System and methods for defending against root

• US 20090007233A1
• Filed: 04/28/2008
• Published: 01/01/2009
• Est. Priority Date: 04/27/2007
• Status: Active Grant

• Current Assignee: ANGEL Secure Networks, Inc.
• Original Assignee: ANGEL Secure Networks, Inc.
• Inventors: Smith, Fred Hewitt
• Granted Patent: US 8,336,107 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method is disclosed for securing sensitive material on a computer system comprising a network of computers from unauthorized access by a root level user of the computer system, the method including the steps of: limiting access to the sensitive material to one or more authorized users; controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material.

Claims

1. A method for securing sensitive material on a computer system comprising a network of computers from unauthorized access by a root level user of said computer system, said method comprising the steps of:

limiting access to said sensitive material to one or more authorized users; and

controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material.

2. The method of claim 1, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material comprises denying user access including root level user access to said one or more system functions for a period of time based on the status of said sensitive material.

3. The method of claim 1, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material comprises denying user access including root level user access to said one or more system functions when said functions are directed at said sensitive material.

4. The method of claim 3, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material comprises not permitting said system function to proceed.

5. The method of claim 4, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material comprises producing an alarm in response to an unauthorized system function directed at said sensitive material.

6. The method of claim 5, further comprising deleting or encrypting at least a portion of the sensitive material in response to said alarm, or taking other appropriate action such as notifying remote network nodes of the incident

7. The method of claim 3, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material comprises:

providing a list of allowed processes related to the sensitive material;

intercepting a system function call directed to said sensitive material, said system function call corresponding to a process on said computer system;

identifying the process corresponding to the intercepted system function call; and

for identified processes not included in the allowed process list, not allowing the function call to proceed.

8. The method of claim 6, wherein the list of allowed processes corresponds to a list of ID values for the allowed processes, and

wherein identifying the process corresponding to the intercepted system function call comprises obtaining a process identification value associated with the process.

9. The method of claim 7, further comprising monitoring operation of the sensitive materials on the computer system using a remote monitoring unit, wherein root level access to said computer system does not provide root level access to said remote unit.

10. The method of claim 9, wherein providing the list of allowed processes related to the sensitive material comprises determining, based on the remote monitoring or previous laboratory experiments or both, which processes are necessary for the operation of the sensitive materials.

11. The method of claim 7, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material further comprises analyzing system function calls corresponding to processes which are members of the list of allowed processes to determine information about performance of said processes.

12. The method of claim 7, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material further comprises rescheduling system function calls corresponding to processes which are members of the list of allowed processes to improve operation of the sensitive material.

13. The method of claim 3, wherein controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material comprises modifying an operating system of each of the computers of the network of computers.

14. The method of claim 13, wherein modifying an operating system of each of the computers of the network of computers comprises associating a set of additional instructions with one or more operating system functions to provide modified system functions.

15. The method of claim 13, wherein modifying an operating system of each of the computers of the network of computers consists of inserting kernel level modules.

16. The method of claim 13, wherein the system functions are kernel level primitive functions, and wherein modifying an operating system of each of the computers of the network of computers comprises insertion of kernel level modules to operate within these functions.

17. The method of claim 16, further comprising:

providing an angel process on each of the computers of the computer network, respectively, each of said angel processes being inaccessible to the root level user;

using the modified system functions, enabling communication between each of said angel processes and sensitive material residing on the respective computer;

for each of said angel processes providing a secure communication link with at least one other angel process.

18. The method of claim 17, further comprising providing a secure communication link between at least one of the angel processes and a remote monitoring unit, wherein root level access to said computer system does not provide root level access to said remote unit.

19. The method of claim 1, further comprising

storing authenticating information in a remote unit, wherein root level access to said computer system does not provide root level access to said remote unit;

and

providing said authenticating information to an authorized user over secure communication links;

wherein limiting access to said sensitive material to one or more authorized users comprises allowing access to said sensitive material in response to receiving said authenticating information from the authorized users.

20. A system for securing sensitive material on a computer system comprising a network of computers from unauthorized access by a root level user of said computer system, said system comprising:

an authentication system for limiting access to said sensitive material to one or more authorized users; and

for each computer in said network, a modified operating system having modified system functions for controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material.

21. The system of claim 20, further comprising

an angel process on each of the computers of the computer network, respectively, each of said angel processes being inaccessible to the root level user;

and

for each of said angel processes, a secure communication link with at least one other angel process;

wherein the modified system functions communicate with said angel processes and enable communication between each of said angel processes and portions of sensitive material residing on the computer on which the respective angel process resides.

22. The system of claim 21, wherein the modified operating system functions each comprise an unmodified operating system function and a set of additional instructions.

23. The system of claim 21, wherein the modified operating system of each of the computers of the network of computers comprises an unmodified operating system and at least one modifying kernel level module.

24. The system of claim 21, further comprising a remote monitoring unit in secure communication with at least one of the angel processes, wherein root level access to said computer system does not provide root level access to said remote unit.

25. The system of claim 20, further comprising a remote unit for storing authenticating information and providing said authenticating information over a secure communications link to the authorized users,

wherein root level access to said computer system does not provide root level access to said remote unit, and

wherein said authentication system is configured to allow access to said sensitive material in response to receiving said authenticating information from the authorized users.

26. A computer-readable media containing a set of instructions that causes a computer system to perform a process for securing sensitive material on the computer system from unauthorized access by a root level user of said computer system, said method comprising the steps of:

limiting access to said sensitive material to one or more authorized users; and

controlling the operation of one or more system functions to prevent unauthorized access to the sensitive material.