Secure privilege level execution and access protection

Patent metadata

Field	Value
Publication number	US-9530000-B2
Application number	US-201313918852-A
Country	US
Kind code	B2
Filing date	Jun 14, 2013
Priority date	Jun 14, 2013
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

The subject disclosure is directed towards using one or more of hardware, a hypervisor, and privileged mode code to prevent system mode code from accessing user mode data and/or running user mode code at the system privilege level, or vice-versa. Also described is (in systems with a hypervisor) preventing non-hypervisor code from running in hypervisor mode or accessing hypervisor-only data, or vice-versa. A register maintained by hardware, hypervisor, or system mode code contains data access and execution polices for different chunks of addressable space with respect to which requesting entities (hypervisor mode code, system mode code, user mode code) have access to or can execute code in a given chunk. When a request to execute code or access data with respect to an address is received, the request is processed to determine to which chunk the address corresponds. The policy for that chunk is evaluated to determine whether to allow or deny the request.

First claim

What is claimed is:

1. A method comprising:
separating addressable memory space into a plurality of chunks, the plurality of chunks respectively comprising a plurality of bits of the addressable memory space, at least some of the plurality of chunks are associated with policy settings that:
identify one or more execution capabilities and one or more access capabilities of the plurality of chunks; and
indicate whether code in the plurality of chunks are executable at a system privilege level or not, or whether data in the plurality of chunks are accessible as system mode data or not; and

enforcing whether code execution or data access is allowed for a request, in which the request indicates whether the request is to execute code or access data and an indication of a privilege level of the request, including:
identifying, from the plurality of chunks, a chunk with which the request is associated,
accessing the policy settings based upon the request to determine the execution or data access capability of the chunk, and
allowing or denying the request based upon the privilege level, whether the request is to execute code or access data and the capability of the chunk with which the request is associated.

2. The method of claim 1 , further comprising receiving the request by a hypervisor or system mode code, and wherein enforcing whether code execution or data access is allowed for a request is performed by enforcement logic.

3. The method of claim 1 , wherein the privilege level of the request corresponds to a system privilege level, wherein the policy settings indicate that:
code in the chunk with which the request is associated is not executable at the system privilege level; or
data in the chunk is not accessible by system mode code; and
denying the request based on the policy settings.

4. The method of claim 1 , further comprising associating identifiers with the plurality of chunks, in which an identifier for an individual chunk from the plurality of chunks is part of an address within the addressable memory space for the individual chunk.

5. The method of claim 4 , wherein identifying the chunk with which the request is associated comprises determining the chunk from an address associated with the request.

6. The method of claim 1 , further comprising one or more of the following:
(a) writing the policy settings, including writing at least one policy setting that indicates whether code in the plurality of chunks is executable at a user privilege level or not, or whether data in the plurality of chunks is accessible as user mode data or not; and
(b) writing the policy settings, including writing at least one policy setting that indicates whether code in the plurality of chunks is executable in a hypervisor mode, or whether data in the plurality of chunks is accessible as hypervisor mode data or not.

7. The method of claim 1 , further comprising subdividing at least one chunk of the plurality of chunks into page structures, and wherein the policy settings include data that identifies execution capabilities and one more access capabilities of the page structures of the page structures.

8. The method of claim 1 , further comprising locking at least part of the policy settings.

9. The method of claim 8 , wherein locking at least part of the policy settings comprises locking by hardware or software, wherein the lock or locks are enforced by one or more of the following: hardware, a hypervisor, and higher-privileged software than software that set a particular lock.

10. A system for enforcing code execution and data access policies comprising:
enforcement logic configured to:
determine an access designation and an execution designation of a chunk, the chunk comprising a plurality of bits of addressable memory space;
lock the access designation of the chunk until an unlock event or reboot;
evaluate a request from a source related to code execution at an address against the access designation of the chunk corresponding to the address by accessing policy settings for the chunk, the policy settings identifying one or more execution capabilities and one or more access capabilities of the chunk; and
allow or deny the request based upon the evaluation.

11. The system of claim 10 , wherein the enforcement logic is incorporated in hardware or incorporated into one or more of the following: a hypervisor and system mode code, and wherein the source of the request comprises user mode code, system mode code, or hypervisor mode code.

12. The system of claim 10 , wherein the enforcement logic is further configured to:
evaluate a request from a source related to data access at an address against data access information maintained for chunks of address spaces; and
determine whether the address corresponds to a chunk in which the source is allowed to access data.

13. The system of claim 10 , wherein a subset of bits of the address identifies a chunk of a plurality of equal size chunks to which the address corresponds.

14. The system of claim 10 , wherein at least two of the chunks of address spaces are different sizes from one another.

15. The system of claim 10 , wherein access designations are maintained in a register set in memory or in a processor location.

16. The system of claim 10 , wherein the access designation for the chunk includes information that indicates whether chunk code is executable at user privilege level only, at system privilege level only or in hypervisor mode only.

17. The system of claim 10 , wherein the access designation for the chunk includes information that indicates whether chunk data is accessible at user privilege level only, at system privilege level only or in hypervisor mode only.

18. A computer-readable storage memory having computer-executable instructions that are configured, upon execution, to enforce code execution and data access policies comprising:
dividing addressable memory space into a plurality of chunks;
receiving an access designation and an execute designation for at least one of the plurality of chunks, the access designation enforcing access of the at least one of the plurality of chunks to only a hypervisor and the execute designation enforcing execution of the at least one of the plurality of chunks to only the hypervisor;
receiving a request related to code execution or data access for the at least one of the plurality of chunks;
determining a source of the request and an address associated with the request;
comparing the source and the address against policy settings; and
upon determining that the request is for execution or access not by the hypervisor, denying the request based upon the comparison.

19. The computer-readable storage memory of claim 18 , wherein:
the source of the request comprises system mode code; and
the address corresponds to a chunk of addressable space designated as user mode only.

20. The one or more computer-readable storage memory of claim 18 , wherein
the address corresponds to a chunk of addressable space designated as system mode only.

Assignees

• Microsoft Corp
• Microsoft Technology Licensing Llc

Inventors

• Lange Jonathan E
• Sell John V
• Chen Ling Tony
• Mejdrich Eric O

Classifications

• G06F12/1491

  in a hierarchical protection system, e.g. privilege levels, memory rings · CPC title

• G06F12/1483

  using an access-table, e.g. matrix or list · CPC title

• G06F11/1004

  to protect a block of data words, e.g. CRC or checksum (G06F11/1076 takes precedence; security arrangements for protecting computers or computer systems against unauthorized activity G06F21/00) · CPC title

• G06F12/0246

  in block erasable memory, e.g. flash memory · CPC title

• G06F11/1008

  in individual solid state devices (G06F11/1004 takes precedence) · CPC title