrity data of the manifest has changed; and

blocking all programs from executing if the integrity data of the manifest has changed.

14. The method of claim 12, further comprising:

determining if an integrity data of the first program in the manifest has changed;

blocking the first program from executing if the integrity data of the first program in the manifest has changed.

15. A method to be executed by at least one processor in an electronic environment, comprising:

identifying a calling code in a first program, the calling code for submitting a service parameter data to a first service implementation having a first linguistic interface configured to interpret requests that conform to a first grammar type;

identifying a first constant data in the first program, wherein the service parameter data is determined using the first constant data via at least one code path in the first program;

defining a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation; and

generating a second program, the second program comprising the substitution code,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

16. The method of claim 15, wherein the substitution code comprises a second constant data.

17. The method of claim 15, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns a second constant data as the expression in the second grammar type directed to the second linguistic interface.

18. The method of claim 17, wherein the second constant data is a mapping string of a plurality of mapping strings, the plurality of mapping strings corresponding respectively to a plurality of arbitrary strings in a mapping table;

wherein the mapping string is identified by finding a corresponding arbitrary string of the plurality of arbitrary strings that matches an input string of the first constant data.

19. A system, comprising:

a memory to store instructions; and

a processor configured to execute the instructions to;

identify a first constant data of a first client program, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation;

determine a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data;

search a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

create a new entry in the mapping table if none of the arbitrary strings of the plurality of arbitrary strings matches an input string of the first constant data, wherein the new entry includes a new arbitrary string matching the input string of the first constant data, wherein a new matching string is generated to correspond to the new arbitrary string, wherein the new matching string is a second constant data created in the new entry as the expression in the second grammar type directed to the second linguistic interface,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

20. The system of claim 19, wherein the substitution code comprises the second constant data.

21. A system, comprising:

a memory to store instructions; and

a processor configured to execute the instructions to;

receive a request for executing a first program, the first program comprising a first constant data, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation;

determine a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data; and

generate a second program including the first program with the first constant data replaced by the substitution code,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

22. The system of claim 21, the processor configured to execute further instructions to:

search a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

create a new entry in the mapping table if none of the arbitrary strings of the plurality of arbitrary strings matches an input string of the first constant data,

wherein the new entry includes a new arbitrary string matching the input string of the first constant data, and wherein a new matching string is generated to correspond to the new arbitrary string.

23. A system, comprising:

a memory to store instructions; and

a processor configured to execute the instructions to;

identify a calling code in a first program, the calling code for submitting a service parameter data to a first service implementation having a first linguistic interface configured to interpret requests that conform to a first grammar type;

identify a first constant data in the first program, wherein the service parameter data is determined using the first constant data via at least one code path in the first program;

define a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation; and

generate a second program, the second program comprising the substitution code,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

24. The system of claim 23, wherein the substitution code comprises a second constant data.

25. At least one non-transitory computer readable storage medium having instructions stored thereon, the instructions when executed by a processor cause the processor to:

identify a first constant data of a first client program, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation;

determine a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data;

search a mapping table having a plurality of arbitrary strings corresponding respectively to a plurality of mapping strings; and

create a new entry in the mapping table if none of the arbitrary strings of the plurality of arbitrary strings matches an input string of the first constant data, wherein the new entry includes a new arbitrary string matching the input string of the first constant data, wherein a new matching string is generated to correspond to the new arbitrary string, wherein the new matching string is a second constant data created in the new entry as the expression in the second grammar type directed to the second linguistic interface,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

26. The at least one non-transitory computer readable storage medium of claim 25, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns the second constant data as the expression in the second grammar type directed to the second linguistic interface.

27. At least one non-transitory computer readable storage medium having instructions stored thereon, the instructions when executed by a processor cause the processor to:

receive a request for executing a first program, the first program comprising a first constant data, the first constant data expressed in a first grammar type directed to a first linguistic interface of a first service implementation;

determine a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation, the expression equivalent to the first constant data; and

generate a second program including the first program with the first constant data replaced by the substitution code,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

28. The at least one non-transitory computer readable storage medium of claim 27, wherein the substitution code comprises the second constant data.

29. At least one non-transitory computer readable storage medium having instructions stored thereon, the instructions when executed by a processor cause the processor to:

identify a calling code in a first program, the calling code for submitting a service parameter data to a first service implementation having a first linguistic interface configured to interpret requests that conform to a first grammar type;

identify a first constant data in the first program, wherein the service parameter data is determined using the first constant data via at least one code path in the first program;

define a substitution code to replace the first constant data, the substitution code indicating an expression in a second grammar type directed to a second linguistic interface of a second service implementation; and

generate a second program, the second program comprising the substitution code,

wherein the first and second service implementations implement equivalent services, and the first and second linguistic interfaces are distinct.

30. The at least one non-transitory computer readable storage medium of claim 29, wherein the substitution code comprises a subroutine call having the first constant data as an argument, wherein the subroutine call returns a second constant data as the expression in the second grammar type directed to the second linguistic interface.