Performing secure and insecure computing operations in a compartmented operating system

• US 20020194241A1
• Filed: 06/18/2002
• Published: 12/19/2002
• Est. Priority Date: 06/19/2001
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Griffin, Jonathan, Dalton, Christopher I.
• Granted Patent: US 7,159,210 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105

Abstract

A process 23 runs directly on a host operating system 22, until the process 23 attempts an operation which can affect security of the host operating system 22 (such as loading a kernel module or using system privileges). A guest operating system 25 is then provided running as a virtual machine session within a compartment 24 of the host operating system 22 and running of the process 23 continues using the guest operating system. Operations of the process 23 which can affect security of the host operating system 22 are instead performed on the guest operating system 25, giving greater security. The guest operating system 25 is only invoked selectively, leading to greater overall efficiency.

Claims

1. A method for running a process, comprising the steps of:

(a) providing a host operating system;

(b) running a process directly on the host operating system;

(c) selectively providing a guest operating system when the process attempts a predetermined operation; and

(d) running the process on the guest operating system.

2. The method of claim 1, wherein in the step (c) operations attempted by the process are divided into a first set which are allowed to run directly on the host operating system and a second set which are not allowed to run directly on the host operating system.

3. The method of claim 2, wherein the step (c) comprises identifying an attempt to perform an operation falling into the second set.

4. The method of any preceding claim, wherein in the step (c) the guest operating system is provided within a compartment of the host operating system.

5. The method of any preceding claim, wherein in the step (b) the process runs within a compartment of the host operating system.

6. The method of any preceding claim, wherein the guest operating system is provided by a virtual machine session.

7. The method of any preceding claim, comprising the step of (e) closing the guest operating system in response to a condition caused by running the process on the guest operating system.

8. The method of claim 7, wherein the guest operating system is provided within a compartment of the host operating system, and the step (e) comprises closing the compartment.

9. A method for running a process, comprising the steps of:

(a) providing a host operating system;

(b) providing a process which attempts an operation;

(c) monitoring attempted operations of the process by comparing against a first set and a second set;

(d) where the attempted operation falls into the first set, allowing the attempted operation to execute directly on the host operating system;

(e) where the attempted operation falls into the second set, providing a guest operating system and allowing the attempted operation to execute on the guest operating system.

10. A computing platform for running a process, comprising:

a host operating system for running a process; and

a guest operating system selectively provided for running the process when the process attempts a predetermined operation.

11. The computing platform of claim 10, wherein operations attempted by the process fall either into a first set allowed to run directly on the host operating system or a second set not allowed to run directly on the host operating system.

12. The computing platform of claim 11, wherein the host operating system identifies an attempt to perform an operation falling into the second set, and in response provides the guest operating system.

13. The computing platform of any of claims 10 to 12, wherein the host operating system provides a compartment for containing the process.

14. The computing platform of any of claims 10 to 12, wherein the host operating system provides a compartment for containing the guest operating system.

15. The computing platform of any of claims 10 to 12, wherein the guest operating system is provided by a virtual machine session running on the host operating system.