EP0325776A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
A trusted path mechanism for an operating system
Assignee: International Business Machines Corp
•
Filing: 1988-12-22
•
Granted: —
•
Expires: 2008-12-22
Abstract
Abstract The trusted path mechanism guarantees that data typed by a user on a terminal keyboard is protected from any intrusion by unauthorized programs. It allows a user to create a non-forgeable and non-penetrable communication path between the user's terminal and the trusted operating system software. The user can create a trusted path by simply pressing a key, called the Secure Attention Key (SAK), on the terminal keyboard. This operation can be called when the user logs into the system in order to be sure that the user is communicating with the real login program and not a Trojan horse program masquerading as a login program, which could steal the user's password. After the user establishes the trusted path, he can enter his critical data, such as a password, and can be sure that his critical data is not being stolen by an intruder's program. Then, after the user logs out, he can be sure that the trusted path has actually logged him out of the system so that a Trojan horse program is not capable of continuing the session started by the user.
Inventors
- 👤 Gary Linn Luckenbaugh
- 👤 Abhai Johri
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-11-05 01:41
CPC Classifications
G; G06; G06F; G06F9/00; G06F9/06; G06F9/46; G06F9/48; G06F9/4806; G06F9/4843; G06F21/00; G06F21/30; G06F21/31; G06F21/70; G06F21/82; G06F21/83; G06F9/468; G06F2211/00; G06F2211/009
Claims Analysis
Total Claims: 10
Claim 1
Independent Claim
153 words
A method in a UNIX-type operating system for creating, in response to a secure attention request, a trusted path between a terminal connected to a data processor running an init process under said operating system and a trusted shell portion of a trusted computing base in said data processor, comprising the steps of: testing for the termination of an existing process running under the control of said init process; executing a fork system call by said init process for a new child process when said existing process terminates due to said secure attention request; changing the access mode of the terminal to readable and writable by the owner only; changing the owner identification of the terminal to root; revoking access to the terminal; recording that said child process is running a trusted shell; executing an exec system call to overlay said trusted shell onto said new child process, thereby establishing the trusted path.
Claim 2
Independent Claim
153 words
A method in a UNIX-type operating system for creating, in response to a secure attention request, a trusted path between a terminal connected to a data processor running an init process under said operating system and a trusted shell portion of a trusted computing base in said data processor, comprising the steps of: testing for the termination of an existing process running under the control of said init process; executing a fork system call by said init process for a new child process when said existing process terminates due to said secure attention request; changing the access mode of the terminal to readable and writable by the owner only; changing the owner identification of the terminal to root; revoking access to the terminal; recording that said child process is running a trusted shell; executing an exec system call to overlay said trusted shell onto said new child process, thereby establishing the trusted path.
Claim 3
Independent Claim
371 words
A method in a UNIX-like operating system for creating, in response to a secure attention request, a trusted path between a terminal connected to a data processor running a trusted init process under said operating system and a trusted shell portion of a trusted computing base in said data processor, comprising the steps of: waiting for the termination of an existing process running under the control of said trusted init process; executing a fork system call by said trusted init process when said existing process terminates due to a secure attention request and said existing process was a getty or a login process, changing the access mode of said terminal to readable and writable by the owner only, changing the owner identification and group identification of said terminal to root, revoking access to said terminal, executing an exec system call to overlay the getty process onto said new child process, and executing the getty process; executing a fork system call by said trusted init process for a new child process when said existing process terminates due to a secure attention request and said existing process was a user process or a trusted shell, changing the access mode of said terminal to readable and writable by owner only, changing the owner identification and group identification of said terminal to root, revoking access to said terminal, recording that said child is running a trusted shell, and executing an exec system call to overlay a trusted shell onto said child process, thereby establishing the trusted path; executing a fork system call by said trusted init process for a new child process when said existing process terminates due to a normal exit and said existing process was a trusted shell, recording that the new child process is running an untrusted process, executing an exec system call to overlay an untrusted process onto said new child process; executing a fork system call by said trusted init process for a new child process when said existing process terminates due to a normal exit and said existing process was an untrusted process, executing an exec system call to overlay a getty process onto said child process to provide a login function for a new session at said terminal.
Claim 4
Independent Claim
371 words
A method in a UNIX-like operating system for creating, in response to a secure attention request, a trusted path between a terminal connected to a data processor running a trusted init process under said operating system and a trusted shell portion of a trusted computing base in said data processor, comprising the steps of: waiting for the termination of an existing process running under the control of said trusted init process; executing a fork system call by said trusted init process when said existing process terminates due to a secure attention request and said existing process was a getty or a login process, changing the access mode of said terminal to readable and writable by the owner only, changing the owner identification and group identification of said terminal to root, revoking access to said terminal, executing an exec system call to overlay the getty process onto said new child process, and executing the getty process; executing a fork system call by said trusted init process for a new child process when said existing process terminates due to a secure attention request and said existing process was a user process or a trusted shell, changing the access mode of said terminal to readable and writable by owner only, changing the owner identification and group identification of said terminal to root, revoking access to said terminal, recording that said child is running a trusted shell, and executing an exec system call to overlay a trusted shell onto said child process, thereby establishing the trusted path; executing a fork system call by said trusted init process for a new child process when said existing process terminates due to a normal exit and said existing process was a trusted shell, recording that the new child process is running an untrusted process, executing an exec system call to overlay an untrusted process onto said new child process; executing a fork system call by said trusted init process for a new child process when said existing process terminates due to a normal exit and said existing process was an untrusted process, executing an exec system call to overlay a getty process onto said child process to provide a login function for a new session at said terminal.
Claim 5
Dependent Claim
22 words
The method of claim 2 wherein the secure attention request is recognized by a UNIX-type operating system as an interrupt SIGSAK signal.
Claim 6
Dependent Claim
22 words
The method of claim 3 wherein any user-defined key combination entered at said terminal can be employed as said secure attention request.
Claim 7
Dependent Claim
37 words
The method of claim 4 wherein a timeout is established for the generation of a complete secure attention request sequence, whereby keys which are chosen can be used with the timeout as regular keys of said terminal.
Claim 8
Dependent Claim
45 words
The method of claim 5 wherein the initial key is held in a line discipline driver and not sent to an application process until either the sequence breaks or the secure attention request timeout occurs, thereby avoiding emulation of a trusted path by unauthorized programs.
Claim 9
Dependent Claim
294 words
In a data processing system including a memory to which is connected a plurality of terminals, with at least one terminal including a keyboard having a Secure Attention Key, a method in a UNIX-type operating system for creating, in response to said Secure Attention Key, a trusted path between said terminal and a trusted shell portion of a trusted computing base which is a child process of an init process under said operating system, comprising the steps of: detecting said Secure Attention Key in a keyboard device driver connected to said keyboard; outputting from said keyboard device driver to a Secure Attention Key Signal Generator, information that said Secure Attention Key has been detected; outputting from said Secure Attention Key Generator a SIGSAK signal to all processes operating in a process group of said terminal, terminating all of said processes in said terminal process group; applying said SIGSAK signal to access authorization tables associated with all device drivers interfacing with said terminal, to deny access authorization to all processes in said data processing system except said init process; applying said SIGSAK signal to a file access table to remove all addressing information relating said device drivers interfacing with said terminal, to all processes in said data processing system except said init process; executing a fork system call by said init process for a new child process; executing an exec system call to overlay a trusted shell process onto said new child process, said trusted shell process having access authorization to said device drivers interfacing with said terminal and said trusted shell process having an addressing relationship defined in said file access table to said device drivers interfacing with said terminal; whereby a trusted path is established between said terminal and said trusted shell process.
Claim 10
Dependent Claim
294 words
In a data processing system including a memory to which is connected a plurality of terminals, with at least one terminal including a keyboard having a Secure Attention Key, a method in a UNIX-type operating system for creating, in response to said Secure Attention Key, a trusted path between said terminal and a trusted shell portion of a trusted computing base which is a child process of an init process under said operating system, comprising the steps of: detecting said Secure Attention Key in a keyboard device driver connected to said keyboard; outputting from said keyboard device driver to a Secure Attention Key Signal Generator, information that said Secure Attention Key has been detected; outputting from said Secure Attention Key Generator a SIGSAK signal to all processes operating in a process group of said terminal, terminating all of said processes in said terminal process group; applying said SIGSAK signal to access authorization tables associated with all device drivers interfacing with said terminal, to deny access authorization to all processes in said data processing system except said init process; applying said SIGSAK signal to a file access table to remove all addressing information relating said device drivers interfacing with said terminal, to all processes in said data processing system except said init process; executing a fork system call by said init process for a new child process; executing an exec system call to overlay a trusted shell process onto said new child process, said trusted shell process having access authorization to said device drivers interfacing with said terminal and said trusted shell process having an addressing relationship defined in said file access table to said device drivers interfacing with said terminal; whereby a trusted path is established between said terminal and said trusted shell process.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.