METHOD AND APPARATUS FOR SECURING A COMPUTER

• US 20140289864A1
• Filed: 11/02/2012
• Published: 09/25/2014
• Est. Priority Date: 11/04/2011
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: El-Moussa, Fadi, Dimitrakos, Theo
• Granted Patent: US 9,602,466 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls

Abstract

A computer system (100) is arranged to run at east one user-oriented operating system (153) (e.g. Windows, LINUX, etc.) on which a plurality of user-oriented applications (152) (e.g. Word processor, web browser, spreadsheet application, etc.) may run, the computer system being further arranged to run a secondary program supporting environment (154), (155) (e.g. computer BIOS, Hypervisor, basic LINUX operating system micro-kernel, etc.). The computer system (100) is arranged to run the secondary program supporting environment (154), when the main user-oriented operating system is not miming in either or both of the following situations: prior to loading the main operating system at boot-up time of the system or when a user wishes to log back into his/her operating system after having previously logged out or having been logged out automatically and/or during a sleep mode of the computer system. The computer system (100) is arranged to run within the secondary program supporting environment an agent program or programs (157), (158) which are operable to communicate with one or more remote servers (300) to obtain security patches associated with the user-oriented operating system and/or the user-oriented applications.

Claims

1. A computer system arranged to run at least one user-oriented operating system on which a plurality of user-oriented applications may run, the computer system being further arranged to run a secondary program supporting environment;

wherein the computer system is arranged to run within the secondary program supporting environment an agent program or programs operable to communicate with one or more remote servers to obtain security patches associated with the user-oriented operating system and/or the user-oriented applications and wherein the computer system is configured to apply any security patches obtained by the agent program or programs prior to the user-oriented operating system setting up a network connection on boot up of the user-oriented operating system or prior to permitting certain specified user-oriented applications running on the user-oriented operating system from using a network connection.

2. A computer system according to claim 1 wherein the computer system is arranged to run the secondary program supporting environment when the main user-oriented operating system is not running in either or both of the following situations:

prior to loading the main operating system at boot-up time of the system or when a user wishes to log back into his/her operating system after having previously logged out or having been logged out automatically and/or during a sleep mode of the computer system.

3. A computer system according to claim 1 wherein the patches may comprise either an update for an application or an operating system or a filter patch arranged to block incoming packets of data which satisfy a criterion or criteria specified in the patch.

4. A computer system according to claim 1 wherein the secondary program supporting environment is a Basic Input Output System.

5. A computer system according to claim 1 wherein the secondary program supporting environment is an operating system which includes a virtual machine manager application which is operable to run the user oriented operating system.

6. A method of updating a computer system arranged to run at least one user-oriented operating system on which a plurality of user-oriented applications may run and a secondary program supporting environment, the updating method operating to keep the computer system protected from having vulnerabilities, in the user oriented operating system or in a user application running on the user oriented operating system, from being exploited by malware, the method comprising a program or programs, running within the secondary program supporting environment, communicating with one or more remote servers to obtain at least one security patch or filter, the at least one security patch or filter being associated with the user-oriented operating system and/or with a user-oriented application operable to run on the user-oriented operating system;

wherein the method further comprises the computer system applying any security patches obtained by the agent program or programs prior to the user-oriented operating system setting up a network connection in respect of either the user-oriented operating system as a whole or in respect of a user oriented application to which an obtained patch applies, or at least prior to the user-oriented operating system permitting certain specified applications such as a web browser from using a network connection.

7. A program or programs for causing a computer system to carry out the method of claim 6.

8. A non-transient computer readable carrier medium carrying the computer program of claim 7.