Universal Security Agent

• US 20180302409A1
• Filed: 04/12/2017
• Published: 10/18/2018
• Est. Priority Date: 04/12/2017
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Hope, Edward, Solero, Daniel, Moran, Christopher, Meyer, Frederick Henry
• Granted Patent: US 10,503,545 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A universal security agent deployed on a computing endpoint includes one or both of a base agent and a security agent plugin module. The base agent loads the security agent plugin module and, in response, receives plugin tasks from the security agent plugin module for registration. The base agent schedules the received plugin tasks based on a policy and/or a system access information associated with the security agent plugin module. Further, the base agent executes the plugin tasks based on the scheduling. The base agent controls system access requests generated during the execution of the plugin tasks based on the policy associated with the security agent plugin module. Additionally, the base agent monitors and logs system access information associated with the security agent plugin module.

Claims

1. A method comprising:

loading, by a base agent of a universal security agent deployed on a computing endpoint, a security agent plugin module into a memory associated with the computing endpoint;

registering, by the base agent, a plugin task of the security agent plugin module;

scheduling, by the base agent, the plugin task of the security agent plugin module based on one of a policy associated with the security agent plugin module and system access information associated with the security agent plugin module;

executing, by the base agent, the plugin task based on the scheduling;

controlling, by the base agent, a request for system access generated during the execution of the plugin task based on an inspection of the policy associated with the security agent plugin module; and

monitoring and logging, by the base agent, system access information associated with the security agent plugin module, the system access information comprising data associated with the request for system access.

2. The method of claim 1, wherein loading the security agent plugin module comprises:

registering the base agent with a universal security agent controller that is communicably coupled to the universal security agent over a communication network;

transmitting, by the base agent, a current list of configured security agent plugin modules to the universal security agent controller, the current list of configured security agent plugin modules comprising the security agent plugin module;

downloading, by the base agent, plugin package files associated with the security agent plugin module that are received from a repository associated with the universal security agent controller in response to transmitting the current list of configured security agent plugin modules; and

loading, by the base agent, the plugin package files associated with the security agent plugin module to the memory associated with the computing endpoint.

3. The method of claim 2:

wherein the plugin package files of the security agent plugin module comprise a plugin policy file that defines the policy associated with the security agent plugin module, a plugin object file, and a signed digital certificate of the plugin package files; and

wherein loading the plugin package files comprises;

validating, by the base agent, an authenticity of the plugin package files associated with the security agent plugin module prior to loading the plugin package files;

loading, by the base agent, the plugin object file into the memory associated with the computing endpoint; and

loading, by the base agent, the plugin policy file into a plugin policy database of the memory.

4. The method of claim 3, wherein validating comprises:

generating, by the base agent, a hash of the plugin package files associated with the security agent plugin module; and

determining, by the base agent, that the hash of the plugin package files matches the signed digital certificate of the plugin package files.

5. The method of claim 1, wherein registering the plugin task comprises:

receiving, by the base agent, a registration request comprising the plugin task of the security agent plugin module after an initialization of the security agent plugin module that is loaded; and

validating, by the base agent, that the plugin task is compliant with the policy associated with the security agent plugin module.

6. The method of claim 1, wherein the scheduling of the plugin task of the security agent plugin module is controlled to avoid contention of the security agent plugin module with another security agent plugin module for simultaneous access of system resources of the computing endpoint.

7. The method of claim 1, wherein controlling the request for system access comprises:

receiving, by the base agent, the request for system access, the request for system access comprising identifying information associated with the security agent plugin module;

based on the identifying information, determining, by the base agent, that the security agent plugin module is associated with the request for system access;

retrieving, by the base agent, the policy associated with the security agent plugin module from a plugin policy database of the memory of the computing endpoint;

determining, by the base agent, that the policy allows the request for system access by the security agent plugin module; and

interacting, by the base agent, with system resources of the computing endpoint based on an allowed system access request by the security agent plugin module.

8. The method of claim 7, further comprising:

receiving, by the base agent, one of data and an error code in response to the allowed system access request; and

transmitting, by the base agent, one of the data and the error code to the security agent plugin module associated with the allowed system access request.

9. The method of claim 7, further comprising:

transmitting, by the base agent, an error code to the security agent plugin module when the policy associated with the security agent plugin module does not allow the request for system access.

10. The method of claim 1, further comprising:

multiplexing and encrypting, by the base agent, communication data from the security agent plugin module and another security agent plugin module deployed on the computing endpoint to generate multiplexed and encrypted communication data; and

transmitting, by the base agent, the multiplexed and encrypted communication data from the security agent plugin module and the another security agent plugin module to a proxy gateway as a single communication session over a common communication channel.

11. The method of claim 1, further comprising transmitting, by the base agent, communication data from the security agent plugin module to a controller associated with the security agent plugin module based on the policy associated with the security agent plugin module, the controller being located remotely from the computing endpoint.

12. A tangible computer-readable medium comprising a plurality of instructions, which, when executed by a base agent deployed in a computing endpoint, cause the base agent to perform operations comprising:

receiving a plugin task of a security agent plugin module deployed on the computing endpoint;

scheduling the plugin task of the security agent plugin module based on one of a policy associated with the security agent plugin module and system access information associated with the security agent plugin module;

executing the plugin task based on the scheduling;

controlling a request for system access generated during the executing of the plugin task based on an inspection of the policy associated with the security agent plugin module;

monitoring and logging system access information associated with the security agent plugin module, the system access information comprising data associated with the request for system access;

multiplexing and encrypting communication data from the security agent plugin module and another security agent plugin module deployed on the computing endpoint to generate multiplexed and encrypted communication data; and

transmitting the multiplexed and encrypted communication data from the security agent plugin module and the another security agent plugin module to a proxy gateway as a single communication session over a common communication channel.

13. The tangible computer readable medium of claim 12, wherein receiving the plugin task comprises:

receiving a registration request comprising the plugin task of the security agent plugin module after an initialization of the security agent plugin module; and

validating that the plugin task is compliant with the policy associated with the security agent plugin module.

14. The tangible computer readable medium of claim 12, wherein the scheduling of the plugin task of the security agent plugin module is controlled to avoid contention of the security agent plugin module with another security agent plugin module for simultaneous access of system resources of the computing endpoint.

15. The tangible computer readable medium of claim 12, wherein controlling the request for system access comprises:

receiving the request for system access, the request for system access comprising identifying information associated with the security agent plugin module;

based on the identifying information, determining that the security agent plugin module is associated with the request for system access;

retrieving the policy associated with the security agent plugin module from a plugin policy database of the memory of the computing endpoint;

determining that the policy allows the request for system access by the security agent plugin module; and

interacting with system resources of the computing endpoint based on an allowed system access request by the security agent plugin module.

16. The tangible computer readable medium of claim 15, further comprising instructions to perform operations comprising:

receiving one of data and an error code in response to the allowed system access request; and

transmitting one of the data and the error code to the security agent plugin module associated with the allowed system access request.

17. The tangible computer readable medium of claim 15, further comprising instructions to perform operations comprising:

transmitting an error code to the security agent plugin module when the policy associated with the security agent plugin module does not allow the request for system access.

18. A universal security agent comprising:

a security agent plugin module; and

a base agent that is deployed on a computing endpoint, the base agent comprising;

a loading module that;

loads the security agent plugin module into a memory associated with the computing endpoint;

a scheduling module that;

registers a plugin task of the security agent plugin module; and

schedules the plugin task of the security agent plugin module based on one of a policy associated with the security agent plugin module and system access information associated with the security agent plugin module;

a system access module that;

executes the plugin task based on the scheduling;

controls a request for system access generated during the execution of the plugin task based on an inspection of the policy associated with the security agent plugin module; and

a security plugin monitoring module that;

monitors and logs system access information associated with the security agent plugin module, the system access information comprising data associated with the request for system access.

19. The universal security agent of claim 18, wherein the scheduling module validates that the plugin task is compliant with the policy associated with the security agent plugin module.

20. The universal security agent of claim 18, wherein the base agent comprises a communication and encryption module that:

multiplexes and encrypts communication data from the security agent plugin module and another security agent plugin module deployed on the computing endpoint to generate multiplexed and encrypted communication data; and

transmits the multiplexed and encrypted communication data from the security agent plugin module and the another security agent plugin module to a proxy gateway as a single communication session over a common communication channel.