Altered Token Sandboxing for Secure Untrusted Execution

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing systems face challenges in securely running untrusted software in multithreaded environments without significant performance loss, as they often grant excessive privileges or fail to restrict access to system resources effectively, leaving them vulnerable to malicious code.

Innovation Solution

User-mode altered token sandboxing, which utilizes altered tokens with restricted privileges to create a 'naked token' that denies all access, combined with a broker and target process architecture, where the target process runs with a naked token and is controlled by a job object to limit system interactions, ensuring secure execution without modifying the operating system.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If kernel mode sandboxing is used to securely execute untrusted software, then system security is improved, but system stability deteriorates due to the risk of mistakes in modifying the operating system

Engineering Contradiction:
Improvesystem securityVSAvoidsystem stability
Core Design Contradiction:
ReliabilityVSStability of the object's composition

Solution Approach 1:

The patent introduces a user-mode sandboxing intermediary layer that mediates between untrusted software and the operating system kernel. This intermediary runs in user mode rather than kernel mode, providing security enforcement without directly modifying or compromising kernel stability. The sandbox acts as a buffer that isolates untrusted code while maintaining system integrity.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the execution environment into isolated sandboxed regions within user mode. Each sandboxed process runs in a confined memory space with restricted access to system resources, separating untrusted code from the core operating system. This segmentation prevents mistakes or malicious actions in one sandbox from affecting system stability.

Inventive Principle:
Principle #1Segmentation

2Stability of the object's composition

If user mode sandboxing with dynamic translation is used to securely execute untrusted software, then system stability is improved, but application performance deteriorates due to code rewriting overhead

Engineering Contradiction:
Improvesystem stabilityVSAvoidapplication performance
Core Design Contradiction:
Stability of the object's compositionVSProductivity

Solution Approach 1:

The patent performs preliminary sandbox setup and token configuration actions before executing untrusted code. By pre-configuring the sandboxed environment, restricting tokens, and establishing security boundaries in advance, the system avoids the need for runtime code translation and rewriting, thereby maintaining application performance while ensuring stability.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent extracts the security enforcement mechanisms from the code execution path itself. Instead of translating or rewriting code during execution, the system extracts security checks into separate privilege verification routines that operate on metadata and tokens associated with the code, allowing original code to execute unchanged at native speed.

Inventive Principle:
Principle #2Taking out (Extraction)

3Ease of operation

If traditional tokens are used to control process privileges, then ease of operation is improved, but security deteriorates due to inability to dynamically restrict privileges in multithreaded systems

Engineering Contradiction:
Improvetoken management simplicityVSAvoidsecurity
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent implements dynamic privilege restriction by allowing tokens to be modified and updated during runtime in multithreaded environments. The system can dynamically create restricted copies of tokens, adjust privilege levels, and enforce different security policies for different threads and processes, transforming static token management into a dynamic security control mechanism.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The patent applies different security restrictions to different threads and processes based on their specific needs. Each thread can have its own customized restricted token with privileges tailored to its function, allowing fine-grained security control where each local execution context receives appropriate access rights rather than applying uniform restrictions system-wide.

Inventive Principle:
Principle #3Local quality

4Manufacturing precision

If segmentation is used to cord off memory access for specific applications, then memory protection is improved, but security deteriorates because applications can still access other system resources through process spawning

Engineering Contradiction:
Improvememory protection precisionVSAvoidoverall security
Core Design Contradiction:
Manufacturing precisionVSReliability

Solution Approach 1:

The patent extends sandboxing restrictions beyond just memory access to cover multiple system resources universally. The sandbox mechanism implements multi-functional control that restricts file system access, network connections, process creation, and other system resources simultaneously, not merely memory segmentation. This universal restriction approach ensures that even if memory protection is bypassed, other security boundaries remain intact.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2332048B1Altered token sandboxing
Publication Date: 2017.12.27 GOOGLE LLC
  • EP2332048B1 patent drawingFigure 1~2
  • EP2332048B1 patent drawingFigure 3
  • EP2332048B1 patent drawingFigure 4

AI summary

Embodiments of the present invention relate generally to application security. In an embodiment, a method for altered token sandboxing includes creating a process based on a naked token and suspending the process. The method further includes obtaining an impersonation token and resuming the process with the impersonation token. The method further includes acquiring resources needed for the process with the impersonation token. The method also includes replacing the impersonation token with the naked token, hi a further embodiment, the method further includes executing the suspended process with the naked token and the acquired resources. In another embodiment, a system for user-mode, altered token sandboxing includes a security module, an acquisition module and a replacement module. In a further embodiment, the system may include an execution module. In another embodiment, the system may include a request module.