Patent ID: 7774599
Filing Date: 2010-08-10
Classification: G06F,H04L

Abstract:
1. A computer system securing inter-process communication (IPC) based on trust, the system comprising: a user quota mechanism providing resource management of IPCs, wherein a single user is allowed to allocate a fixed amount of objects within a system maximum, the fixed amount being less than the system maximum; and a trusted IPC mechanism, embodied as computer executable instructions executed by a computer processor, mediating access to IPC objects by employing signed executables signed by a key and containing a list of trusted keys, and using a trust relationship among a set of subjects connected to an IPC to determine whether communication can be carried out between processes, wherein in order for the processes to communicate via an IPC, either they have to trust each other, or a kernel must trust one process and that process must also trust the other process; wherein said trusted IPC mechanism classifies subjects into domains and prevents a subject, which is misbehaving in one of the domains, from affecting subjects in another of the domains; wherein said trusted IPC mechanism verifies that executables are signed with a vendor key that is a certificate uniquely identifying a software vendor that created the executable, wherein, upon execution, the vendor key is linked with a resulting subject, so the vendor key can always be found; and wherein said trusted IPC mechanism employs a kernel trust scheme in which the kernel trusts multiple vendor keys, and all subjects signed with vendor keys trusted by the kernel are allowed to communicate with each other, but untrusted subjects, those subjects that are either not signed with a vendor key or are not signed with a vendor key trusted by the kernel, are allowed to communicate with one another, but not with trusted subjects.