CROSS REFERENCE TO RELATED APPLICATIONS

[0001] This patent application claims priority to U.S. Utility patent application entitled "RPC Call Interception" with Serial No. 14/098,246, filed December 5, 2013. Application Serial No. 14,098,246 is fully incorporated herein by reference.

BACKGROUND

[0002] Computer system administrators may collect various data related to the use of system resources to help characterize the use of the system resources, particularly with intent to prevent unauthorized access, identify malicious software, or to improve the allocation of the system resources, among other reasons.

[0003] Collection of this data may traditionally be accomplished by attaching an observer to a kernel and/or system call interface of an Operating System (OS). Accordingly, when a user-level process requests system resources using the observed kernel system call, the observer may collect data and analyze the data as appropriate.

[0004] But Operating Systems have grown in functionality to support interfaces to system resources other than kernel systems calls. For example, an OS may provide functionality via a Remote Procedure Call (RPC) interface. In some instances, the RPC interface may be implemented as a Local Procedure Call (LPC) interface configured to use RPC-style transport, serialization, and runtime -binding to perform LPC system calls without actually sending a call to a remote system.

[0005] Some LPC interfaces exist entirely in userspace, preventing any traditional form of observation by intercepting kernel system calls. Other LPC interfaces also reside in userspace and can make a kernel system call on behalf of the client, thereby masking the identity of the client process because the system call may appear to originate from the LPC interface.

[0006] In general, an LPC interface may not lend itself to observation by a kernel system call as described above. Thus, despite the use of various kernel observers, any calls made to the LPC interface may remain uncollected and unanalyzed. Accordingly, the computer system administrators may capture an incomplete picture of the use of system resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The detailed description is set forth with reference to the accompanying figures. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. The use of the same reference numbers in different figures indicates similar or identical items or features.

[0008] FIG. 1 illustrates an example architecture depicting an LPC interface for requesting an interface to a service, including a name switch used to insert a service proxy. [0009] FIG. 2 illustrates an example architecture depicting communications between a client and a service via a proxy.

[0010] FIG. 3 illustrates an example architecture depicting a thread injected into a client to perform communications between a client and a service via a proxy.

[0011] FIG. 4 illustrates example processes 400 to analyze and marshal a message while acting as a proxy.

[0012] FIG. 5 illustrates a component level view of a computing device capable of acting as the proxy.

DETAILED DESCRIPTION

Overview

[0013] This disclosure describes, in part, a security agent that operates on a host computing device, including mobile devices and embedded systems, as a service proxy. By acting as a proxy for an existing service, the service proxy may receive client communications addressed to the existing service, may process the client communications, may transparently invoke the existing service, and may similarly proxy return communications from the service to the client. Accordingly, the service proxy may capture process interactions with LPC services.

[0014] In general, a service may be any computer program providing an interface to perform work on the behalf of another process. In various embodiments, the service may be run as a background process and may communicate with the process by sending messages. The service may be available to multiple users. For example, a computer program for performing DNS lookups may be implemented as a service, and may perform DNS lookups for all of the users of a system.

[0015] In general, the communications between a client and a service may be part of a communication session. The communication session may be created by the service on a per-client basis. In general, the communication session may be associated with a session state describing the session. In some embodiments, the communication session may be stateless. In some embodiments, the communication session may be as simple as the existence of as an interface for communication that is not associated with a state nor associated with ongoing communications.

[0016] In various embodiments, the service proxy may be configured to run in user mode. However, some of the operations performed by the service proxy may not be available in user mode, thus the service proxy may be configured to perform a subset of operations in a more permissive mode, such as kernel mode.

Example Architecture

[0017] FIG. 1 illustrates an example architecture depicting an LPC interface for requesting an interface to a service, including a name switch procedure used to insert a service proxy. As illustrated in FIG. 1 , a client 102 may make a request 104 to an object manager 106 to receive a named port object 108. For example, the request 104 may indicate a request for a service having a particular name or otherwise identify the requested service by reference. Although the example of FIG. 1 describes the interface to the service as a port, other interface techniques are contemplated herein, including interfacing via files, signals, sockets, messages, message queues, pipes, named pipes, semaphores, shared memory, message passing, memory mapped files, or the like.

[0018] The request 104 may conform to an Interface Description Language (IDL) definition. An IDL definition may be a file that describes an interface to a service. In general, an IDL may be used to generate a stub, wherein the stub may be configured to convert service parameters and to gather data to transfer to another process and/or address space. For example, the client 102 may wish to communicate with a service existing in another address space, and if the client sends a pointer to data in the client's address space, the service may not be able to access the data. The stub may help move the data into an area that may be copied from the client address space to the service address space. Thus, the client 102 may use an IDL definition to form the request 104.

[0019] In various embodiments, the request 104 may be an LPC request, including an RPC layer encapsulating a variety of information. The RPC layer may be decoded to provide information related to the client 102 such as the process identifier (PID), thread identifier (TID) and so forth.

[0020] The object manager 106 may include a namespace that facilitates lookup of an object by name. For example, the object manager 106 may receive the request 104 and search its namespace for an object associated with the particular name. In various examples, the object and/or a reference to the object may then be provided to the client 102. The client 102 may then bind to the object, for example via a request to an RPC runtime (not shown). The RPC runtime may be configured to verify that the request 104 conforms to the IDL for the requested service in response to receiving the request 104.

[0021] The object manager 106 may be configured to store port objects, such as the named port object 108. In general, port objects may provide specific details that enable a caller to communicate with a service as well as to limit access to the service. For example, a port object may specify an Access Control List (ACL) limiting access by one or more rules and/or may specify a required security identifier. Furthermore, a port may provide the communicating parties with information about the other communicating parties, including identification information.

[0022] After receiving the request 104, the object manager 106 may determine a handle 110 associated with the named port object 108, the handle referencing a service 112 associated with the particular name. The object manager 106 may then form a response 114 including a reference to the handle 110 and return the response 1 14 to the client 102.

[0023] However, in the example of FIG. 1, a service proxy 116 is introduced to proxy communications between the client 102 and the service 112. In general, the service proxy 1 16 may have less-than kernel-level privileges. However, some operations may require kernel-level privileges, which may be implemented using a kernel-level process to perform one or more kernel-level actions on behalf of the proxy, or by calling kernel resources. In various examples, the service proxy 1 16, acting with kernel privileges, may intercept the request 104 at the object manager 106 and may rename the named port object 108 to another name. For example, supposing the named port object 108 had an original name of "DNSLookup," the named port object 108 may be renamed to "DNSLookup-Original." In another example, the service proxy 116 may rename the named port object 108 to another name, even absent the request 104. Accordingly, after renaming, the named port object 108 may not be accessible using the original name via the object manager 106. An example computing device capable of serving as a device implementing the service proxy 116 is illustrated in FIG. 5 and described below with reference to that figure.

[0024] In other embodiments, the service proxy 1 16 may be configured to respond to the creation of the named port object 108 and may rename the named port object 108. For example, when the object representing the named port object 108 is created, an event may be created to notify the service proxy 116 of the new object, the named port object 108. The named port object 108 may be renamed in response to the event.

[0025] In various embodiments, the service proxy 1 16 may be configured to reference an IDL describing the service 112. For example, the service proxy 116 may need the IDL to faithfully perform the proxy functions. The IDL describing the service may sometimes be missing or otherwise inaccessible. For example, a software update may update a service without providing an accessible copy of the IDL to the service proxy 116. In such cases, the service proxy may be stopped, a named port proxy object 1 18 may be removed from the object manager 106, the named port object 108 may be reverted to have its original name, and the client 102 may be bound to the service 1 12 using the handle 1 10. In other examples, the service proxy 116 may remain, but may take a less active role in performing proxy functionality.

[0026] The service proxy 116 may add an entry to the object manager 106 using the original name. In the example of FIG. 1 , the named port proxy object 118 may be added to the object manager 106 associated with the original name, for example "DNSLookup." Accordingly, the named port proxy object 1 18 may take-over the original name. The named port proxy object 118 may be configured to reference the service proxy 116 by a handle 120. The handle 120 may be provided to the client 102 via the response 114, allowing the client 102 to access the service proxy 116.

[0027] In this example, the client 102 sent the request 104 for the named port object 108 and received a handle 120 referencing the service proxy 116. Accordingly, the client 102 may make a service call 122 to the service referenced by the handle 120 expecting to call the service 1 12, but may instead call the service proxy 116. The service proxy 116 may receive the service call 122, observe the call, log details, and/or modify the call, and may redirect the call to the service 112 via a redirection 124.

[0028] In general, the redirection 124 may require changing the message sent via the service call 122 and/or creating a new message based on the service call 122. These changes may include modifying an indicated message recipient, an indicated message sender, a PID, a TID, a sequence number, and/or an indication of state, or the like. These changes may further include "marshaling." Marshaling may comprise such acts as transforming memory representations of data, serializing data, deserializing data, complying with interface requirements, or the like.

[0029] In various embodiments, the redirection 124 may be performed by directly calling the service 112. In various embodiments, the service proxy 1 16 may request, from the object manager 106, a handle associated with the (renamed) named port object 108, and may receive the handle 110 referencing the service 112. The service proxy 1 16 may then perform the redirection 124 using the handle 110.

[0030] In some examples, the service proxy 116 may receive a service response 126. The service proxy 116 may observe the service response 126, log details, and/or modify the service response 126, and may provide a proxy response 128 to the client 102. In some examples, the proxy response 128 is the same as the service response 126. In other embodiments, the service proxy 116 may modify portions of the service response 126 to create the proxy response 128. Similar to marshaling, as described above, the service proxy 1 16 may remarshal the service response 126 to produce the proxy response 128. Accordingly, the service proxy 1 16 may provide transparent proxy service to the client 102, intercepting the service call 122 and returning the proxy response 128, all while providing opportunity for the service proxy 1 16 to observe, log, and modify as appropriate.

[0031] In general, the service proxy 116 may be configured to perform actions, including security-related actions, or may be part of a security agent which performs such actions. In some embodiments, the service proxy 116 or other component(s) of the security agent may determine that the client 102 includes malicious software, and may disrupt one or more service calls to reduce the impact of the malicious software. For example, referencing the example of FIG. 1, assuming that the client 102 is malicious and performs the service call 122 to get a DNS lookup for a malicious server from the service 112, the service proxy 116 or other component(s) of the security agent may detect the request as malicious either in response to receiving the service call 122 or in response to receiving the service response 126. The service proxy 116 or other component(s) of the security agent may then "sinkhole" the DNS request by providing a fake DNS address via the proxy response 128. Thus, the malicious software of the client 102 may be unable to lookup the malicious server and the damage may be limited. An example of such a security agent is described in U.S. Patent Application 13/492,672 filed on Jun. 8, 2012, entitled "Kernel-Level Security Agent," which is incorporated herein by this reference.

[0032] In various embodiments, the service proxy 1 16 may be configured to appear to the client 102 as being functionally indistinguishable from the service 112. In some embodiments, the service proxy 1 16 may be entirely indistinguishable from the service 112. To maintain the illusion of identity, the service proxy 1 16 may appear to behave sub-optimally. For example, supposing the service proxy 1 16 identifies the service call 122 as malformed, an optimal behavior may be to immediately reject the service call 122. However, this may drop the illusion of identity by, among other things, never contacting the service 112 via the redirection 124, thereby eliding any side effects created by the service 1 12 such as error handling and error logging. Thus, in spite of the optimal behavior, the service proxy 1 16 may pass the malformed service call 122 using the redirection 124.

[0033] In various embodiments, the service proxy 1 16 may not be able to call the redirection 124. For example, if the service proxy 1 16 receives the service call 122 but experiences an out of memory error before sending the redirection 124, it may not be possible and/or may not be desirable to send the redirection 124. In some examples, upon receiving the out of memory error, the service proxy 116 may be configured to "clean up" memory usage and return some memory to the system, and may thereafter try performing the redirection 124. In some examples, the service proxy 116 might be configured to do whatever an RPC runtime would have done in the case of running out of memory while processing the service call 122.

[0034] In various embodiments, the service proxy 1 16 may be configured to keep track of a state of interaction between the client 102 and the service 1 12. For example, the state of interaction may indicate whether the client 102 is bound to the service proxy 116, whether the client 102 is bound to the service 112, whether the service proxy 116 can read any of the request 104, the response 1 14, the service call 122, and/or the service response 126, and/or whether the service 112 can read the redirection 124. In some embodiments, determinations of the state may not be conclusively discernible; however the service proxy 1 16 may deduce and/or indicate an estimated state.

[0035] FIG. 2 illustrates an example architecture depicting communications between a client and a service via a proxy. As described here, particularly with respect to FIG. 1, the client 102 may generally communicate with the service 112. In the example of FIG. 2, a client communication port 202 existing in the address space of the client 102 may be configured to receive data from the client 102 for deliver to the service 1 12, as well as to receive data from the service 1 12 for delivery to the client 102.

[0036] In general, the client 102 may exist in a different address space than the service 112. Accordingly, data must be ferried back and forth between the client 102 and the service 112. In general, a kernel-mode process—being unrestricted by memory protection rules—may move the data on behalf of the client 102 and the service 1 12.

[0037] A proxy 204 may be positioned between the client communication port 202 and a service communication port 206. In general, the proxy may be inserted using techniques similar to those described with respect to the service proxy 1 16 herein, particularly with respect to FIG. 1. For example, a bind request from the client 102 may be intercepted, the proxy 204 may be created as an intermediary, and the client communication port 202 may be bound to the proxy 204. Additionally, the proxy 204 may be bound to the service communication port 206. Furthermore, the proxy 204 may be configured to appear to the client 102 as being functionally indistinguishable from the service communication port 206. In some embodiments, the proxy 204 may be entirely indistinguishable from the service communication port 206 from the perspective of the client 102. In various embodiments, client communication port 202, the proxy 204, and/or the service communication port 206 may be particular to a session between the client 102 and the service 112 via the proxy 204. In various embodiments, the client communication port 202, the proxy 204, and/or the service communication port 206 may not be indexed by the object manager 106, for example not indexed by name. In various embodiments, the proxy 204 may belong to a proxy service process. An example computing device capable of serving as a device implementing the proxy 204 is illustrated in FIG. 5 and described below with reference to that figure.

[0038] In various embodiments, the proxy 204 may observe, log, and/or modify messages between the client communication port 202 and the service communication port 206.

[0039] In general, communication between the client communication port 202 and the service communication port 206 may be limited to smaller messages. When larger messages are sent another form of communication is used to take advantage of shared memory.

[0040] In general, shared memory includes a portion of physical memory mapped by one or more memory addresses existing in a respective address space for multiple processes. The one or more memory addresses may be virtual addresses. In various embodiments, different virtual addresses may map to a same physical address. For example, a shared memory may include a page of physical memory addressed by a first virtual address of a first address space and a second virtual address of a second address space. Accordingly, multiple processes may concurrently access the shared memory. In general, the shared memory may account for a subset of the total address space of any encompassing process.

[0041] In the example of FIG. 2, a client/proxy/service shared memory space 208 includes a shared memory 210. In general, the client 102 attached to the shared memory space 208 and expects the service to attach to the shared memory space 208. In this case, the proxy also attaches to the shared memory space 208. Accordingly, the proxy gains access to the shared memory 210.

[0042] In various embodiments, the client 102 communicates with the service 1 12 by populating the shared memory 210 with a message payload (i.e. a data of a larger communication). A smaller communication is then sent from the client communication port 202 destined to the service communication port 206. In general, the smaller communication may block a thread of the calling process in the client 102.

[0043] In a typical example, the client 102 may expect the service communication port 206 to receive the smaller communication, read the larger communication in the shared memory 210, and act on the data of the larger communication. The service 1 12 may then reply to the smaller communication or otherwise release the smaller communication from blocking the thread.

[0044] In the example of FIG. 2, however, the proxy 204 receives the smaller communication from the client communication port 202. At this time, the proxy 204 may examine the contents of the shared memory 210 before the service 112 even receives notification of the smaller communication. After the proxy 204 is finished, the proxy 204 may send another smaller message to the service communication port 206. The other smaller message may be the same as the smaller message or may be created based on the smaller message.

[0045] The service 112 may reply to the client 102 using a smaller reply message from the service communication port 206 to the client communication port 202, by way of the proxy 204, and/or the service 1 12 may reply to the client using a larger reply message written into the shared memory 210. Before the blocked thread of the client 102 is released, the proxy 204 may inspect and/or modify either of the larger reply message or the smaller reply message.

[0046] As described above, particularly with respect to FIG. 1 , it may be desirable that the proxy 204 appears indistinguishable from the service communication port 206 as seen from the client 102, and vice versa as seen from the service 112. However, the proxy 204 may have a different PID and/or TID than either of the client communication port 202 or the service communication port 206. Accordingly, the proxy 204 may send messages including identifying information that may notify either of the client 102 or service 112 of the presence of a third party. Various embodiments designed to address this issue will be discussed further herein, particularly with respect to FIGS. 3 and 4.

[0047] FIG. 3 illustrates an example architecture depicting the injection of an executable code into a client to perform communications between a client and a service via a proxy. In various examples, the executable code may be implemented as a thread within a process associated with the client. As described herein, particularly with respect to FIGS. 1 and 2, the client 102 may generally communicate with the service 1 12, including communicating from the client communication port 202 to the service communication port 206. In the example of FIG. 3, a thread running a proxy 302 is injected into the address space of the client 102. In various embodiments, client communication port 202, the proxy 302, and/or the service communication port 206 may be particular to a session between the client 102 and the service 112 via the proxy 302. In various embodiments, the client communication port 202, the proxy 204, and/or the service communication port 206 may not be indexed by the object manager 106, for example not indexed by name. The proxy 302 may operate similarly to the proxy 204, however the proxy 204 may belong to a proxy service process whereas the proxy 302 may belong to a client process associated with the client 102.

[0048] The thread may be injected by a process having kernel-level permissions. The thread may run in the address space of the client 102 and take the PID of the client 102. Accordingly, communications from the proxy 302 may naturally take the PID and TID valid to the client 102. Thus, recipients of the communications from the proxy 302 may determine that the source of the communications was the client communication port 202, and not that of a different process. An example computing device capable of serving as a device implementing the proxy 302 is illustrated in FIG. 5 and described below with reference to that figure.

[0049] The client/service shared memory space 304 may be shared with the client 102 and the service 112, and not with a third process, for example not shared with a proxy service process. In various embodiments, the proxy 302 gains access to the shared memory space 304 by virtue of being a thread of the client 102. Similarly, the shared memory 306 may be accessible to the client 102 and the service 1 12, but not to a third process (other than kernel-level processes).

[0050] In various embodiments, the functionality depicted by FIG. 3 may be similar to that as depicted by FIG. 2. For example, a smaller message from the client communication port 202 to the service communication port 206 may pass through the proxy 302. Similarly, a larger communication written to the shared memory 306 may be intercepted by the proxy 302 when the proxy 302 receives an indication that either of the client 102 or the service 1 12 has written a data to the shared memory 306.

[0051] In some examples, the injected executable code may be injected into a program area of an existing thread of the process. This may enable the injected executable code to operate having the PID and TID of the existing thread. Example Process

[0052] FIG. 4 illustrates an example process 400 to analyze and marshal a message while acting as a proxy. This process is illustrated as logical flow graph, each operation of which represents a sequence of operations that can be implemented in hardware, software, or a combination thereof. In the context of software, the operations represent computer-executable instructions stored on one or more computer-readable storage media that, when executed by one or more processors, perform the recited operations. Generally, computer- executable instructions include routines, programs, objects, components, data structures, and the like that perform particular functions or implement particular abstract data types. The order in which the operations are described is not intended to be construed as a limitation, and any number of the described operations can be combined in any order and/or in parallel to implement the processes.

[0053] The process 400 references subject matter described herein, particularly with respect to FIGS. 1-3. In various embodiments, the process 400 may be performed by a proxy service, such as the service proxy 116, the proxy 204, the proxy 302, or the like.

[0054] The process 400 includes, at 402, receiving a message from a sender. An address of the message may indicate an intended recipient. For example, the message may be addressed to an LPC service, such as the service 112, or addressed to a client, such as the client 102. The proxy service may intercept the message using the various techniques described herein, particularly with respect to FIGS. 1-3. Accordingly, the recipient may not know or may not be capable of determining that the proxy service receiving the message is not the intended recipient.

[0055] At 404, the message may be analyzed. For example, the proxy service may log the message, the message contents may be read, the proxy service may characterize the message as safe, unsafe, or unknown, the message may be checked for validity, or the like.

[0056] In various embodiments, a format of the message may be determined by an IDL associated with the service 112, a stub associated with the IDL, and/or by reverse engineering. The message may be analyzed based on the format of the message. For example, the format may indicate the location and/or format of a particular field in the message. The field may be dereferenced to determine a value of the field.

[0057] At 406, the message may be modified. As described herein, particularly with respect to FIG. 1, modifying may include transforming the message for a variety of purposes.

[0058] In general, the message may include the headers to identify the sender, to identify the receiver, to indicate the type of message being sent, to flag interactions (such as flagging the availability of information in a shared memory space), and/or to indicate a state of interaction between the client 102 and the service 112. The headers may include a sequence number, a message identifier, a PID, and/or a TID. In various embodiments, the kernel and/or the service 1 12 may not process a message having incorrect or inconsistent information. Thus, the headers may be modified to indicate different information, for example to indicate information that appears correct or consistent with expected header information. For example, assuming the service proxy creates a new message using an LPC message creation resource, the new message may include header information indicating that the service proxy is the source of the message. The service proxy may then modify the header information to change the source to match the client 102 or the service 112, or the like. In another example, the header information may be modified to indicate the proxy service as the message source. In various embodiments, portions of the headers may be removed. In various embodiments, the values stored at portions of the header may be overwritten with a zero value or a default value.

[0059] At 408, the message may be marshaled. In general, marshaling may facilitate the sharing of data, particularly among different threads, processes, and/or computing devices. In various embodiments, the marshaling may include transforming memory representations of data, serializing data, deserializing data, complying with interface requirements, or the like.

[0060] At 410, the modified message may be sent to the intended recipient. Example System

[0061] FIG. 5 illustrates a component level view of a computing device capable of acting as or including the client 102, the service 112, or a proxy, such as the service proxy 1 16, the proxy 204, or the proxy 302. As illustrated, computing device 500 comprises a system memory 502 storing modules and data 504. Also, computing device 500 includes processor(s) 506, a removable storage 508 and non-removable storage 510, input device(s) 512, output device(s) 514 and communication connections 516 for communicating with other computing devices 518.

[0062] In various embodiments, system memory 502 is volatile (such as RAM), non-volatile (such as ROM, flash memory, etc.) or some combination of the two. The modules or data 504 stored in the system memory 502 may comprise methods, threads, processes, applications or any other sort of executable instructions, such as the instructions utilized to perform the operations of the client 102, the service 1 12, or a proxy, such as the service proxy 116, the proxy 204, or the proxy 302. The modules and data 504 may also include files and databases.

[0063] In some embodiments, the processor(s) 506 is a central processing unit (CPU), a graphics processing unit (GPU), or both CPU and GPU, or other processing unit or component known in the art.

[0064] Computing device 500 also includes additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in FIG. 5 by removable storage 508 and non-removable storage 510. Tangible computer- readable media may include volatile and nonvolatile, removable and nonremovable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. System memory 502, removable storage 508 and nonremovable storage 510 are all examples of computer-readable storage media. Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the computing device 500. Any such tangible computer-readable media may be part of the computing device 500.

[0065] Computing device 500 also has input device(s) 512, such as a keyboard, a mouse, a touch-sensitive display, voice input device, etc., and output device(s) 514 such as a display, speakers, a printer, etc. These devices are well known in the art and need not be discussed at length here.

[0066] Computing device 500 also contains communication connections 516 that allow the computing device 500 to communicate with other computing devices 518.

CONCLUSION

[0067] Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described. Rather, the specific features and acts are disclosed as exemplary forms of implementing the claims.