Real-Time Module Protection

• US 20140115652A1
• Filed: 10/19/2012
• Published: 04/24/2014
• Est. Priority Date: 10/19/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kapoor, Aditya, Edwards, Jonathan L., Hughes, Michael, Schmugar, Craig, Konobeev, Vladimir
• Granted Patent: US 9,275,223 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Technologies for securing an electronic device include trapping an attempt to access a secured system resource of the electronic device, determining a module associated with the attempt, determining a subsection of the module associated with the attempt, the subsection including a memory location associated with the attempt, accessing a security rule to determine whether to allow the attempted access based on the determination of the module and the determination of the subsection, and handling the attempt based on the security rule. The module includes a plurality of distinct subsections.

Claims

1. A method for securing an electronic device, comprising:

trapping an attempt to access a secured system resource of the electronic device;

determining a module associated with the attempt, the module comprising a plurality of distinct subsections;

determining a subsection of the module associated with the attempt, the subsection including a memory location associated with the attempt;

based on the determination of the module and the determination of the subsection, accessing a security rule to determine whether to allow the attempted access; and

handling the attempt based on the security rule.

2. The method of claim 1, wherein:

the trapping is conducted at a level below all of the operating systems of the electronic device; and

handling the attempt is conducted at least in part at a level below all of the operating systems of the electronic device.

3. The method of claim 1, wherein the memory location identifies a point of origin of the attempt.

4. The method of claim 1, wherein the memory location identifies a target point of the attempt.

5. The method of claim 1, wherein the subsection is a target of the attempt and is a data subsection.

6. The method of claim 1, wherein the subsection is a target of the attempt and is a header subsection.

7. The method of claim 1, wherein the subsection is a target of the attempt and is a code subsection.

8. The method of claim 1, wherein the security rule:

identifies a target of the attempt as a code subsection; and

based on the identification, specifies that handling the attempt includes denying an attempted write to the code subsection.

9. The method of claim 1, wherein the security rule:

identifies a target of the attempt as a header subsection; and

based on the identification, specifies that handling the attempt includes denying an attempted write to the header subsection.

10. The method of claim 1, wherein the security rule:

identifies a target of the attempt as a data subsection; and

based on the identification, specifies that handling the attempt includes allowing an attempted write to the data subsection.

11. At least one machine readable storage medium, comprising computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:

trap an attempt to access a secured system resource of an electronic device;

determine a module associated with the attempt, the module comprising a plurality of distinct subsections;

determine a subsection of the module associated with the attempt, the subsection including a memory location associated with the attempt;

based on the determination of the module and the determination of the subsection, access a security rule to determine whether to allow the attempted access; and

handle the attempt based on the security rule.

12. The medium of claim 11, wherein:

the trapping is conducted at a level below all of the operating systems of the electronic device; and

handling the attempt is conducted at least in part at a level below all of the operating systems of the electronic device.

13. The medium of claim 11, wherein the memory location identifies a point of origin of the attempt.

14. The medium of claim 11, wherein the memory location identifies a target point of the attempt.

15. The medium of claim 11, wherein the subsection is a target of the attempt and is a data subsection.

16. The medium of claim 11, wherein the subsection is a target of the attempt and is a header subsection.

17. The medium of claim 11, wherein the subsection is a target of the attempt and is a code subsection.

18. The medium of claim 11, wherein the security rule:

identifies a target of the attempt as a code subsection; and

based on the identification, specifies that handling the attempt includes denying an attempted write to the code subsection.

19. The medium of claim 11, wherein the security rule:

identifies a target of the attempt as a header subsection; and

based on the identification, specifies that handling the attempt includes denying an attempted write to the header subsection.

20. The medium of claim 11, wherein the security rule:

identifies a target of the attempt as a data subsection; and

based on the identification, specifies that handling the attempt includes allowing an attempted write to the data subsection.

21. A system for securing an electronic device, comprising:

a memory;

a processor;

a secured system resource; and

one or more security agents including instructions resident in the memory and operable for execution by the processor, wherein the security agents are configured to;

trap an attempt to access the secured system resource;

determine a module associated with the attempt, the module comprising a plurality of distinct subsections;

determine a subsection of the module associated with the attempt, the subsection including a memory location associated with the attempt;

based on the determination of the module and the determination of the subsection, access a security rule to determine whether to allow the attempted access; and

handle the attempt based on the security rule.

22. The system of claim 21, wherein the security agents are further configured to:

conduct the trapping at a level below all of the operating systems of the electronic device; and

conduct the handling at least in part at a level below all of the operating systems of the electronic device.

23. The system of claim 21, wherein the memory location identifies a point of origin of the attempt.

24. The system of claim 21, wherein the memory location identifies a target point of the attempt.

25. The system of claim 21, wherein the subsection is a target of the attempt and is a data subsection.

26. The system of claim 21, wherein the subsection is a target of the attempt and is a header subsection.

27. The system of claim 21, wherein the subsection is a target of the attempt and is a code subsection.

28. The system of claim 21, wherein the security rule:

identifies a target of the attempt as a code subsection; and

based on the identification, specifies that handling the attempt includes denying an attempted write to the code subsection.

29. The system of claim 21, wherein the security rule:

identifies a target of the attempt as a header subsection; and

based on the identification, specifies that handling the attempt includes denying an attempted write to the header subsection.

30. The system of claim 21, wherein the security rule:

identifies a target of the attempt as a data subsection; and

based on the identification, specifies that handling the attempt includes allowing an attempted write to the data subsection.