Jeffrey S Barber

US Patent:

7398532, Jul 8, 2008

Filed:

Mar 2, 2000

Appl. No.:

09/517366

Inventors:

Jeffrey S. Barber - Duluth GA, US
Joseph K. Vossen - Duluth GA, US

Assignee:

Hewlett-Packard Development Company, L.P. - Houston TX

International Classification:

G06F 9/46
G06F 12/14

US Classification:

719328, 718100, 726 16

Abstract:

A system and method for establishing a secure execution environment for a software process analyzes system application program interface (API) calls to determine whether the system API call executes a new program. If the system API call executes a new program, the system and method of the invention analyze the call to determine whether an execution environment, in the form of a plurality of attributes, is attached to an executable program file associated with the new program. An execution environment contains security attributes that are to be associated with the resulting process invoked by execution of the new program. If an execution environment is attached, the invention assigns the attributes of the execution environment to the new process, thereby ensuring that the new process includes the security features and capabilities specified in the execution environment.

US Patent:

60264020, Feb 15, 2000

Filed:

Jan 7, 1998

Appl. No.:

9/004131

Inventors:

Joseph K. Vossen - Deluth GA
Jeffrey S. Barber - Tucker GA

Assignee:

Hewlett-Packard Company - Palo Alto CA

International Classification:

G06F 15163

US Classification:

707 9

Abstract:

The present invention provides a method and apparatus for restricting a process or process hierarchy to a subset of a computer host's file system(s) in an environment where all file systems are simultaneously available to an application. A caller is provided with the ability to arrange for the restriction of a process hierarchy (consisting of a process and all the processes it may subsequently create) to a set of file system sub-hierarchies. When a process executes within a restriction domain in which a sub-hierarchy has been specified for each of the available file systems, an embodiment of the invention will modify the usual operation of the host computer's operating system interface such that any file system access attempts by the affected process are constrained to occur logically within the restriction domain.