SYSTEM INTEGRITY MANAGER

• US 20070044151A1
• Filed: 08/22/2005
• Published: 02/22/2007
• Est. Priority Date: 08/22/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Whitmore, James
• Application Number:
  US11/161,905
• Publication Number:
  US 20070044151A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A system integrity manager, system, computer program product and method for providing security may include transforming an operational behavior of an instance of a computing system from a general purpose computing system to a special purpose computing system. The operational behavior may be transformed by using at least one of a system integrity sensor and a system integrity effector and a set of system integrity policies and system integrity data.

Claims

1. A method for providing security, comprising transforming an operational behavior of an instance of a computing system from a general purpose computing system to a special purpose computing system, wherein the operational behavior is transformed by using at least one of a system integrity sensor, a system integrity effector, a set of system integrity policies, and system integrity data.

2. The method of claim 1, further comprising

gathering operational data related to operating conditions and operations within the computing system;

analyzing the operational data to form state information; and

invoking adaptive behavior in at least one component of the computing system if needed based on the state information.

3. The method of claim 2, wherein invoking adaptive behavior comprises at least one of:

changing policy information for the at least one component based upon an evaluation of the set of system integrity policies within a given operational state;

incorporating the state information in a policy rule evaluation logic of at least one of a security integrity manager associated with the computing system and the at least one component;

authorizing an external security integrity manager external to the computing system to alter operation of the security integrity manager associated with the computing system; and

resetting the state information.

4. The method of claim 1, further comprising initiating control operations capable of invoking change in any legacy components which are incapable of accessing and interpreting available state information.

5. The method of claim 1, further comprising managing operation of a system integrity manager, a plurality of system integrity sensors, a plurality of system integrity effectors and a plurality of other components based on a set of policy rules.

6. The method of claim 1, further comprising maintaining a normative operational profile of the computing system.

7. The method of claim 6, wherein maintaining the normative operational profile of the computing system comprises:

periodically scanning each file, folder and file system associated with the computing system to validate integrity based on the normative profile; and

initiating a reaction in response to integrity being compromised.

8. The method of claim 7, wherein initiating a reaction comprises at least one of:

creating and transmitting an alert message;

marking an integrity compromised file unusable;

changing permissions for using the integrity compromised file;

restoring the integrity compromised file from a trusted repository; and

correcting behavior based upon any events or symptoms.

9. The method of claim 6, wherein maintaining the normative operational profile of the computing system comprises:

testing the integrity of a file when being accessed; and

initiating a self-protection behavior in response to the file being found to be compromised.

10. The method of claim 9, further comprising:

notifying a system integrity manager in response to the file being found to be compromised; and

correcting behavior based upon any events and symptoms.

11. A system for providing security, comprising:

a system integrity manager for transforming an operational behavior of an instance of a computing system from a general purpose computing system to a special purpose environment; and

at least one system integrity sensor to gather operational data related to operating conditions and operations within the computing system.

12. The system of claim 11, further comprising at least one system integrity effector to initiate control operations to invoke change in any legacy components in the computing system.

13. The system of claim 11, wherein the system integrity manager analyzes the operational data, to form state information and to invoke adaptive behavior in each component of the computing system as needed based on the state information.

14. The system of claim 13, wherein the system integrity manager invokes adaptive behavior by at least one of a group comprising:

changing policy information for the at least one component based upon an evaluation of the set of system integrity policies within a given operational state;

incorporating the state information in a policy rule evaluation logic of at least one of a security integrity manager associated with the computing system and the at least one component;

authorizing an external security integrity manager external to the computing system to alter operation of the security integrity manager associated with the computing system; and

resetting the state information.

15. The system of claim 11, further comprising a set of policy rules to manage operation of the system integrity manager.

16. The system of claim 11, further comprising a normative profile selected for operation of the computing system, wherein the at least one system integrity sensor periodically scans each file, folder and file system associated with the computing system to validate integrity based on the selected normative profile.

17. The system of claim 16, wherein the system integrity manager initiates a reaction in response to integrity being compromised.

18. The system of claim 11, further comprising:

system integrity installation data accessible by the system integrity manager; and

system integrity management data accessible by the system integrity manager for maintaining a normative operational profile of the computing system.

19. A computer program product for providing security, the computer program product comprising:

a computer useable medium having computer useable program code embodied therein, the computer useable medium comprising;

computer useable program code configured to transform an operational behavior of an instance of a computing system from a general purpose computing system to a special purpose computing system.

20. The computer program product of claim 19, further comprising:

computer useable program code configured to gather operational data related to operating conditions and operations within the computing system;

computer useable program code configured to analyze the operational data to form state information; and

computer useable program code configured to invoke adaptive behavior in at least one component of the computing system if needed based on the state information.

21. The computer program product of claim 19, further comprising computer useable program code configured to initiate control operations capable of invoking change in any legacy components which are incapable of accessing and interpreting available state information.

22. The computer program product of claim 19, further comprising computer useable program code configured to maintain a normative operational profile of the computing system.

23. The computer program product of claim 22, further comprising

computer useable program code configured to periodically scan each file, folder and file system associated with the computing system to validate integrity based on the normative profile;

and

computer useable program code configured to initiate a reaction in response to integrity being compromised.

24. The computer program product of claim 23, wherein the computer useable program code configured to initiate a reaction comprises at least one of:

computer useable program code configured to create and transmit an alert message;

computer useable program code configured to mark an integrity compromised file unusable;

computer useable program code configured to change permissions for using the integrity compromised file;

computer useable program code configured to restore the integrity compromised file from a trusted repository; and

computer useable program code configured to correct behavior based upon any events or symptoms.

25. The computer program product of claim 22, further comprising

computer useable program code configured to test the integrity of a file when being accessed;

and

computer useable program code configured to initiate a self-protection behavior in response to the file being found to be compromised.