SYSTEMS AND METHODS FOR IMPLEMENTING COMPUTER SECURITY

• US 20150026472A1
• Filed: 10/09/2014
• Published: 01/22/2015
• Est. Priority Date: 08/09/2011
• Status: Active Grant

• Current Assignee: Runway Growth Finance Corporation
• Original Assignee: CloudPassage Inc.
• Inventors: Sweet, Carson, Geraymovych, Vitaly
• Granted Patent: US 8,996,865 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer system includes memory storing an operating system. An agent executive runs within the operating system. The agent executive receives an agent identity token from a grid computer system. The agent identity token includes a unique cryptographic key assigned to the agent executive. The agent executive collects information about the computer system for an evaluation of integrity of the agent executive, according to a plurality of agent self-verification factors. The agent executive encrypts the collected information using the cryptographic key and transmits the encrypted information to the grid computer system. The agent executive retrieves an encrypted set of commands from the grid computer system, which are selected by the grid computer system in response to the transmitted information. The agent executive decrypts the encrypted set of commands and executes, at the computer system, each command in the set of commands.

Claims

1. A computer system comprising:

one or more processing units;

a memory, coupled to at least one of the one or more processing units, the memory storing an operating system, wherein an agent executive runs within the operating system, the agent executive executed by at least one of the one or more processing units, the agent executive including instructions for;

receiving an agent identity token from a grid computer system, wherein the agent identity token includes a unique cryptographic key assigned to the agent executive;

collecting information about the computer system for an evaluation of integrity of the agent executive, according to a plurality of agent self-verification factors;

encrypting the collected information using the cryptographic key;

transmitting the encrypted information to the grid computer system;

retrieving an encrypted first set of commands from the grid computer system, wherein the first set of commands is selected by the grid computer system in response to the transmitted encrypted information;

decrypting the encrypted first set of commands using the cryptographic key; and

executing, at the computer system, each command in the first set of commands.

2. The computer system of claim 1, wherein a command in the first set of commands updates a firewall policy for the computer system.

3. The computer system of claim 1, wherein a command in the first set of commands is a corrective or proactively protective action.

4. The computer system of claim 1, wherein a command in the first set of commands repeats the collecting, encrypting, and transmitting at a predetermined time or at a predetermined time interval.

5. The computer system of claim 1, wherein the first set of commands includes a plurality of commands and wherein:

a first command in the plurality of commands updates the plurality of agent self-verification factors; and

a second command in the plurality of commands repeats the collecting, encrypting, and transmitting at a predetermined time, or at predetermined time intervals, using the update to the plurality of agent self-verification factors.

6. The computer system of claim 1, wherein a command in the first set of commands reinitializes the agent executive and repeats the receiving, collecting, encrypting, and transmitting after re-initialization of the agent executive is complete.

7. The computer system of claim 1, wherein a command in the first set of commands terminates execution of the operating system.

8. The computer system of claim 1, wherein the first set of commands performs one of (i) checking a status of a setting associated with a file stored in the memory, (ii) checking a setting of a directory stored in the memory, (iii) checking a password associated with a user of the computer system, or (iv) checking a password associated with a group of users of the computer system.

9. The computer system of claim 1, wherein the first set of commands checks a status of a network communication port for the computer system.

10. The computer system of claim 1, wherein the retrieving, decrypting, and executing are repeated at a predetermined time or at predetermined time intervals.

11. The computer system of claim 1, wherein the encrypting further uses data shared with the grid computer system to digitally sign and encrypt the collected information prior to transmitting the encrypted information.

12. The computer system of claim 1, wherein the first set of commands checks a status of a process running in the memory or checks for existence of a process running in the memory.

13. A grid computer system comprising:

one or more processing units;

a memory, coupled to at least one of the one or more processing units, the memory storing a grid node, the grid node executed by at least one of the one or more processing units, the grid node including instructions for;

receiving a request from an agent executive running within an operating system on a remote computer distinct from the grid computer system;

generating a unique agent identity token, which includes a cryptographic key;

transmitting the agent identity token to the agent executive;

receiving encrypted information, signed with a cryptographic digital signature, from the remote computer for an evaluation of the integrity of the agent executive based upon a plurality of agent self-verification factors;

decrypting the received encrypted information using the cryptographic key to form decrypted information; and

verifying the integrity of the agent executive based on the decrypted information.

14. The grid computer system of claim 13, wherein the verifying comprises applying to the decrypted information one or more rules stored on the grid computer system,

wherein, when a rule of the one or more rules fails, the verifying further comprises posting a corrective or proactively protective action to a command queue on the grid computer system that is uniquely associated with the agent executive.

15. The grid computer system of claim 13, wherein the decrypting further uses data shared with the agent executive running on the remote computer.

16. The grid computer system of claim 13, wherein the grid computer system comprises a plurality of computers networked to each other by a network connection.

17. The grid computer system of claim 13, wherein the grid node further includes instructions for verifying the digital signature, thereby obtaining decrypted, authenticated, and integrity-verified information.

18. The grid computer system of claim 13, wherein the grid node further includes instructions for:

creating, using the agent identity token, a command queue on the grid computer system, wherein the command queue is unique to the agent executive; and

posting to the command queue one or more commands to be executed by the agent executive.

19. The grid computer system of claim 18, wherein a command in the one or more commands (i) updates a firewall policy for the remote computer, or (ii) is a corrective or proactively protective action to be executed by the agent executive.

20. The grid computer system of claim 18, wherein the one or more commands is a plurality of commands and wherein:

a first command in the plurality of commands updates the plurality of agent self-verification factors;

a second command in the plurality of commands instructs the agent executive to collect data for an evaluation of integrity of the agent executive using the update to the plurality of agent self-verification factors; and

a third command in the plurality of commands instructs the agent executive to communicate the data to the grid node as part of a process in which no network connection may be initiated from the grid computer system to the agent executive, but may only be initiated from the agent executive to the grid computer system.

21. The grid computer system of claim 18, wherein a command in the one or more commands reinitializes the agent executive and repeats:

receiving a request from the agent executive;

generating a unique agent identity token;

transmitting the agent identity token;

receiving encrypted information;

decrypting the received encrypted information; and

verifying the integrity of the agent executive.

22. The grid computer system of claim 18, wherein a command in the one or more commands terminates execution of the operating system on the remote computer.

23. The grid computer system of claim 18, wherein the one or more commands check a status of a setting associated with a file stored in the memory, check a setting of a directory stored in the memory, or check an existence or a status of a process running in the memory.

24. The grid computer system of claim 18, wherein the one or more commands check a password associated with a user of the remote computer or check a password associated with a group of users of the remote computer.

25. The grid computer system of claim 18, wherein the one or more commands check a status of a network communication port for the remote computer.

26. The grid computer system of claim 18, wherein the one or more commands check a status of a process running on the remote computer.

27. The grid computer system of claim 18, wherein a command in the one or more commands instructs the agent executive to:

collect data for an evaluation of integrity of the agent executive using a plurality of agent self-verification factors; and

communicate the data to the grid node.

28. The grid computer system of claim 28, wherein the one or more commands further specify that the collection and communication be repeated at a predetermined time or be repeated at predetermined time intervals.

29. A non-transitory computer readable storage medium storing one or more programs configured for execution by a computer system having one or more processors and memory, the one or more programs comprising instructions for:

receiving an agent identity token from a grid computer system, distinct from the computer system, wherein the agent identity token includes a unique cryptographic key assigned to the computer system;

collecting information about the computer system for an evaluation of integrity of the one or more programs, according to a plurality of agent self-verification factors;

encrypting the collected information using the cryptographic key;

transmitting the encrypted information to the grid computer system;

retrieving an encrypted first set of commands from the grid computer system, wherein the first set of commands are selected by the grid computer system in response to the transmitted encrypted information;

decrypting the encrypted first set of commands using the cryptographic key; and

executing, at the computer system, each command in the first set of commands.

30. A non-transitory computer readable storage medium storing one or more programs configured for execution by a computer system having one or more processors and memory, the one or more programs comprising instructions for:

receiving a request from an agent executive running within an operating system on a remote computer distinct from the computer system, wherein the request includes a unique identifier of the agent executive;

generating a unique agent identity token, which includes a cryptographic key;

transmitting the agent identity token to the agent executive;

receiving encrypted information, signed with a cryptographic digital signature, from the remote computer for an evaluation of the integrity of the agent executive based upon a plurality of agent self-verification factors;

decrypting the received encrypted information using the cryptographic key to form decrypted information; and

verifying the integrity of the agent executive based on the decrypted information.