Security Deployment System

Abstract

To address security that can arise in information systems, the present invention uses novel methods and/or systems to enhance security in information systems, using a new way to deploy selected security policies. Instead of trying to modify a whole binary file all at once to add in code to implement additional security policies, the current invention modifies the code in memory in a piecemeal, as-needed fashion.

What is claimed: 
     
         1 . A method of using binary code translation to introduce security policy for a program run on a data processor, comprising:
 a), translating code for said program at runtime by adding code to implement said security policy;   b) holding said translation of code at branches with unknown targets, termed dynamic branches;   c) continuing the said translation process at runtime when a dynamic branch is executed;   d) said translation beginning at the target of the said dynamic branch;   whereby code is translated on an as-needed basis to introduce a security policy.   
     
     
         2 . A method according to  claim 1  further comprising:
 a) said security policy includes checking branch targets; 
 b) said branch targets are determined to be only within code approved by an administrator or user 
 
     
     
         3 . A method according to  claim 1  further comprising:
 a) said code translation includes using an address translation table; 
 b) said table providing a mapping from original program addresses to addresses in the translated code; 
 c) translating branches in said code includes inserting code to branch to the target address provided by said table instead of the original target address; 
 whereby branches go to the properly translated target taking into account the address changes caused by inserting code. 
 
     
     
         4 . A method according to  claim 3  wherein c) further comprises:
 a) determining when targets of said branches are static 
 b) replacing the said branch target in said translated code with the actual target address provided by said table; 
 whereby repeated table lookups are avoided. 
 
     
     
         5 . An apparatus using binary code translation to introduce security policy for a program run on a data processor, comprising:
 a) a means of translating code for said program at runtime by adding code to implement said security policy;   b) a means of holding said translation of code at branches with unknown targets, termed dynamic branches;   c) a means of continuing the said translation process at runtime when a dynamic branch is executed;   d) a means of having said translation begin at the target of the said dynamic branch;   whereby code is translated on an as-needed basis to introduce a security policy.   
     
     
         6 . An apparatus according to  claim 1  further comprising:
 a) a means of having said security policy include checking branch targets; 
 b) a means of having said branch targets determined to be only within code approved by an administrator or user 
 
     
     
         7 . An apparatus according to  claim 1  further comprising:
 a) a means of having said code translation include using an address translation table; 
 b) a means of having said table provide a mapping from original program addresses to addresses in the translated code; 
 c) a means of translating branches in said code that includes inserting code to branch to the target address provided by said table instead of the original target address; 
 whereby branches go to the properly translated target taking into the address changes caused by inserting code. 
 
     
     
         8 . An apparatus according to  claim 3  wherein c) further comprises:
 a) a means of determining when targets of said branches are static 
 b) a means of replacing the said branch target in said translated code with the actual target address provided by said table; 
 whereby repeated table lookups are avoided.