Damage containment by translation
View Patent ↗Interface elements of a logic module are translated by renaming, adding dummy elements, and/or associating traps with dummy elements. Trusted parties are made aware of renamed interface elements and thereby allowed to properly communicate with logic module. Untrusted parties are kept unaware of the interface translation, with attempts to guess correct interface elements likely to fail, instead resulting in communication attempts with dummy elements and subsequent trapping of the untrusted parties.
1. A computer-assisted method for translating a logic module interface, comprising the steps of:
determining a first interface of a logic module, the first interface having a first one or more interface element names; and
generating a second interface of the logic module, the second interface having a second one or more interface element names;
wherein the generating step comprises renaming the first one or more interface element names to produce the second one or more interface element names.
2. The method of claim 1 , wherein the renaming step comprises generating one, or more random strings as the second one or more interface element names.
3. The method of claim 1 , wherein the renaming step comprises hashing the first one or more interface element names.
4. The method of claim 1 , wherein the renaming step comprises adding an offset to the first one or more interface element names.
5. The method of claim 1 , wherein the generating step further comprises adding one or more dummy interface elements to the second interface.
6. The method of claim 5 , wherein the generating step further comprises associating one or more traps with the one or more dummy interface elements.
7. The method of claim 1 , wherein the logic module comprises an operating system and the first interface comprises a set of system calls of the operating system.
8. A computer-assisted method for translating a user module, comprising the steps of:
determining a first user module and a translation, the translation mapping a first provider interface to a second provider interface; and
generating a second user module according to the translation;
wherein the generating step comprises replacing a first reference in the first user module to an element in the first provider interface with a second reference to an element in the second provider interface according to the translation.
9. The method of claim 8 , wherein the first provider interface comprises a set of system calls of an operating system, the second provider interface comprises a translated set of system calls of the operating system, the first user module comprises a software application referencing the first provider interface, and the second user module comprises a translated software application referencing the second provider interface.
10. A computer system, comprising:
an operating system;
a processing module, wherein the processing module is running the operating system;
a first set of one or more system calls to the operating system for disclosing to trusted software modules; and
a second set of one or more dummy systems calls to the operating system for trapping untrusted software modules.
11. The computer system of claim 10 , wherein the untrusted software module is disabled after a reference to any one or more of the second set of one or more dummy systems calls.
12. The computer system of claim 10 , wherein the operating system generates a system administrator alert after reference to any one or more of the second set of one or more dummy systems calls.
13. The computer system of claim 10 , wherein the operating system generates an event log after reference to any one or more of the second set of one or more dummy systems calls.
14. A computer system comprising: a processing module; a software program; and an operating system; the software program configured for running on the operating system, the operating system having a translated system call interface, the translated system call interface comprising a first set of translated system call names for disclosing to trusted parties, the translated system call interface further comprising a second set of dummy system call names untranslated system call names for trapping entrusted parties, the software program comprising:
a set of one or more instructions;
wherein the set of one or more instructions comprises one or more references to the first set of translated system call names.
15. The computer system of claim 14 , wherein a second software program is disabled after the second software program references any one the second set of dummy system call name untranslated system call names.
16. The computer system of claim 14 , wherein the operating system generates a log event after a reference to any one or more of the second set of dummy system call name untranslated system call names.
17. The computer system of claim 14 , wherein the operating system generates a system administrator alert after reference to any one or more of the second set of dummy system call name untranslated system call names.
18. A shared software library stored on machine readable media, comprising:
a first set of one or more library functions for disclosing to trusted software modules; and
a second set of one or more dummy library functions for trapping untrusted software modules.
19. The shared software library of claim 18 , wherein a corresponding library function is disabled after a reference to the corresponding dummy library function.
20. The shared software library of claim 18 , wherein the untrusted software modules are disabled after a reference to the corresponding dummy library function.
21. The shared software library of claim 18 , wherein the dummy library function generates a system log event as result of a reference to the corresponding dummy library function.
22. The shared software library of claim 18 , wherein the dummy library function generates a system administrator alert as result of a reference to the corresponding dummy library function.
23. A hardware processing system, comprising:
a processor;
an instruction translation table; and
a module name translation table;
wherein the processor fetches an instruction, decodes the instruction according to a translation stored in the translation table, and executes the decoded instruction, and wherein instruction calls to modules are translated according to the module name translation table.
24. A method for generating a web page, comprising the steps of:
receiving a web page request having a first URL;
translating the first URL to a second URL according to a URL translation table, the second URL indicating a first web page, the first web page having a third one or more embedded URLS; and
generating a second web page;
wherein the generating step comprises replacing the third one or more embedded URLS with translated versions of said third one or more embedded URLS according to the URL translation table to obtain the second web page.
25. The method of claim 24 , wherein a reference any one or more third one or more embedded URLS before translation will generate a system administrator alert.
26. A method for processing a file access request, comprising the steps of:
receiving a file access request having a first string; and
translating the first string to a second string, the second string indicating a file name;
wherein the translating step proceeds according to a file name translation table.
27. A method for providing access to a file system, comprising the steps of:
receiving a file access request; and
processing the request;
wherein the file access request comprises a file name and a first file name extension, the processing step comprises translating the first file name extension to obtain a second file name extension and providing access to a file indicated by the file name and the second file name extension.
28. A method for processing a network packet, comprising the steps of:
receiving a network packet, the network packet comprising a protocol type field having a first protocol type identifier;
translating the first protocol type identifier to a second protocol type identifier; and
routing the network packet according to a protocol indicated by the second protocol type identifier;
wherein the translating step proceeds according to a protocol type field translation table.
29. A method for processing a database command, comprising the steps of:
receiving a database command having a first command string; and
translating the first command string to a second command string, the second command string indicating a database command keyword;
wherein the translating step proceeds according to a database command keyword translation table.