IP Library Granted Patent US 8,694,797
Granted Patent B2
US 8,694,797 · App. 11/353,893 · Granted Apr 8, 2014

Method for preventing malicious software from execution within a computer system

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,694,797
App. No.
11/353,893
Granted
Apr 8, 2014
Kind
B2
Abstract

A method for preventing malicious software from execution within a computer system is disclosed. Before any actual execution of an application program on a computer system, the application program needs to be cross-compiled to yield a set of cross-compiled code of the application program. The set of cross-compiled code of the application program can then be executed in an execution module that is capable of recognizing and translating the set of cross-compiled code of the application program to the actual machine code of the processor.

Claims (31)

1. A method for preventing malicious software from execution within a computer system, said method comprising:

providing said computer system a permuted instruction pointer table having a plurality of randomly generated permutation sequences, wherein each of said plurality of permutation sequences is generated by utilizing a subset of N instructions selected within an instruction set;

in response to a request to install an application program within said computer system, replacing each occurrence of said N subset of instructions within a set of executable code of said application program to another one of said N subset of instructions based on one of said plurality of permutation sequences to yield a set of permuted executable code of said application program before any actual execution of said application program on said computer system, wherein said permutation sequence associates each selected instruction 1 through N to a respective slot 1 through N and stores within said each slots, a respective identifier to a different one of said Nth instruction that will be used to replace each occurrence of said selected instruction within said executable code block with said Nth instruction identified from that respective slot; and

in response to a request to execute said application program within said computer system, transforming said set of permuted executable code of said application program back to said set of executable code of said application program based on said one permutation sequence, and executing said set of executable code in an execution module within said computer system by translating said set of executable code of said application program to an actual machine code of a processor within said computer system, such that any application program that has not been permuted via said permuted instruction pointer table is not able to be executed within said computer system.

2. The method of claim 1 , wherein said method further includes assigning each of said subset of instructions a unique instruction number.

3. The method of claim 2 , wherein said permutation sequence includes a sequence of said unique instruction numbers.

4. The method of claim 1 , wherein said permutation sequence is stored in a permuted instruction pointer table within said computer system.

5. The method of claim 1 , wherein said method further includes

providing a first virtual machine to perform said cross-compiling; and

providing a second virtual machine to perform said transforming and executing.

6. The method of claim 5 , wherein said first virtual machine includes a first operating system and said second virtual machine includes a second operating system.

7. A non-transitory computer usable device having a computer program product for preventing malicious software from execution within a computer system, said computer usable device comprising:

program code for providing said computer system a permuted instruction pointer table having a plurality of randomly generated permutation sequences, wherein each of said plurality of permutation sequences is generated by utilizing a subset of N instructions selected within an instruction set;

program code for, in response to a request to install an application program within said computer system, replacing each occurrence of said N subset of instructions within a set of executable code of said application program to another one of said N subset of instructions based on one of said plurality of permutation sequences to yield a set of permuted executable code of said application program before any actual execution of said application program on said computer system, wherein said permutation sequence associates each selected instruction 1 through N to a respective slot 1 through N and stores within said each slots, a respective identifier to a different one of said Nth instruction that will be used to replace each occurrence of said selected instruction within said executable code block with said Nth instruction identified from that respective slot; and

program code for, in response to a request to execute said application program within said computer system, transforming said set of permuted executable code of said application program back to said set of executable code of said application program based on said one permutation sequence, and executing said set of executable code in an execution module within said computer system by translating said set of executable code of said application program to an actual machine code of a processor within said computer system, such that any application program that has not been permuted via said permuted instruction pointer table is not able to be executed within said computer system.

8. The computer usable device of claim 7 , wherein said computer usable medium further includes program code for assigning each of said subset of instructions a unique instruction number.

9. The computer usable device of claim 8 , wherein said permutation sequence further includes a sequence of said unique instruction numbers.

10. The computer usable device of claim 7 , wherein said permutation sequence is stored in a permuted instruction pointer table within said computer system.

11. The computer usable device of claim 7 , wherein said computer usable medium further includes

program code for providing a first virtual machine to perform said cross-compiling; and

program code for providing a second virtual machine to perform said transforming and executing.

12. The computer usable device of claim 11 , wherein said first virtual machine includes a first operating system and said second virtual machine includes a second operating system.

13. A computer system capable of preventing malicious software from being executed, said computer system comprising:

a processor; and

a system memory coupled to said processor, wherein said system memory contains:

a permuted instruction pointer table having a plurality of randomly generated permutation sequences, wherein each of said plurality of permutation sequences is generated by utilizing a subset of N instructions selected within an instruction set;

a cross compiler for, in response to a request to install an application program within said computer system, replacing each occurrence of said N subset of instructions within a set of executable code of said application program to another one of said N subset of instructions based on one of said plurality of permutation sequences to yield a set of permuted executable code of said application program before any actual execution of said application program on said computer system, wherein said permutation sequence associates each selected instruction 1 through N to a respective slot 1 through N and stores within said each slots, a respective identifier to a different one of said Nth instruction that will be used to replace each occurrence of said selected instruction within said executable code block with said Nth instruction identified from that respective slot; and

an execution module, in response to a request to execute said application program within said computer system, for transforming said set of permuted executable code of said application program back to said set of executable code of said application program based on said one permutation sequence, and executing said set of executable code in said execution module within said computer system by translating said set of executable code of said application program to an actual machine code of a processor within said computer system, such that any application program that has not been permuted via said permuted instruction point table is not able to be executed within said computer system.

14. The computer system of claim 13 , wherein each of said subset of instructions is assigned a unique instruction number.

15. The computer system of claim 14 , wherein said permutation sequence includes a sequence of said unique instruction numbers.

16. The computer system of claim 15 , wherein said permutation sequence is stored in a permuted instruction pointer table.

Assignments (4)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 10, 2025
From: LENOVO PC INTERNATIONAL LIMITED
To: LENOVO SWITZERLAND INTERNATIONAL GMBH
Reel/Frame 069870/0670 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 3, 2019
From: LENOVO (SINGAPORE) PTE. LTD.
To: LENOVO PC INTERNATIONAL
Reel/Frame 049667/0620 →
NUNC PRO TUNC ASSIGNMENT Recorded Dec 4, 2015
From: LENOVO (SINGAPORE) PTE LTD.
To: LENOVO PC INTERNATIONAL
Reel/Frame 037211/0693 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 15, 2006
From: CHALLENER, DAVID C.; DAVIS, MARK C.; HORTENSIUS, PETER; WALTERMANN, ROD D.
To: LENOVO (SINGAPORE) PTE. LTD.
Reel/Frame 017627/0517 →