Protection of state data in computer system code

Patent metadata

Field	Value
Publication number	US-9740878-B2
Application number	US-201615237765-A
Country	US
Kind code	B2
Filing date	Aug 16, 2016
Priority date	Nov 3, 2015
Publication date	Aug 22, 2017
Grant date	Aug 22, 2017

Abstract

A method, system, and computer program product are provided for protecting state data of computer system code. The computer system code may be operating system code, subsystem code or application code and the item of state data is not expected to change within the execution of the computer system code. The method includes: creating or modifying an item of state data having a field value and being stored in memory for access by computer system code; registering an item of state data for protection; preserving the field value of the item of state data in a form inaccessible to third party software; validating the field value of the item of state data by comparing a current field value with the preserved field value to determine if the field value has been modified; and, if the field value has been modified, taking appropriate action.

First claim

What is claimed is:

1. A computer-implemented method for protecting state data of computer system code, the method comprising:
registering an item of state data for protection, wherein registering the item of state data for protection is carried out at system runtime when an item of state data is modified;
preserving a field value of the item of state data in a form inaccessible to third party software by taking a snapshot of the item of the state data and storing it in an encrypted form;
determining the field value of the item of state data has been altered greater than an acceptable deviation by comparing a current field value with the preserved field value, wherein validating the field value is carried out at specified times; and
in response to the field value being altered greater than an acceptable deviation, initiating an action.

2. The method according to claim 1 , wherein registering the item of state data for protection is carried out at system initialization when the item of state data is created.

3. The method according to claim 1 , wherein preserving the field value hardens a copy of the field value to a non-memory destination which only the computer system code has access to.

4. The method according to claim 1 , wherein preserving the field value of the item of state data includes preserving multiple field values of multiple items of state data in a single preserving operation.

5. The method according to claim 1 , wherein generating includes modifying or creating, or both.

6. The method according to claim 1 , wherein the items of state data comprise a wide range of possible forms including: data structures, addresses, flags, limiting values, Boolean values, pointers, arrays, constant values, character strings, hash values, or binary data.

7. A computer system for protecting state data of computer system code, the computer system comprising:
one or more computer processors, one or more computer-readable storage media, and program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
program instructions to identify a data field containing a hardcoded limiting value of number of times an operation occurs within a computer program;
program instructions to register an item of state data for protection, wherein registering the item of state data for protection is carried out at system runtime when an item of state data is modified, wherein the item of state data's field corresponds to the data field;
program instructions to preserve a field value of the item of state data in a form inaccessible to third party software by taking a snapshot copy of the item of the state data and storing it in an encrypted form;
program instructions to determine the field value of the item of state data being altered greater than an acceptable deviation by comparing a current field value with the preserved field value, wherein validating the field value is carried out at specified times; and
program instructions to initiate an action in response to the field value being altered greater than an acceptable deviation.

8. The computer system according to claim 7 , wherein the program instructions to register the item of state data for protection are implemented at system initialization when the item of state data is created.

9. The computer system according to claim 7 , wherein the instructions to preserve the field value hardens a copy of the field value to a non-memory destination which only the system computer code has access to.

10. The computer system according to claim 7 , wherein the program instructions to preserve the field value of the item of state data includes program instructions to preserve multiple field values of multiple items of state data in a single preserving operation.

11. The computer system according to claim 7 , wherein generating includes modifying or creating, or both.

12. The computer system according to claim 7 , wherein the items of state data comprise a wide range of possible forms including: data structures, addresses, flags, limiting values, Boolean values, pointers, arrays, constant values, character strings, hash values, or binary data.

13. A computer program product for protecting state data of computer system code, comprising:
one or more non-transitory computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions comprising:
program instructions to register an item of state data for protection, wherein registering the item of state data for protection is carried out at system runtime when an item of state data is modified;
program instructions to preserve a field value of the item of state data in a form inaccessible to third party software by taking a snapshot of the item of the state data and storing it in an encrypted form;
program instructions to determine the field value of the item of state data being altered greater than an acceptable deviation by comparing a current field value with the preserved field value, wherein validating the field value is carried out at specified times; and
program instructions to initiate an action in response to the field value being altered greater than an acceptable deviation.

14. The computer program product according to claim 13 , wherein the program instructions to register the item of state data for protection are implemented at system initialization when the item of state data is created.

15. The computer program product according to claim 13 , wherein the instructions to preserve the field value hardens a copy of the field value to a non-memory destination which only the system computer code has access to.

16. The computer program product according to claim 13 , wherein the program instructions to preserve the field value of the item of state data includes program instructions to preserve multiple field values of multiple items of state data in a single preserving operation.

17. The computer program product according to claim 13 , wherein generating includes modifying or creating, or both.

18. The computer program product according to claim 13 , wherein the items of state data comprise a wide range of possible forms including: data structures, addresses, flags, limiting values, Boolean values, pointers, arrays, constant values, character strings, hash values, or binary data.

19. The method according to claim 1 , wherein the specified times are selected from a group consisting of: periodically, as part of a subsystem dispatch cycle, when the fields themselves are referred to, or as part of internal trace recording or a housekeeping operation.

20. The method according to claim 1 , wherein an action comprises one or more of: alerting an operator, keeping the modified field value, returning the field value back to the preserved field value, or terminating the system.

Assignees

• IBM

Inventors

• Harman David J
• Whittingham Gary O
• Woolley Mark A
• Wright Andrew

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/0471

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title

• G06F16/2365

  Ensuring data consistency and integrity · CPC title