US5991856A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for computer operating system protection
Assignee: McAfee LLC
•
Filing: 1997-09-30
•
Granted: 1999-11-23
•
Expires: 2017-09-30
Abstract
Abstract A method for protecting a computer operating system from unexpected errors write-protects certain critical system components, thereby preventing corruption by application programs, and handles otherwise fatal program errors and infinite loops outside of the context of a malfunctioning program, permitting the program to be reactivated.
Inventors
- 👤 Michael L. Spilo
- 👤 Jonathan A. Daub
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 04:16
CPC Classifications
G; G06; G06F; G06F11/00; G06F11/07; G06F11/0703; G06F11/0793; G06F11/0706
Claims Analysis
Total Claims: 16
Claim 1
Independent Claim
99 words
A method for preventing unauthorized access by a CPU to an area of an operating system comprising the steps of: selectively write-protecting the area by (a) identifying a shared data area by intercepting an attempt to allocate a region for use by high-privilege-level programs and low-privilege-level programs; (b) relocating the shared data area; (c) ensuring that the shared data area remains unprotected; and (d) write protecting a remaining portion of the operating system; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed.
Claim 2
Independent Claim
99 words
A method for preventing unauthorized access by a CPU to an area of an operating system comprising the steps of: selectively write-protecting the area by (a) identifying a shared data area by intercepting an attempt to allocate a region for use by high-privilege-level programs and low-privilege-level programs; (b) relocating the shared data area; (c) ensuring that the shared data area remains unprotected; and (d) write protecting a remaining portion of the operating system; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed.
Claim 3
Independent Claim
149 words
A method for preventing unauthorized access by a CPU to an area of an operating system comprising the steps of: selectively write-protecting the area by (a) identifying a shared data area; (b) relocating the shared data area; (c) ensuring that the shared data area remains unprotected; and (d) write protecting a remaining portion of the operating system; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed; the relocating step comprising the substeps of: determining a frequency of access for the shared data area; comparing the frequency of access to a threshold; if the frequency of access is greater than the threshold, moving the shared data area to an unprotected region; and if the frequency of access is less than the threshold, adding the shared data area to a list of shared regions.
Claim 4
Independent Claim
149 words
A method for preventing unauthorized access by a CPU to an area of an operating system comprising the steps of: selectively write-protecting the area by (a) identifying a shared data area; (b) relocating the shared data area; (c) ensuring that the shared data area remains unprotected; and (d) write protecting a remaining portion of the operating system; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed; the relocating step comprising the substeps of: determining a frequency of access for the shared data area; comparing the frequency of access to a threshold; if the frequency of access is greater than the threshold, moving the shared data area to an unprotected region; and if the frequency of access is less than the threshold, adding the shared data area to a list of shared regions.
Claim 5
Dependent Claim
41 words
The method of claim 2, wherein the moving step comprises substeps of: identifying a new location; copying contents from the shared data region to the new location; and modifying any pointers to the shared data region to reflect the new location.
Claim 6
Dependent Claim
25 words
The method of claim 2, wherein the moving step comprises substeps of: identifying an unprotected region; allocating the shared data region from the unprotected region.
Claim 7
Independent Claim
110 words
A method for preventing unauthorized access by a CPU to an area of an operating system, the CPU having access to a real-mode memory area, a protected addressing modes and a V86 addressing mode, the method comprising the steps of: selectively write-protecting the area by (a) determining a CPU addressing mode; (b) identifying the real-mode memory area; (c) when the addressing mode is protected mode, protecting the real-mode memory area; and (d) when the addressing mode is V86 mode, unprotecting the real-mode memory area; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed.
Claim 8
Independent Claim
110 words
A method for preventing unauthorized access by a CPU to an area of an operating system, the CPU having access to a real-mode memory area, a protected addressing modes and a V86 addressing mode, the method comprising the steps of: selectively write-protecting the area by (a) determining a CPU addressing mode; (b) identifying the real-mode memory area; (c) when the addressing mode is protected mode, protecting the real-mode memory area; and (d) when the addressing mode is V86 mode, unprotecting the real-mode memory area; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed.
Claim 9
Independent Claim
91 words
A method for preventing unauthorized access by a CPU to an area of an operating system, comprising the steps of: selectively write-protecting the area; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed; the selectively write-protecting step comprising the sub-steps of: identifying an active cache region, identifying an inactive cache region, protecting the inactive cache region by marking the inactive cache region as not present; and scheduling an event to protect the active region.
Claim 10
Independent Claim
91 words
A method for preventing unauthorized access by a CPU to an area of an operating system, comprising the steps of: selectively write-protecting the area; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed; the selectively write-protecting step comprising the sub-steps of: identifying an active cache region, identifying an inactive cache region, protecting the inactive cache region by marking the inactive cache region as not present; and scheduling an event to protect the active region.
Claim 11
Independent Claim
89 words
A method for preventing unauthorized access by a CPU to an area of an operating system, comprising the steps of: selectively write-protecting the area; intercepting an attempt to access the area by trapping at least one cache function; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed; the selectively write-protecting step comprising the sub-steps of: identifying an active cache region, identifying an inactive cache region, protecting the inactive cache region; and scheduling an event to protect the active region.
Claim 12
Independent Claim
89 words
A method for preventing unauthorized access by a CPU to an area of an operating system, comprising the steps of: selectively write-protecting the area; intercepting an attempt to access the area by trapping at least one cache function; determining whether the attempt should be permitted; and if the attempt should be permitted, allowing the access to proceed; the selectively write-protecting step comprising the sub-steps of: identifying an active cache region, identifying an inactive cache region, protecting the inactive cache region; and scheduling an event to protect the active region.
Claim 13
Dependent Claim
19 words
The method of claim 7, wherein the cache function is provided by a VCACHE service of the operating system.
Claim 14
Independent Claim
97 words
A method for preventing unauthorized access by a CPU to an area of an operating system, comprising the steps of: selectively write-protecting the area; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted allowing the access to proceed; the selectively write-protecting step comprising sub-steps of: identifying an active cache region, identifying an inactive cache region, protecting the inactive cache region; and scheduling an event to protect the active region by adding the event to a list of events to be processed and processing the event.
Claim 15
Independent Claim
97 words
A method for preventing unauthorized access by a CPU to an area of an operating system, comprising the steps of: selectively write-protecting the area; intercepting an attempt to access the area; determining whether the attempt should be permitted; and if the attempt should be permitted allowing the access to proceed; the selectively write-protecting step comprising sub-steps of: identifying an active cache region, identifying an inactive cache region, protecting the inactive cache region; and scheduling an event to protect the active region by adding the event to a list of events to be processed and processing the event.
Claim 16
Dependent Claim
49 words
The method of claim 9, wherein the processing step comprises substeps of: adding the active cache region to a list; identifying at least one region on the list that is not being held; and protecting the at least one identified region on the list that is not being held.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-11-22 | 2003-05-24 | 2003-11-23 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-11-22 | 2007-05-24 | 2007-11-23 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-11-22 | 2011-05-24 | 2011-11-23 | $7700.00 | Window Closed / Lapsed |