Apparatus, method and system to control accessibility of platform resources based on an integrity level

• US 9,479,513 B1
• Filed: 03/18/2015
• Issued: 10/25/2016
• Est. Priority Date: 03/20/2014
• Status: Active Grant

• Current Assignee: National Technology & Engineering Solutions Of Sandia LLC (Honeywell International Inc.)
• Original Assignee: Sandia Corporation (Martin Marietta Corporation)
• Inventors: Jenkins, Chris, Pierson, Lyndon G.
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/661,174
• Time in Patent Office: 587 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques and mechanism to selectively provide resource access to a functional domain of a platform. In an embodiment, the platform includes both a report domain to monitor the functional domain and a policy domain to identify, based on such monitoring, a transition of the functional domain from a first integrity level to a second integrity level. In response to a change in integrity level, the policy domain may configure the enforcement domain to enforce against the functional domain one or more resource accessibility rules corresponding to the second integrity level. In another embodiment, the policy domain automatically initiates operations in aid of transitioning the platform from the second integrity level to a higher integrity level.

Claims

1. An apparatus comprising:

first logic including circuitry configured to execute one or more software processes of a functional domain to access resources of the apparatus;

second logic including circuitry configured to provide an enforcement domain to enforce a first rule set against access by the functional domain to the resources;

third logic including circuitry configured to provide a report domain to detect, during enforcement of the first rule set, a transition from the functional domain from a first state to a second state, wherein the first state is assigned a first integrity level and the second state is assigned a second integrity level, wherein the second integrity level is an integrity level less than the first integrity level;

fourth logic including circuitry configured to provide a policy domain, responsive to the transition from the first state to the second state, the fourth logic further configured to;

identify a second rule set based on a policy corresponding to the second integrity level;

configure the enforcement domain to enforce the second rule set against access by the functional domain to the resources;

identify, based on the second integrity level, a condition of a state assigned an integrity level greater than the second integrity level; and

automatically initiate an operation to cause the condition to be satisfied.

2. The apparatus of claim 1, wherein the first logic is configured to execute a first virtual machine including the functional domain.

3. The apparatus of claim 2, wherein the apparatus is configured to execute a hypervisor including the enforcement domain.

4. The apparatus of claim 3, wherein the hypervisor further includes the policy domain and the report domain.

5. The apparatus of claim 2, wherein the second logic is configured to execute a second virtual machine, wherein the second virtual machine includes the enforcement domain, the third logic is configured to execute a third virtual machine, wherein the third virtual machine includes the report domain, and the fourth logic is configured to execute a fourth virtual machine, wherein the fourth virtual machine includes the policy domain.

6. The apparatus of claim 1, wherein the policy domain is configured to identify the second rule set, wherein, based upon the second rule set, the policy domain is further configured to:

select the second state from among a plurality of states based on one or more conditions identified by the report domain; and

select the second integrity level from among a plurality of integrity levels based on an assignment of the second integrity level to the second state.

7. The apparatus of claim 1, wherein the policy domain is configured to identify the condition, wherein the condition instructs the policy domain to determine a difference between one or more conditions of the second state and one or more conditions of the state assigned the integrity level greater than the second integrity level.

8. The apparatus of claim 7, wherein the policy domain is configured to identify the condition includes the policy domain to calculate a cardinality of the difference.

9. The apparatus of claim 1, wherein the policy domain is configured to identify the condition includes the policy domain to calculate an aggregate weight value based on one or more weight values each corresponding to a respective condition of the second state and one or more weight values each corresponding to a respective condition of the state assigned the integrity level greater than the second integrity level.

10. A method executed at a platform, the method comprising:

with an enforcement domain of the platform, enforcing a first rule set against access by a functional domain of the platform to resources of the platform;

during enforcement of the first rule set, detecting a transition from the functional domain from a first state to a second state, wherein the first state is assigned a first integrity level and the second state is assigned a second integrity level, wherein the second integrity level is an integrity level less than the first integrity level;

in response to detecting the transition from the first state to the second state;

identifying a second rule set based on a policy corresponding to the second integrity level;

configuring the enforcement domain to enforce the second rule set against access by the functional domain to the resources based on the second integrity level;

identifying a condition of a state assigned an integrity level greater than the second integrity level; and

automatically initiating an operation to cause the condition to be satisfied.

11. The method of claim 10, wherein a first virtual machine includes the functional domain.

12. The method of claim 11, wherein a hypervisor includes the enforcement domain.

13. The method of claim 12, wherein the hypervisor further includes the policy domain and the report domain.

14. The method of claim 11, wherein a second virtual machine includes the enforcement domain, a third virtual machine includes the report domain, and a fourth virtual machine includes the policy domain.

15. The method of claim 10, wherein identifying the second rule set further comprises:

selecting the second state from among a plurality of states based on one or more conditions identified by the report domain; and

selecting the second integrity level from among a plurality of integrity levels based on an assignment of the second integrity level to the second state.

16. The method of claim 10, wherein identifying the condition further comprises determining a difference between one or more conditions of the second state and one or more conditions of the state assigned the integrity level greater than the second integrity level.

17. The method of claim 16, wherein identifying the condition further comprises calculating a cardinality of the difference.

18. The method of claim 10, wherein identifying the condition further comprises calculating an aggregate weight value based on one or more weight values each corresponding to a respective condition of the second state and one or more weight values each corresponding to a respective condition of the state assigned the integrity level greater than the second integrity level.

19. A non-volatile computer-readable storage medium having stored thereon instructions which, when executed by one or more processing units, cause the one or more processing units to perform a method comprising:

with an enforcement domain of the platform, enforcing a first rule set against access by a functional domain of the platform to resources of the platform;

during enforcement of the first rule set, detecting a transition from the functional domain from a first state to a second state, wherein the first state is assigned a first integrity level and the second state is assigned a second integrity level, wherein the second integrity level is an integrity level less than the first integrity level;

in response to detecting the transition from the first state to the second state;

identifying a second rule set based on a policy corresponding to the second integrity level;

configuring the enforcement domain to enforce the second rule set against access by the functional domain to the resources based on the second integrity level;

identifying a condition of a state assigned an integrity level greater than the second integrity level; and

automatically initiating an operation to cause the condition to be satisfied.

20. The computer-readable storage medium of claim 19, wherein a first virtual machine includes the functional domain.

21. The computer-readable storage medium of claim 20, wherein a hypervisor includes the enforcement domain.

22. The computer-readable storage medium of claim 19, wherein identifying the condition further comprises determining a difference between one or more conditions of the second state and one or more conditions of the state assigned the integrity level greater than the second integrity level.

23. The computer-readable storage medium of claim 19, wherein identifying the condition further comprises calculating an aggregate weight value based on one or more weight values each corresponding to a respective condition of the second state and one or more weight values each corresponding to a respective condition of the state assigned the integrity level greater than the second integrity level.