Systems and methods for policy linking and/or loading for secure initialization

Abstract

A system including at least one processor programmed to identify, based on a policy to be enforced, one or more metadata symbols corresponding to an entity name; identify, from a target description describing a target system, an entity description matching the entity name, wherein the entity description describes an entity of the target system; and apply a metadata label to the entity of the target system, wherein the metadata label is based on the one or more metadata symbols corresponding to the entity name, as identified based on the policy.

1 . A system comprising at least one processor programmed to:
 identify, based on a policy to be enforced, one or more metadata symbols corresponding to an entity name;   identify, from a target description describing a target system, an entity description matching the entity name, wherein the entity description describes an entity of the target system; and   apply a metadata label to the entity of the target system, wherein the metadata label is based on the one or more metadata symbols corresponding to the entity name, as identified based on the policy.   
     
     
         2 . The system of  claim 1 , wherein:
 the at least one processor is further programmed to construct the metadata label at least in part by including, in the metadata label, an indication that the one or more metadata symbols pertain to the policy.   
     
     
         3 . The system of  claim 1 , wherein:
 the policy is to be enforced during execution of object code of one or more programs;   the object code is in a loadable binary format; and   the at least one processor is programmed to apply the metadata label to the entity at least in part by annotating at least one portion of the object code with a binary representation of the metadata label.   
     
     
         4 . The system of  claim 3 , wherein:
 the at least one processor is further programmed to identify the at least one portion of the object code to be annotated, at least in part by:   using the entity description to identify one or more object symbol names and one or more address ranges associated with the entity; and   identifying, from the object code, based on the one or more address ranges, one or more instructions matching the one or more object symbol names; and   annotating the at least one portion of the object code comprises annotating the one or more instructions identified from the object code with the binary representation of the metadata label.   
     
     
         5 . The system of  claim 1 , wherein:
 the at least one processor is further programmed to generate an initialization specification based at least in part on the policy and the target description; and   the at least one processor is programmed to apply the metadata label to the entity at least in part by including, in the initialization specification, an indication that the entity is associated with the metadata label.   
     
     
         6 . The system of  claim 5 , wherein:
 the at least one processor is further programmed to resolve at least one metadata symbol of the one or more metadata symbols into a binary representation; and   the binary representation of the at least one metadata symbol is included in the initialization specification.   
     
     
         7 . The system of  claim 5 , wherein:
 the initialization specification is in a loadable binary format.   
     
     
         8 .- 9 . (canceled) 
     
     
         10 . The system of  claim 1 , wherein the at least one processor is further programmed to:
 in response to a piece of object code being loaded to a location in an application memory, identify, based on an initialization specification, at least one metadata label associated with the piece of object code, wherein the piece of object code comprises one or more executable instructions and/or data to be manipulated by one or more executable instructions; and   associate the location in the application memory, where the piece of object code is loaded, with the at least one metadata label.   
     
     
         11 .- 12 . (canceled) 
     
     
         13 . The system of  claim 10 , wherein:
 the at least one processor is programmed to associate the location in the application memory with the at least one metadata label at least in part by creating an entry in a tag map table, the entry mapping the location in the application memory to the at least one metadata label, wherein:   the entry in the tag map table stores a binary representation of the at least one metadata label and/or information indicative of a location at which a binary representation of the at least one metadata label is stored.   
     
     
         14 .- 15 . (canceled) 
     
     
         16 . The system of  claim 13 , wherein:
 the information comprises:   an address in a metadata memory at which the binary representation of the at least one metadata label is stored, and/or   an identifier for a register at which the binary representation of the at least one metadata label is stored.   
     
     
         17 .- 19 . (canceled) 
     
     
         20 . The system of  claim 13 , further comprising policy enforcement hardware, wherein:
 the at least one processor is programmed to associate the location in the application memory with the at least one metadata label at least in part by causing the policy enforcement hardware to evaluate one or more rules;   evaluation of the one or more rules comprises looking up the tag map table for an entry corresponding to the location in the application memory; and   the policy enforcement hardware is configured to, in response to determining that the tag map table does not already include an entry corresponding to the location in the application memory, create the entry in the tag map table mapping the location in the application memory to the at least one metadata label.   
     
     
         21 . The system of  claim 10 , wherein:
 the at least one processor is further programmed to resolve the at least one metadata label into at least one binary representation; and   associating the location in the application memory with the at least one metadata label comprises associating the location in the application memory with the at least one binary representation of the at least one metadata label.   
     
     
         22 . The system of  claim 21 , wherein:
 the piece of object code comprises object code of a user application that is loaded dynamically; and   the at least one processor is programmed to:   dynamically resolve the at least one metadata label into the at least one binary representation; and   dynamically associate the location in the application memory with the at least one binary representation of the at least one metadata label.   
     
     
         23 . The system of  claim 10 , wherein:
 the at least one processor is further programmed to confirm that the initialization specification is from a trusted source, at least in part by verifying a cryptographic signature on the initialization specification; and   the at least one processor is programmed to associate the location in the application memory with the at least one metadata label only in response to confirming that the initialization specification is from a trusted source.   
     
     
         24 . (canceled) 
     
     
         25 . The system of  claim 10 , further comprising policy enforcement hardware, wherein:
 the at least one metadata label comprises a default metadata label;   the at least one processor is further programmed to cause the policy enforcement hardware to evaluate one or more rules; and   evaluation of the one or more rules causes the policy enforcement hardware to replace the default metadata label with another metadata label.   
     
     
         26 .- 28 . (canceled) 
     
     
         29 . The system of  claim 1 , wherein the at least one processor is further programmed to:
 receive a request from a user to examine a policy violation;   in response to the request, determine that the entity of the target system is related to the policy violation; and   display, in human readable form, the metadata label applied to the entity of the target system.   
     
     
         30 . A method performed by a system comprising at least one processor, the method comprising an act of:
 identifying, based on a policy to be enforced, one or more metadata symbols corresponding to an entity name;   identifying, from a target description describing a target system, an entity description matching the entity name, wherein the entity description describes an entity of the target system; and   applying a metadata label to the entity of the target system, wherein the metadata label is based on the one or more metadata symbols corresponding to the entity name, as identified based on the policy.   
     
     
         31 . At least one computer-readable medium having encoded thereon instructions which, when executed by at least one processor, cause the at least one processor to:
 identify, based on a policy to be enforced, one or more metadata symbols corresponding to an entity name;   identify, from a target description describing a target system, an entity description matching the entity name, wherein the entity description describes an entity of the target system; and   apply a metadata label to the entity of the target system, wherein the metadata label is based on the one or more metadata symbols corresponding to the entity name, as identified based on the policy.