System and method to secure a computer system by selective control of write access to a data storage medium

• US 10,503,418 B2
• Filed: 02/01/2017
• Issued: 12/10/2019
• Est. Priority Date: 12/01/2005
• Status: Active Grant

• Current Assignee: Drive Sentry Limited
• Original Assignee: Drive Sentry Limited
• Inventors: Safa, John
• Primary Examiner(s): Mackall, Larry T
• Application Number:
  US15/421,984
• Publication Number:
  US 20170147245A1
• Time in Patent Office: 1,042 Days
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0676 Magnetic disk device
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system and method of securing a computer system by controlling write access to a storage medium by monitoring an application; detecting an attempt by the application to write data to said storage medium; interrogating a rules database in response to said detection; and permitting or denying write access to the storage medium by the application in dependence on said interrogation.

Claims

1. In a computer comprising a storage medium and an application running on said computer in conjunction with an operating system that manages access to a data storage device, a method of controlling write access to said data storage device by said application comprising:

using the computer operating a detection process in a secure mode access an attempt by the running application to write data to said data storage device;

retrieving from computer memory a permission data value result from a database comprised of data elements encoding either at least one permission value associated with the application or a value representing that no permission value for the application is present in the database;

and

controlling write access by the running application to store data to the data storage device in dependence on said retrieved permission result.

2. The method of claim 1 further comprising:

inspecting the data that the application is attempting to store to determine if said data designates a file type;

inspecting said data to determine if said data is of a type consistent with the designated file type; and

further controlling write access by the running application to the storage medium in dependence on the result of the inspecting result.

3. The method of claim 2 with the additional step of receiving into said computer at least one data value that logically relates at an least one application name to an at least one file type.

4. The method of claim 1 where the permission value is a value that is independent of a directory location where the application is attempting to write data.

5. The method of claim 1 further comprising:

determining that the permission value encodes the condition that no permission value for the application is present in the database; and

prompting a user of the computer to input a data value that is a permission value to apply to the attempted write access by the running application.

6. The method of claim 1 in wherein the permission value encodes one of at least two levels, the at least two levels comprised of at least two of:

first level in which no write access is allowed, a second level in which full write access is allowed, and a third level in which write access is only allowed to write data of at least one of a specified file type.

7. The method of claim 1 where the permission values are stored in a data structure that pre-exists the installation of the running application on the computer that executes the method.

8. The method of claim 1 where write access by the running application is prevented as a result of determining that no permission value corresponding to the running application is stored in the database.

9. The method of claim 1 with the further step of:

generating a prompt on a user interface on said computer requesting a response from a user, accepting such response, and using such accepted response to generate a permission value, and updating the database to store the accepted response as a permission value associated with the running application.

10. The method of claim 9 further comprising:

displaying on the user interface a number of possible responses to the prompt, the possible responses comprising a first response for allowing write access, a second response for blocking write access and a third response for allowing write access of a specific file type.

11. The method of claim 9 displaying on the user interface selections representing a plurality of further actions, the further actions comprised of:

storing the chosen response in the database and receiving input representing an input selection of one of the further actions.

12. The method of claim 1 with the additional step of:

in response to determining that no permission value associated with the running application is stored in the database, transmitting a request for the permission value to a remote computer operatively connected to the computer running the application by means of a data network; and

receiving into said computer at least one additional permission value and storing said at least one additional permission value entry into the database stored on said computer.

13. The method of claim 1 where the controlling step blocks write access by the running application if the data to be stored is a portable executable file.

14. The method of claim 1 further comprising the step of automatically uploading at least one permission value associated with said running application from said computer to an additional computer over a data communications network.

15. The method of claim 1 further comprising the step of:

in response to determining that a required permission value is not stored in the database, downloading from an additional computer over a data communications network at least one permission value and storing that value in the database.

16. The method of claim 1 where the database is stored on a remote server operatively connected to said computer by means of a data communication network.

17. The method of claim 1 further comprising:

determining if the permission value has been tampered with, and in dependence, on the determination that the permission value has been tampered with, blocking write access by the running application and ignoring the permission value.

18. The method of claim 1 further comprising:

receiving a permission value from a database stored on a remote server operatively connected to said computer by means of a data communication network in response to a query from said computer automatically generated as a result of a determination that said database does not contain a permission value corresponding to said running application, said received rule derived from data received by the remote server from a plurality of remote computers, said data received by the remote server comprising data input by a corresponding plurality of users encoding a permission value for said application.

19. A computer system for controlling write access to a first data storage device by at least one application running on a first computer system operatively connected to said first data storage device comprising:

The first data storage device;

A first rules database stored on the first computer system comprised of at least one application identifier data value and at least one corresponding permission data value;

An interceptor module operating a process on the first computer system in a secure mode that is configured by logic to monitor file system access on the first computer system by the at least one application operating distinct from the interceptor process, where such logic is configured to detect, a write access attempt to the first data storage device by the at least one running application, the interceptor module is further adapted by logic to control the write access to the first data storage device by retrieving a permission value corresponding to the at least one application attempting the write access to the first data storage device and using the retrieved permission value to determine whether to permit or prevent such write access to the first data storage device.

20. The computer system of claim 19 where the first rule database is encrypted.

21. The computer system of claim 19 further comprising a manager module operating on the first computer system that is operatively connected over one or more computer networks to a second rule database stored on a second computer system comprised of at least one application identifier data value and at least one corresponding permission data value where the manager module is configured by logic to automatically update the contents of the second rule database incrementally by transmitting data over a data network from the first rule database to the second rule database.

22. The computer system of claim 21 where the second rule database stored on a second computer system is operatively connected over one or more computer networks to a corresponding plurality of manager modules operating on a plurality of corresponding computer systems comprised of corresponding rule databases and each of the plurality of manager modules is adapted by logic to update its corresponding rule database by receiving data transmitted from the second rule database.

23. The computer system of claim 21 further comprising an input and output interface module that is configured by logic to receive as user input a permission value into the first computer system and the first computer system automatically transmitting that input permission value to the second rule database on the second computer system.

24. The computer system of claim 21 where the first rule database is further comprised of permission values that, when used by the interceptor module, cause the interceptor module to perform at least one of the operations:

allow write access to the first data storage device, block write access to the first data storage device, allow write access to a specified file type on the first data storage device.

25. The computer system of claim 24 where the specified file type is an executable file type and the corresponding permission value denies write access to the first data storage device to store the executable file type.

26. The computer system of claim 21 where the first database is further comprised of at least one signature value corresponding to the at least one application identifier.

27. The computer system of claim 21 where the first database is further comprised of at least one file type value corresponding to the at least one application identifier.

28. The computer system of claim 19 further comprising an input and output interface module that is adapted by logic to enable a user of the first computer system to input data into the first computer system that the interface module uses to modify the first rule database.

29. A method of controlling write access to a data storage device by an application running in application space on a first computer comprising:

receiving at a server computer from a plurality second computers operatively connected to the server by means of a data network, a corresponding plurality of permission values associated with the application operating on the first computer;

storing said permission values;

generating an output permission value for the application in dependence on the stored permission values;

receiving at said server computer from the first computer operatively connected to the server by means of a data network, a request for a permission value associated with the application running on the first computer as a result of a process monitoring write access requests by the application on the first computer detecting an attempt by the application to write data to the data storage device, interrogating a local database of permission values and failing to locate a permission value associated with the application in the local database;

selecting the stored permission value in response to receiving the request; and

transmitting to said first computer the output permission value derived from the plurality of received permission values to the first computer over the data network in order to cause the monitoring process operating on the first computer to permit or deny write access by the application to the data storage device in dependence on the transmitted output permission value.

30. The method of claim 29 where the output permission value has at least two states, one of which denies permission for the application to write to the storage medium.

31. The method of claim 29 where the output permission value designates permission to write at least one specified data file type.

32. The method of claim 29 where the output transmitted permission value is transmitted with a signature associated with the application.