Method and system for preventing and detecting security threats

• US 10,635,807 B2
• Filed: 11/03/2017
• Issued: 04/28/2020
• Est. Priority Date: 03/30/2012
• Status: Active Grant

• Current Assignee: Irdeto B.V. (MultiChoice Group Ltd.)
• Original Assignee: Irdeto B.V. (MultiChoice Group Ltd.)
• Inventors: Vandergeest, Ron
• Primary Examiner(s): Moorthy, Aravind K
• Application Number:
  US15/802,518
• Publication Number:
  US 20180068118A1
• Time in Patent Office: 907 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

A system and method is provided for implementing platform security on a consumer electronic device having an open development platform. The device is of the type which includes an abstraction layer operable between device hardware and application software. A secured software agent is provided for embedding within the abstraction layer forming the operating system. The secured software agent is configured to limit access to the abstraction layer by either blocking loadable kernel modules from loading, blocking writing to the system call table or blocking requests to attach debug utilities to certified applications or kernel components.

Claims

1. A method for increasing security of a computing device having at least one processor executing an operating system and application software, the method comprising:

embedding a secured software agent within an OS kernel of the device;

the secured software agent performing an integrity verification process on the code of an application or system component of the device; and

the secured software agent changing privileges of an application or system component for the device when the integrity verification process indicates modification of the code of the application or system component and in response to the application or system component attempting to access OS kernel resources.

2. The method of claim 1, wherein the integrity verification process includes computing a hash value of the code of an application or system component, comparing the hash value to a known good value for the hash function, verifying the integrity when the hash value and the known good value are the same and detecting tampering when the hash value and the known good value are not the same.

3. The method of claim 1, wherein the step of performing an integrity verification process occurs during runtime.

4. The method of claim 1, wherein changing privileges is revoking privileges to an application or system component.

5. The method of claim 1, further comprising:

the secured software agent accessing an enhanced permissions container stored in an application secure store and including manifest specifying an application code signature and a container signature and including permissions required by an application code during runtime;

wherein the integrity verification process is performed on the application based on the manifest is stored in an agent secured store when the integrity of the application has been verified.

6. The method of claim 1, wherein the secured software agent is configured to:

insert one or more upcalls at points in the OS kernel where a user-level system call from an application would result in access to an internal OS kernel object;

receive, from the OS kernel, via at least one of the one or more upcalls, a request to modify or debug functionality of the application;

determine whether the request is a valid request; and

limit access to the OS kernel based at least in part on a determination that the request is not a valid request.

7. An apparatus for increasing security of a computing device having at least one processor executing an operating system and application software, the apparatus comprising:

at least one processor; and

at least one non-transient memory device having instructions stored thereon which, when executed by the at least one processor, cause the at least one processor to;

embed a secured software agent within an OS kernel of the device;

wherein the secured software agent performs an integrity verification process on the code of an application or system component of the device; and

wherein the secured software agent changes privileges of an application or system component for the device when the integrity verification process indicates modification of the code of the application or system component and in response to the application or system component attempting to access the OS kernel resources.

8. The apparatus of claim 7, wherein the integrity verification process includes computing a hash value of the code of an application or system component, comparing the hash value to a known good value for the hash function, verifying the integrity when the hash value and the known good value are the same and detecting tampering when the hash value and the known good value are not the same.

9. The apparatus of claim 7, wherein the integrity verification process occurs during runtime.

10. The apparatus of claim 7, wherein changing the privileges is revoking privileges to an application or system component.

11. The apparatus of claim 7, wherein the secured software agent accesses an enhanced permissions container stored in an application secure store and including manifest specifying an application code signature and a container signature and including permissions required by an application code during runtime and wherein the integrity verification process is performed on the application based on the manifest is stored in an agent secured store when the integrity of the application has been verified.

12. The apparatus of claim 7, wherein the secured software agent is configured to:

insert one or more upcalls at points in the OS kernel where a user-level system call from an application would result in access to an internal OS kernel object;

receive, from the OS kernel, via at least one of the one or more upcalls, a request to modify or debug functionality of the application;

determine whether the request is a valid request; and

limit access to the OS kernel based at least in part on a determination that the request is not a valid request.

13. A secured software agent embedded within an OS kernel of a device having at least one processor executing an operating system and application software, the secured software agent comprising code for causing the device to:

performing an integrity verification process on the code of an application or system component of the device; and

changing privileges of an application or system component for the device when the integrity verification process indicates modification of the code of the application or system component and in response to the application or system component attempting to access the OS kernel resources.

14. The secured software agent of claim 13, wherein the integrity verification process includes computing a hash value of the code of an application or system component, comparing the hash value to a known good value for the hash function, verifying the integrity when the hash value and the known good value are the same and detecting tampering when the hash value and the known good value are not the same.

15. The secured software agent of claim 13, wherein the integrity verification process occurs during runtime.

16. The secured software agent of claim 13, wherein changing the privileges is revoking privileges to an application or system component.

17. The secured software agent of claim 13, wherein the code further causes the device to:

access an enhanced permissions container stored in an application secure store and including manifest specifying an application code signature and a container signature and including permissions required by an application code during runtime; and

wherein the integrity verification process is performed on the application based on the manifest is stored in an agent secured store when the integrity of the application has been verified.

18. The secured software agent of claim 13, wherein the secured code further causes the device to:

insert one or more upcalls at points in the OS kernel where a user-level system call from an application would result in access to an internal OS kernel object;

receive, from the OS kernel, via at least one of the one or more upcalls, a request to modify or debug functionality of the application;

determine whether the request is a valid request; and

limit access to the OS kernel based at least in part on a determination that the request is not a valid request.