Inhibiting denial-of-service attacks using group controls

Patent metadata

Field	Value
Publication number	US-9027151-B2
Application number	US-201113029702-A
Country	US
Kind code	B2
Filing date	Feb 17, 2011
Priority date	Feb 17, 2011
Publication date	May 5, 2015
Grant date	May 5, 2015

Abstract

A sandbox tool can cooperate with components of a secure operating system (OS) to create an isolated execution environment for accessing content without exposing other processes and resources of the computing system to the untrusted content. The sandbox tool can utilize task control groups (cgroups) of the secure OS with the isolated execution environment. A cgroup defines the hardware resources that can be accessed and utilized by the isolated execution environment. The cgroups can define accessible hardware resources by particular hardware resources, amount of hardware resources, and/or components of the hardware resources. Once a cgroup is applied to the isolated execution environment, any processes running in the isolated execution environment will be confined to the hardware resources defined by the applied cgroup. If a process running in the isolated execution environment attempts to utilize hardware resources outside the definition of the cgroup, the secure OS can block the usage.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a processor, a request to create an isolated execution environment within a host environment controlled by an operating system executing on a computing system;
creating, by the processor, a new process server to support communications with one or more processes to be executed in the isolated execution environment;
assigning, by the processor, a security context to the new process server, wherein the creating of the new…

Assignees

• Walsh Daniel J
• Red Hat Inc

Inventors

• Walsh Daniel J

Classifications

• H04L63/1458

  Electricity · mapped topic

• G06F21/53 Primary

  Physics · mapped topic

• G06F2221/034

  Physics · mapped topic

• G06F2221/2101

  Physics · mapped topic

• G06F2221/2141

  Physics · mapped topic