Pervasive package identifiers

Patent metadata

Field	Value
Publication number	US-8990561-B2
Application number	US-201113228695-A
Country	US
Kind code	B2
Filing date	Sep 9, 2011
Priority date	Sep 9, 2011
Publication date	Mar 24, 2015
Grant date	Mar 24, 2015

Abstract

A package identifier for a package from which an application is installed on a computing device is obtained. The package identifier is assigned to each of one or more processes created for running the application and, for each of the one or more processes, whether the process is permitted to access a resource of the computing device is determined based at least in part on the package identifier.

First claim

What is claimed is:

1. A method comprising:
obtaining, at a computing device for an application installed on the computing device from a package, a package identifier for the package, the package identifier including an identifier of an architecture of computing devices on which the application is designed to operate, the application having been installed only if a publisher of the package included in the package identifier was verified as being the same as the publisher included in a digital certificate associated with the package;
maintaining the package identifier in a protected manner such that the package identifier is accessible to an operating system of the device but not accessible to other applications of the device;
assigning the package identifier to each of one or more processes created for the application, wherein each process created for the application includes a process token generated by the operating system of the computing device, the process incapable of modifying the process token; and
determining, based at least in part on the package identifier, for each of the one or more processes whether the process is permitted to access a resource of the computing device.

2. The method as recited in claim 1 , the package identifier further including a name of the package and a name of the publisher of the package.

3. The method as recited in claim 2 , the package identifier further including an indication of a version of the package and a value identifying a resource type of the package.

4. The method as recited in claim 1 , the package including one or more components or modules of one or more applications.

5. The method as recited in claim 1 , the assigning comprising generating a security identifier based on the package identifier or family identifier of the package, and adding the security identifier to the process token of each of the one or more processes.

6. The method as recited in claim 5 , the determining comprising allowing, for each of the one or more processes, the process to access a folder of a storage device of the computing device only if an access control list associated with the folder indicates the security identifier of the process is permitted to access the folder.

7. The method as recited in claim 5 , the determining further comprising allowing, for each of the one or more processes, the process to access an additional process in the computing device only if the security identifier of the process and the security identifier of the additional process are the same.

8. The method as recited in claim 5 , the generating the security identifier comprising inputting one or more elements of the package identifier to a hash function to generate a hash value, and using the hash value as the security identifier.

9. The method as recited in claim 1 , the obtaining a package identifier for the package comprising obtaining the package identifier for the package from a manifest associated with the package.

10. The method as recited in claim 1 , further comprising, in response to loading of a library being requested:
loading the library if the library is identified in a manifest of the package or in a manifest of a dependency package of the package; and
otherwise not loading the library.

11. The method as recited in claim 1 , further comprising determining a process with which streaming code received by the computing device is associated based on the package identifier.

12. One or more computer storage media having stored thereon multiple instructions that, when executed by one or more processors of a computing device, cause the one or more processors to:
obtain, at the computing device as part of installing one or more applications from a package on the computing device, a package identifier from the package, the package identifier including an identifier of an architecture of computing devices on which the application is designed to operate, the one or more applications being installed only if a publisher of the package included in the package identifier is the same as the publisher included in a digital certificate) associated with the package;
maintain the package identifier in a protected manner such that the package identifier is accessible to an operating system of the device but not to other applications of the device;
use a subset of elements of the package identifier to be a family identifier of the package; and
assign the family identifier to each of one or more processes created for running the one or more applications, wherein each process created for an application comprises a process token with a security identifier based on the package identifier, the security identifier stored in the process token in a manner) that identifies the security identifier as being a package identifier security identifier.

13. One or more computer storage media as recited in claim 12 , the package identifier being obtained from a manifest associated with the package.

14. One or more computer storage media as recited in claim 12 , the subset of elements including a name of the package and a name of the publisher of the package.

15. One or more computer storage media as recited in claim 12 , the package including one or more components or modules of one or more applications.

16. One or more computer storage media as recited in claim 12 , the instructions causing the one or more processors to assign the family identifier to each of the one or more processes comprising instructions causing the one or more processors to generate a security identifier based on the family identifier and add the security identifier to the process token of each of the one or more processes.

17. One or more computer storage media as recited in claim 16 , the multiple instructions further causing the one or more processors to allow, for each of the one or more processes, the process to access a folder of a storage device of the computing device only if an access control list associated with the folder indicates the security identifier of the process is permitted to access the folder.

18. One or more computer storage media as recited in claim 16 , the multiple instructions further causing the one or more processors to allow, for each of the one or more processes, the process to access an additional process in the computing device only if the security identifier of the process and the security identifier of the additional process are the same.

19. A method comprising:
obtaining, at a computing device as part of installing one or more applications from a package on the computing device, a package identifier from the package, the package identifier including a name of the package, a name of a publisher of the package, an identifier of an architecture of computing devices on which the application is designed to operate, an indication of a version of the package, and a value identifying a resource type of the package, the one or more applications being installed only if the publisher of the package included in the package identifier is verified to be the same as the publisher included in a digital certificate associated with the package;
maintaining the package identifier in a protected manner such that the package identifier is accessible to an operating system of the device but not to other applications of the device;
using a subset of elements of the package identifier to be a family identifier of the package, the subset of elements including the name of the package and the name of the publisher of the package;
assigning the family identifier to each of on

Assignees

• Sheehan John M
• Kapustein Howard S
• Holman Jerome Thomas
• Graham Scott B
• Iskin Sermet
• Microsoft Technology Licensing Llc

Inventors

• Sheehan John M
• Kapustein Howard S
• Holman Jerome Thomas
• Graham Scott B
• Iskin Sermet

Classifications

• G06F9/468 Primary

  Specific access rights for resources, e.g. using capability register · CPC title

• G06F21/121

  Restricting unauthorised execution of programs · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title