Runtime application integrity protection

Patent metadata

Field	Value
Publication number	US-9483636-B2
Application number	US-201414157926-A
Country	US
Kind code	B2
Filing date	Jan 17, 2014
Priority date	Jan 17, 2014
Publication date	Nov 1, 2016
Grant date	Nov 1, 2016

Abstract

Systems, methods, apparatuses, and computer program products are described for checking the integrity of applications installed on a computing device and preventing the launch of applications that appear to have been tampered with or modified. In accordance with embodiments, the content of an application is validated at the time the application is to be launched, but before the launch has actually occurred. In accordance with additional embodiments, integrity protection can also be extended to content that is generated by an application (e.g., documents or other files generated by the application), thereby enabling applications to write their own files and data with the same degree of integrity protection.

First claim

What is claimed is:

1. A method for protecting application integrity at runtime, comprising:
receiving a request to create a process by which an application will be executed, the application comprising one of a plurality of application components;
based at least on receiving the request:
determining, by one or more hardware processors, whether an access control entry (ACE) exists in association with at least one of the application components, the ACE specifying one or more levels of permission required to perform one or more actions with respect to at least one of the application components, the ACE being created by a protected process that comprises a process to which access by other processes is restricted; and
based at least on determining that the ACE exists in association with the at least one of the application components, creating the process by which the application will be executed.

2. The method of claim 1 , wherein the plurality of application components comprises the application and one or more files associated with the application.

3. The method of claim 1 , wherein determining whether the ACE exists in association with at least one of the application components comprises:
determining whether an ACE that matches an expected ACE exists in association with at least one of the application components.

4. The method of claim 1 , wherein determining whether the ACE exists in association with at least one of the application components comprises:
determining whether the ACE exists in association with a root directory of a folder in which the plurality of application components are stored.

5. The method of claim 1 , further comprising, based at least on determining that the ACE does not exist in association with at least one of the application components:
not creating the process by which the application will be executed.

6. The method of claim 5 , further comprising, based at least on determining that the ACE does not exist in association with at least one of the application components, performing one or more of:
disabling the application from being launched in the future; and
marking the application as requiring repair.

7. The method of claim 1 , further comprising, based at least on determining that the ACE does not exist in association with at least one of the application components:
determining a validity of each of the application components; and
based at least on determining that at least one of the application components is invalid, not creating the process by which the application will be executed.

8. The method of claim 7 , wherein each of the application components comprises a file received as part of an application package and wherein determining a validity of each of the application components comprises:
determining a hash value for each of the files in the application package; and
comparing the determined hash value for each of the files in the application package to a corresponding hash value stored in a digitally-signed file included in the application package.

9. The method of claim 7 , further comprising, based at least on determining that each of the application components is valid:
creating the process by which the application will be executed.

10. The method of claim 9 , further comprising, based at least on determining that each of the application components is valid:
creating an ACE in association with the at least one of the application components.

11. The method of claim 1 , further comprising, based at least on determining that the ACE does not exist in association with at least one of the application components:
creating the process by which the application will be executed;
determining a validity of each of the application components; and
based at least on determining that at least one of the application components is invalid, terminating the process.

12. The method of claim 1 , further comprising allowing only protected processes to create an ACE in association with a resource.

13. A system, comprising:
at least one processor; and
a memory that stores computer program logic for execution by the at least one processor, the computer program logic including a plurality of components configured to perform operations when executed by the at least one processor, the plurality of components including:
a first operating system component that is configured to receive a request to create a process by which an application will be executed, the application comprising one file among a plurality of files in an application package, and based at least on receiving the request, determine whether an access control entry (ACE) exists in association with at least one of the files in the application package, the ACE specifying one or more levels of permission required to perform one or more actions with respect to at least one of the files in the application package, the ACE being created by a protected process that comprises a process to which access by other processes is restricted;
the first operating system component being further configured to, based at least on determining that the ACE exists in association with the at least one of the files in the application package, create the process by which the application will be executed.

14. The system of claim 13 , wherein the plurality of components further includes:
a second operating system component that is configured to, based at least on a determination that the ACE does not exist in association with at least one of the files in the application package, determine a validity of each of the files in the application package;
the first operating system component being further configured to, based at least on a determination that at least one of the files in the application package is invalid, not create the process by which the application will be executed and, based at least on a determination that each of the files in the application package is valid, create the process by which the application will be executed.

15. A method for protecting the integrity of application-generated content, comprising:
receiving by an operating system broker of an operating system, which is at least partially implemented by a hardware processor, a request from an application to assign an access control entry (ACE) to content that has been created by the application, the ACE specifying one or more levels of permission required to perform one or more actions with respect to the content; and
based at least on receiving the request, assigning by the operating system broker the ACE to the content;
the operating system broker comprising a process to which access by other processes is restricted.

16. The method of claim 15 , further comprising:
receiving by the operating system broker a request from the application to obtain the content; and
based at least on receiving the request from the application to obtain the content, determining whether a valid ACE is assigned to the content.

17. The method of claim 16 , further comprising:
based at least on determining that a valid ACE is assigned to the content, providing the content to the application.

18. The method of claim 16 , further comprising:
based at least on determining that a valid ACE is not assigned to the content, not providing the content to the application.

19. The method of claim 16 , further comprising:
based at least on determining that a valid ACE is not assigned to the content, providing the content to the application along with an indication that the content may have been tampered wit

Assignees

• Microsoft Corp
• Microsoft Technology Licensing Llc

Inventors

• Iskin Sermet
• Andrejs Axel
• Kilic Yunus
• Dunn Joshua W

Classifications

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title