Defensive techniques to increase computer security
View Patent ↗Among other disclosed subject matter, a computer-implemented method includes initializing a first descriptor table and a second descriptor table. The first descriptor table is associated with a first permission level and the second descriptor table is associated with a second permission level that is different from the first permission level. The first descriptor table and the second descriptor table are associated with a hardware processor and initialized by an operating system kernel. The method also includes providing a memory address associated with the first descriptor table, in response to a descriptor table address request. The descriptor table address request is provided by a software process. The method also includes updating the second descriptor table, in response to an update request.
1. A computer-implemented method, the method comprising:
initializing a descriptor table, wherein the descriptor table is initialized by an operating system kernel and is associated with a hardware processor;
changing a permission level associated with the descriptor table to a first permission level; and
in response to an update request,
(A) changing the permission level associated with the descriptor table to a second permission level, wherein the second permission level is greater than the first permission level;
(B) updating the descriptor table while the descriptor table is associated with the second permission level, wherein the updating is based on the update request; and
after updating the descriptor table, (C) changing the permission level associated with the descriptor table to the first permission level,
wherein the changing (A), the updating (B), and the changing (C) are limited to the descriptor table.
2. The computer-implemented method of claim 1 further comprising:
in response to a request to access the descriptor table, accessing the descriptor table, wherein the descriptor table is associated with the first permission level.
3. The computer-implemented method of claim 1 wherein the first permission level comprises a read-only permission level and wherein the second permission level comprises a read-write permission level.
4. A computing system comprising:
one or more computers; and
one or more storage units storing instructions that when executed by the one or more computers cause the computing system to perform operations comprising:
initializing a descriptor table, wherein the descriptor table is initialized by an operating system kernel and is associated with a hardware processor;
changing a permission level associated with the descriptor table to a first permission level; and
in response to an update request,
(A) changing the permission level associated with the descriptor table to a second permission level, wherein the second permission level is greater than the first permission level;
(B) updating the descriptor table while the descriptor table is associated with the second permission level, wherein the updating is based on the update request; and
after updating the descriptor table, (C) changing the permission level associated with the descriptor table to the first permission level,
wherein the changing (A), the updating (B), and the changing (C) are limited to the descriptor table.
5. The system of claim 4 , the operations further comprising:
in response to a request to access the descriptor table, accessing the descriptor table, wherein the descriptor table is associated with the first permission level.
6. The system of claim 4 , wherein the first permission level comprises a read-only permission level and wherein the second permission level comprises a read-write permission level.
7. A non-transitory computer storage medium encoded with a computer program, the computer program comprising instructions that when executed by a computing system cause the computing system to perform operations comprising:
initializing a descriptor table, wherein the descriptor table is initialized by an operating system kernel and is associated with a hardware processor;
changing a permission level associated with the descriptor table to a first permission level; and
in response to an update request,
(A) changing the permission level associated with the descriptor table to a second permission level, wherein the second permission level is greater than the first permission level;
(B) updating the descriptor table while the descriptor table is associated with the second permission level, wherein the updating is based on the update request; and
after updating the descriptor table, (C) changing the permission level associated with the descriptor table to the first permission level,
wherein the changing (A), the updating (B), and the changing (C) are limited to the descriptor table.
8. The non-transitory computer storage medium of claim 7 , the operations further comprising:
in response to a request to access the descriptor table, accessing the descriptor table, wherein the descriptor table is associated with the first permission level.
9. The non-transitory computer storage medium of claim 7 , wherein the first permission level comprises a read-only permission level and wherein the second permission level comprises a read-write permission level.