Method and system for detecting modified pages

1. A method for validating program execution, comprising:

identifying a program from a second computer system;

obtaining, by a first computer system, a first copy of a page for a file of the program from a second computer system to create a first obtained page;

calculating a hash value for the first obtained page;

storing the first obtained page in a local memory of the first computer system;

storing the hash value for the first obtained page; and

executing the program on the first computer system, wherein the first obtained page is removed from the local memory during execution of the program, and wherein executing the program comprises:

obtaining a second copy of the page from the second computer system to create a second obtained page;

calculating a hash for the second obtained page;

determining whether the hash value for the first obtained page is equal to the hash value for the second obtained page; and

performing an appropriate action in response to determining whether the hash value for the first obtained page is equal to the hash value for the second obtained page.

2. The method of claim 1 , further comprising:

validating the file prior to executing the program.

3. The method of claim 2 , wherein validating the file comprises:

performing a cryptographic hash of the file using a public key certificate to obtain a hash value for the file; and

comparing the hash value for the file with a plurality of manifest entries in a revocation directory to determine whether a match is found,

wherein the file is valid when a match is not found.

4. The method of claim 1 , wherein the file is one selected from a group consisting of an executable file, a data file, and a library file.

5. The method of claim 1 , wherein the first computer system is implemented in a first zone and wherein the second computer system is implemented in a second zone executing on the same physical computing device.

6. The method of claim 1 , wherein performing the appropriate action comprises:

stopping execution of the program when the hash value for the first obtained page is not equal to the hash value for the second obtained page; and

continuing execution of the program when the hash value for the first obtained page is equal to the hash value for the second obtained page.

7. The method of claim 1 , wherein the first computer system is implemented as a first guest domain and wherein the second computer system is implemented as a second guest domain executing in a hypervisor environment on the same physical computing device.

8. A first computer system for validating program execution comprising:

a processor;

a local memory; and

software instructions stored in memory for causing the first computer system to:

identify a program from a second computer system;

obtain a first copy of a page for a file of the program from the second computer system to create a first obtained page;

calculate a hash value for the first obtained page;

store the first obtained page in the local memory of the first computer system;

store the hash value for the first obtained page; and

execute the program on the first computer system, wherein the first obtained page is removed from the local memory during execution of the program, and wherein executing the program comprises:

obtaining a second copy of the page from the second computer system to create a second obtained page;

calculating a hash for the second obtained page;

determining whether the hash value for the first obtained page is equal to the hash value for the second obtained page; and

performing an appropriate action in response to determining whether the hash value for the first obtained page is equal to the hash value for the second obtained page.

9. The first computer system of claim 8 , wherein the software instructions further cause the first computer system to:

validate the file prior to executing the program.

10. The first computer system of claim 9 , wherein validating the file comprises:

performing a cryptographic hash of the file using a public key certificate to obtain a hash value for the file; and

comparing the hash value for the file with a plurality of manifest entries in a revocation directory to determine whether a match is found,

wherein the file is valid when a match is not found.

11. The first computer system of claim 8 , wherein the file is one selected from a group consisting of an executable file, a data file, and a library file.

12. The first computer system of claim 8 , wherein the first computer system is implemented in a first zone and wherein the second computer system is implemented in a second zone executing on the same physical computing device.

13. The first computer system of claim 8 , performing the appropriate action comprises:

stopping execution of the program when the hash value for the first obtained page is not equal to the hash value for the second obtained page; and

continuing execution of the program when the hash value for the first obtained page is equal to the hash value for the second obtained page.

14. The first computer system of claim 8 , wherein the first computer system is implemented as a first guest domain and wherein the second computer system is implemented as a second guest domain executing in a hypervisor environment on the same physical computing device.

15. A non-transitory computer readable medium comprising computer readable program code embodied therein for causing a computer system to:

identify a program from a second computer system;

obtain, by a first computer system, a first copy of a page for a file of the program from a second computer system to create a first obtained page;

calculate a hash value for the first obtained page;

store the first obtained page in a local memory of the first computer system;

store the hash value for the first obtained page; and

execute the program on the first computer system, wherein the first obtained page is removed from the local memory during execution of the program, and wherein executing the program comprises:

obtaining a second copy of the page from the second computer system to create a second obtained page;

calculating a hash for the second obtained page;

determining whether the hash value for the first obtained page is equal to the hash value for the second obtained page; and

performing an appropriate action in response to determining whether the hash value for the first obtained page is equal to the hash value for the second obtained page.

16. The non-transitory computer readable medium of claim 15 , wherein the computer readable program code further cause the computer system to:

validate the file prior to executing the program.

17. The non-transitory computer readable medium of claim 16 , wherein validating the file comprises:

performing a cryptographic hash of the file using a public key certificate to obtain a hash value for the file; and

comparing the hash value for the file with a plurality of manifest entries in a revocation directory to determine whether a match is found,

wherein the file is valid when a match is not found.

18. The non-transitory computer readable medium of claim 15 , wherein the file is one selected from a group consisting of an executable file, a data file, and a library file.

19. The non-transitory computer readable medium of claim 15 , wherein the first computer system is implemented in a first zone and wherein the second computer system is implemented in a second zone executing on the same physical computing device.

20. The non-transitory computer readable medium of claim 15 , wherein the first computer system is implemented as a first guest domain and wherein the second computer system is implemented as a second guest domain executing in a hypervisor environment on the same physical computing device.