METHOD AND SYSTEM FOR PROTECTING COMPUTERIZED SYSTEMS FROM MALICIOUS CODE

• US 20150356297A1
• Filed: 01/15/2014
• Published: 12/10/2015
• Est. Priority Date: 01/21/2013
• Status: Active Grant

• Current Assignee: Morphisec Information Security 2014, Ltd.
• Original Assignee: Morphisec Information Security 2014, Ltd.
• Inventors: GURI, Mordehai, ELOVICI, Yuval, KEDMA, Gabi
• Granted Patent: US 9,703,954 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

The invention relates to a method for providing a computerized system which is protected from malicious programs coming from an external source, the method comprises the steps of (a) secretly, and in a manner unknown to authors of external programs, modifying one or more essential elements at the protected system in a manner which causes all running programs to fail, unless they are subjected to a compatible modification which enables them to run properly; and (b) modifying each program at the computerized system which is known to be benign in order to comply with said modification of one or more essential elements, thereby to enable it to be executed properly.

Claims

1. A method for providing a computerized system which is protected from malicious programs coming from an external source, the method comprises the steps of:

a) secretly, and in a manner unknown to authors of external programs, modifying on a temporal basis at a central security authority one or more essential elements of the operating system of the protected system in a manner which causes all running programs to fail, unless they are subjected to a compatible modification which enables them to run properly; and

b) modifying also on a temporal basis at said a central security authority each program which is known to be benign in order to comply with said modification of one or more essential elements, thereby to enable proper execution of the program, and running the modified program at the computerized system

2. Method according to claim 1, wherein said modifications involve a modification to one or more essential elements at the operating system, and to each benign program.

3. Method according to claim 1, wherein when a program that does not comply with said modifications is found, the program is halted or sent to a sandbox, and an alert is raised.

4. Method according to claim 1, wherein said modifications involve a modification to an operating system at said system, and wherein said modification to each benign program involves a compatible modification to the instruction set used by the program.

5. Method according to claim 1, wherein said modifications involve a modification to an instruction set of a processor at said system, and wherein said modification to each benign program involves a compatible modification to the instruction set used by the program.

6. Method according to claim 1 which is adapted for a static linking, wherein said modification at the protected system involves modification to at least one service routine and to a wrapper routine in the standard library, and wherein said modification to each of the benign programs is a compatible modification to the signature of the program.

7. Method according to claim 1 which is adapted for a dynamic linking, wherein said modification at the protected system involves maintaining two copies of the dynamic standard library, a first copy of the dynamic standard library under its original name, and a under a modified name, and wherein said modification to each of the benign programs is a compatible modification to call said modified copy of the dynamic standard library.

8. Method according to claim 7, which further includes a stub to detect programs that do not comply with said modification at the protected system.

9. Method according to claim 1 which is adapted for a dynamic linking, wherein said modification at the protected system involves modification to a wrapper routine in the user mode and to the system call service routing in the kernel mode, and wherein said modification to each of the benign programs is a compatible modification to signatures of one or more system call invocations.

10. Method according to claim 1 wherein said modification at the protected system involves modification to the names of one or more methods in a dynamic link library, and wherein each of the benign programs are modified to conform with said modification in said dynamic link library.

11. Method according to claim 5, wherein the processor is a physical processor.

12. Method according to claim 5, wherein the processor is a virtual processor or a hypervisor.

13. Method according to claim 1, wherein said modifications are made on a temporal basis, each time a different subset of essential elements and respective parameters are selected for modification.

14. Method according to claim 1, wherein the modification to said program further involves recompilation and or relinking of the program.

15. Method according to claim 4, wherein the modification to said operating system further involves recompilation and or relinking of the operating system.

16. Method according to claim 1, wherein said modifications to one or more essential elements involve modifications to a virtual machine, and wherein said modification to each benign program involves a compatible modification to a bytecode used by the program.

17. Method according to claim 1, wherein said modifications to one or more essential elements involve modifications to a JIT compiler, and wherein said modification to each benign program involves a compatible modification to a bytecode used by the program.

18. Method according to claim 5, wherein the modification of the instruction set is performed by utilizing the microcode update facility available on various modern processors.