Altered Token Sandboxing for Secure Untrusted Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely running untrusted software in multithreaded environments without significant performance loss, as they often grant excessive privileges or fail to restrict access to system resources effectively, leaving them vulnerable to malicious code.
Innovation Solution
User-mode altered token sandboxing, which utilizes altered tokens with restricted privileges to create a 'naked token' that denies all access, combined with a broker and target process architecture, where the target process runs with a naked token and is controlled by a job object to limit system interactions, ensuring secure execution without modifying the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel mode sandboxing is used to securely execute untrusted software, then system security is improved, but system stability deteriorates due to the risk of mistakes in modifying the operating system
Solution Approach 1:
The patent introduces a user-mode sandboxing intermediary layer that mediates between untrusted software and the operating system kernel. This intermediary runs in user mode rather than kernel mode, providing security enforcement without directly modifying or compromising kernel stability. The sandbox acts as a buffer that isolates untrusted code while maintaining system integrity.
Solution Approach 2:
The patent segments the execution environment into isolated sandboxed regions within user mode. Each sandboxed process runs in a confined memory space with restricted access to system resources, separating untrusted code from the core operating system. This segmentation prevents mistakes or malicious actions in one sandbox from affecting system stability.
2Stability of the object's composition
If user mode sandboxing with dynamic translation is used to securely execute untrusted software, then system stability is improved, but application performance deteriorates due to code rewriting overhead
Solution Approach 1:
The patent performs preliminary sandbox setup and token configuration actions before executing untrusted code. By pre-configuring the sandboxed environment, restricting tokens, and establishing security boundaries in advance, the system avoids the need for runtime code translation and rewriting, thereby maintaining application performance while ensuring stability.
Solution Approach 2:
The patent extracts the security enforcement mechanisms from the code execution path itself. Instead of translating or rewriting code during execution, the system extracts security checks into separate privilege verification routines that operate on metadata and tokens associated with the code, allowing original code to execute unchanged at native speed.
3Ease of operation
If traditional tokens are used to control process privileges, then ease of operation is improved, but security deteriorates due to inability to dynamically restrict privileges in multithreaded systems
Solution Approach 1:
The patent implements dynamic privilege restriction by allowing tokens to be modified and updated during runtime in multithreaded environments. The system can dynamically create restricted copies of tokens, adjust privilege levels, and enforce different security policies for different threads and processes, transforming static token management into a dynamic security control mechanism.
Solution Approach 2:
The patent applies different security restrictions to different threads and processes based on their specific needs. Each thread can have its own customized restricted token with privileges tailored to its function, allowing fine-grained security control where each local execution context receives appropriate access rights rather than applying uniform restrictions system-wide.
4Manufacturing precision
If segmentation is used to cord off memory access for specific applications, then memory protection is improved, but security deteriorates because applications can still access other system resources through process spawning
Solution Approach 1:
The patent extends sandboxing restrictions beyond just memory access to cover multiple system resources universally. The sandbox mechanism implements multi-functional control that restricts file system access, network connections, process creation, and other system resources simultaneously, not merely memory segmentation. This universal restriction approach ensures that even if memory protection is bypassed, other security boundaries remain intact.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Embodiments of the present invention relate generally to application security. In an embodiment, a method for altered token sandboxing includes creating a process based on a naked token and suspending the process. The method further includes obtaining an impersonation token and resuming the process with the impersonation token. The method further includes acquiring resources needed for the process with the impersonation token. The method also includes replacing the impersonation token with the naked token, hi a further embodiment, the method further includes executing the suspended process with the naked token and the acquired resources. In another embodiment, a system for user-mode, altered token sandboxing includes a security module, an acquisition module and a replacement module. In a further embodiment, the system may include an execution module. In another embodiment, the system may include a request module.