Method and system for containment of usage of language interfaces

• US 8,561,082 B2
• Filed: 10/13/2010
• Issued: 10/15/2013
• Est. Priority Date: 12/17/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sharma, Rosen, Shah, Bakul, Sebes, E. John
• Primary Examiner(s): Wu, Qing
• Application Number:
  US12/903,993
• Publication Number:
  US 20130246044A1
• Time in Patent Office: 1,098 Days
• Field of Search: None
• US Class Current: 719/313
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 8/20 Software design
• CPC Class Codes: G06F 8/30 Creation or generation of source code
• CPC Class Codes: G06F 8/40 Transformation of program code
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: H04N 21/8133 specifically related to the content, e.g. biography of the actors in a movie, detailed information about an article seen in a video program

Abstract

Client software is modified by a translator to use unique variant of linguistic interface of a service. An interceptor pre-processes subsequent client service requests from translated unique linguistic interface to standard linguistic interface implemented by service. Usage of linguistic interfaces of service is contained, rendering service incapable of executing arbitrary input, even if such input is crafted specifically for the service interface.

Claims

1. A method to be executed by a processor in an electronic environment, the method comprising:

determining a first linguistic interface of a service implementation, the first linguistic interface being configured to interpret requests that conform to a first grammar type;

replacing the first linguistic interface with a second linguistic interface, the second linguistic interface being configured to interpret requests that conform to a second grammar type that is different than the first grammar type; and

generating a unique client program based on a standard client program, the unique client program being configured to interact with the service implementation via the second linguistic interface,

wherein the second linguistic interface is configured to;

receive a first service request from the unique client program, the first service request being expressed in the second grammar type directed to the second linguistic interface; and

interpret the first service request to interact with the service implementation.

2. The method of claim 1, wherein the replacing the first linguistic interface includes modifying the service implementation.

3. The method of claim 1, wherein the replacing the first linguistic interface includes generating a new service implementation that is functionally equivalent to the service implementation with the first linguistic interface.

4. The method of claim 1, wherein the second linguistic interface is unable to successfully interpret a second service request if the second service request is initiated by another standard client program and if the second service request is expressed in the first grammar type.

5. The method of claim 1, wherein the unique client program and the service implementation reside on distinct hosts and communicate via a network.

6. The method of claim 1, wherein the service implementation and the unique client program reside on the same host.

7. The method of claim 1, wherein the generating the unique client program further includes:

identifying a first constant data of the standard client program, the first constant data expressed in the first grammar type of the first linguistic interface; and

determining a substitution code to replace the first constant data in the unique client program, the substitution code configured to translate the first constant data to a second constant data expressed in the second grammar type of the second linguistic interface.

8. An apparatus, comprising:

a memory element having stored thereon a first linguistic interface of a service implementation, the first linguistic interface being configured to interpret requests that conform to a first grammar type; and

one or more processors operable to execute instructions associated with the first linguistic interface, including;

replacing the first linguistic interface with a second linguistic interface, the second linguistic interface being configured to interpret requests that conform to a second grammar type that is different than the first grammar type; and

generating a unique client program based on a standard client program, the unique client program being configured to interact with the service implementation via the second linguistic interface,

wherein the second linguistic interface is configured to;

receive a first service request from the unique client program, the first service request being expressed in the second grammar type directed to the second linguistic interface; and

interpret the first service request to interact with the service implementation.

9. The apparatus of claim 8, wherein the replacing the first linguistic interface includes modifying the service implementation.

10. The apparatus of claim 8, wherein the replacing the first linguistic interface includes generating a new service implementation that is functionally equivalent to the service implementation with the first linguistic interface.

11. The apparatus of claim 8, wherein the second linguistic interface is unable to successfully interpret a second service request if the second service request is initiated by another standard client program and if the second service request is expressed in the first grammar type.

12. The apparatus of claim 8, wherein the service implementation and the unique client program reside on the same host.

13. The apparatus of claim 8, wherein the generating the unique client program further includes:

identifying a first constant data of the standard client program, the first constant data expressed in the first grammar type of the first linguistic interface; and

determining a substitution code to replace the first constant data in the unique client program, the substitution code configured to translate the first constant data to a second constant data expressed in the second grammar type of the second linguistic interface.

14. Logic encoded in one or more non-transitory media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:

determining a first client program and a first linguistic interface of a service implementation, the first linguistic interface being configured to interpret requests that conform to a first grammar type;

replacing the first linguistic interface with a second linguistic interface, the second linguistic interface being configured to interpret requests that conform to a second grammar type that is different than the first grammar type; and

generating a second client program based on the first client program, the second client program being configured to interact with the service implementation via the second linguistic interface,

wherein the second linguistic interface is configured to;

receive a first service request from the second client program, the first service request being expressed in the second grammar type directed to the second linguistic interface; and

interpret the first service request to interact with the service implementation.

15. The logic of claim 14, wherein the replacing the first linguistic interface includes modifying the service implementation.

16. The logic of claim 14, wherein the replacing the first linguistic interface includes generating a new service implementation that is functionally equivalent to the service implementation with the first linguistic interface.

17. The logic of claim 14, wherein the second linguistic interface is unable to successfully interpret a second service request if the second service request is expressed in the first grammar type.

18. The logic of claim 14, wherein the second client program and the service implementation reside on distinct hosts and communicate via a network.

19. The logic of claim 14, wherein the service implementation and the second client program reside on the same host.

20. The logic of claim 14, wherein the generating the second client program further includes:

identifying a first constant data of the first client program, the first constant data expressed in the first grammar type of the first linguistic interface;

determining a substitution code to replace the first constant data in the first client program, the substitution code configured to translate the first constant data to a second constant data expressed in the second grammar type of the second linguistic interface; and

creating the second client program using the first client program and the substitution code.