Computing device having a multiple process architecture for running plug-in code modules
View Patent ↗A computing device is provided with a multiple process architecture for running plug-in code modules in their own dedicated processes for increasing both the security and reliability of software systems using plug-in design patterns. In this regard, the computing device may have a process-based security model that permits a software application to utilize a plug-in module having security attributes different to or incompatible with those of the application by invoking the plug-in module as a separate process. Additional and alternative apparatuses and methods are also provided.
1. An apparatus comprising a computing device, the computing device being configured to cause the apparatus to at least:
implement a process-based security model on the apparatus, wherein the process-based security model includes at least one set of permissions that defines allowable activities and accessible resources for a process;
implement a software application having security attributes, wherein the software application is invoked as a first process and wherein the first process is a separately executing process;
implement a plug-in module having security attributes different to, or incompatible with, the security attributes of the application;
invoke the plug-in module as a second process, the second process being a separate process from the first process of the software application, wherein the second process is a separately executing process;
wherein the software application seeking to invoke the plug-in module verifies the security attributes of the plug-in module before invoking the plug-in module and wherein the plug-in module verifies the security attributes of the application invoking the plug-in module; and
pass information from the software application to the plug-in module via a data structure before the plug-in is executed, wherein the information is used as handles to system resources or other objects.
2. A method comprising:
implementing a process-based security model on a computing device, wherein the process-based security model includes at least one set of permissions that defines allowable activities and accessible resources for a process;
implementing a software application having security attributes, wherein the software application is invoked as a first process and wherein the first process is a separately executing process;
implementing a plug-in module having security attributes different to, or incompatible with, the security attributes of the software application;
invoking the plug-in module as a second process, the second process being a separate process from the first process of the application, wherein the second process is a separately executing process;
wherein the software application seeking to invoke the plug-in module verifies the security attributes of the plug-in module before invoking the plug-in module and wherein the plug-in module verifies the security attributes of the software application invoking the plug-in module; and
passing information from the software application to the plug-in module via a data structure before the plug-in is executed, wherein the information is used as handles to system resources or other objects.
3. An apparatus comprising a computing device, the computing device being configured to cause the apparatus to at least:
implement an operating system having a process-based security model, wherein the process-based security model includes at least one set of permissions that defines allowable activities and accessible resources for a process;
implement a software application having security attributes, wherein the software application is invoked as a first process and wherein the first process is a separately executing process;
implement a plug-in module having security attributes different to, or incompatible with, the security attributes of the software application;
invoke the plug-in module as a second process, the second process being a separate process from the first process of the application, wherein the second process is a separately executing process;
wherein the software application seeking to invoke the plug-in module verifies the security attributes of the plug-in module before invoking the plug-in module and wherein the plug-in module verifies the security attributes of the application invoking the plug-in module; and
pass information from the software application to the plug-in module via a data structure before the plug-in is executed, wherein the information is used as handles to system resources or other objects.
4. The apparatus of claim 3 , wherein the computing device configured to implement the operating system includes being configured to implement the operating system having a process-based security model, the process-based security model being configured to use a process for implementing security features and memory protection.