Data protection for opaque data structures
Methods, media and systems that use an encoded opaque pointer in an API between a client process and a library process. An encoded opaque pointer, in one embodiment, can be received by the library process from the client process, and the library process can decode the opaque pointer to obtain an address in memory containing a data structure pointed to by the opaque pointer. The library process can operate on the data structure to create a revised or processed data structure, stored in the same or different address in heap memory or stack memory, and the library process can encode and return a new opaque pointer, for the processed data structure, to the client process.
1. A machine readable non-transitory storage medium containing executable instructions which when executed by a data processing system cause the data processing system to perform a method comprising:
receiving, at a library process, a first encoded opaque pointer from a client process;
decoding, in the library process, the first encoded opaque pointer to derive a first address in memory for data in a data structure;
processing, in the library process, the data structure to create a processed data structure;
generating and encoding, in the library process, a second opaque pointer to reference the processed data structure, wherein the first opaque pointer and second opaque pointer are different from one another and the first opaque pointer and second opaque pointer are both generated by the same library process on the same data processing system; and
returning to the client process the second opaque pointer.
2. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises deriving a representation of text of executable code in the library process and using the representation of text as a variable in the encoding of the second opaque pointer.
3. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises obtaining a representation of text of executable code in the client process and using the representation of text as a variable in the encoding of the second opaque pointer.
4. The medium as in claim 1 wherein the first opaque pointer is created in an encoding process by the library process.
5. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises performing a series of encoding operations in which an output from one encoding operation is used as an input to a next encoding operation.
6. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises using one or more constants in executable code in the library process as variables in the encoding of the second opaque pointer.
7. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises using a representation of a pointer value, corresponding to the first address, as a variable in the encoding of the second opaque pointer.
8. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises using a representation of the processed data structure as a variable in the encoding of the second opaque pointer.
9. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises calculating an encryption function with a key and variables, wherein the variables comprise a representation of text of executable code in the library process and a representation of the processed data structure; and wherein the key is a concatenation of a representation of selected text of executable code in the library process and a representation of the pointer value.
10. The medium as in claim 9 wherein the representation of text is randomly selected, and wherein the encoding is nondeterministic and dynamic.
11. A machine implemented method practiced on a data processing system, the method comprising:
receiving, at a library process, a first encoded opaque pointer from a client process;
decoding, in the library process, the first encoded opaque pointer to derive a first address in memory for data in a data structure;
processing, in the library process, the data structure to create a processed data structure;
generating and encoding, in the library process, a second opaque pointer to reference the processed data structure, wherein the first opaque pointer and second opaque pointer are different from one another and the first opaque pointer and second opaque pointer are both generated by the same library process on the same data processing system; and
returning to the client process the second opaque pointer.
12. The method as in claim 11 wherein the encoding of the second opaque pointer comprises deriving a representation of text of executable code in the library process and using the representation of text as a variable in the encoding of the second opaque pointer.
13. The method as in claim 11 wherein the encoding of the second opaque pointer comprises obtaining a representation of text of executable code in the client process and using the representation of text as a variable in the encoding of the second opaque pointer.
14. The method as in claim 11 wherein the first opaque pointer is created in an encoding process by the library process.
15. The method as in claim 11 wherein the encoding of the second opaque pointer comprises performing a series of encoding operations in which an output from one encoding operation is used as an input to a next encoding operation.
16. The method as in claim 11 wherein the encoding of the second opaque pointer comprises using one or more constants in executable code in the library process as variables in the encoding of the second opaque pointer.
17. The method as in claim 11 wherein the encoding of the second opaque pointer comprises using a representation of a pointer value, corresponding to the first address, as a variable in the encoding of the second opaque pointer.
18. The method as in claim 11 wherein the encoding of the second opaque pointer comprises using a representation of the processed data structure as a variable in the encoding of the second opaque pointer.
19. The method as in claim 11 wherein the encoding of the second opaque pointer comprises calculating an encryption function with a key and variables, wherein the variables comprise a representation of text of executable code in the library process and a representation of the processed data structure; and wherein the key is a concatenation of a representation of selected text of executable code in the library process and a representation of the pointer value.
20. The method as in claim 19 wherein the representation of text is randomly selected, and wherein the encoding is nondeterministic and dynamic.
21. A data processing system comprising:
means for receiving, at a library process, a first encoded opaque pointer from a client process;
means for decoding, in the library process, the first encoded opaque pointer to derive a first address in memory for data in a data structure;
means for processing, in the library process, the data structure to create a processed data structure;
means for generating and encoding, in the library process, a second opaque pointer to reference the processed data structure, wherein the first opaque pointer and second opaque pointer are different from one another and the first opaque pointer and second opaque pointer are both generated by the same library process on the same data processing system; and
means for returning to the client process the second opaque pointer.
22. The medium as in claim 1 , wherein the first opaque pointer references data in the data structure, and the second opaque pointer references the processed data structure, and first and second opaque pointers have different encodings.
23. The medium as in claim 1 , wherein the second opaque pointer points to a different memory location than the first opaque pointer.
24. The medium as in claim 1 wherein the encoding of the second opaque pointer comprises calculating an encryption function with a key and variables, wherein the variables comprise at least two of: (a) a representation of text of executable code in the library process, (b) one or more constants in the executable code, or (c) a representation of the processed data structure; and wherein the key is a concatenation of a representation of selected text of executable code in the library process and a representation of the pointer value.
25. The method as in claim 11 wherein the encoding of the second opaque pointer comprises calculating an encryption function with a key and variables, wherein the variables comprise at least two of: (a) a representation of text of executable code in the library process, (b) one or more constants in the executable code, or (c) a representation of the processed data structure; and wherein the key is a concatenation of a representation of selected text of executable code in the library process and a representation of the pointer value.