Systems and methods for implementing computer security

• US 9,124,640 B2
• Filed: 10/09/2014
• Issued: 09/01/2015
• Est. Priority Date: 08/09/2011
• Status: Active Grant

• Current Assignee: Runway Growth Finance Corporation
• Original Assignee: CloudPassage Inc.
• Inventors: Sweet, Carson, Geraymovych, Vitaliy
• Primary Examiner(s): Dinh, Minh
• Assistant Examiner(s): An, Wayne
• Application Number:
  US14/510,982
• Publication Number:
  US 20150026767A1
• Time in Patent Office: 327 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computing device includes a security control module to monitor and control security of the operating system and security of one or more applications executing within the operating system. The security control module transmits to a remote security server a policy identifier, which identifies a security policy that applies to the operating system and to the applications. The security control module receives from the remote security server a unique cryptographic key. The security control module periodically retrieves from the security server a set of commands selected by the remote security server according to the security policy and current conditions. The security control module executes each command. Each command either modifies execution of an executable program or process, collects information, or performs an action that modifies data associated with the operating system, data associated with the security control module, or data associated with the one or more applications.

Claims

1. A computing device, comprising:

one or more processing units;

memory; and

a first security control module, wherein the first security control module is stored in the memory and executed by one or more of the processing units to monitor and control security of a first operating system and security of one or more first applications executing within the first operating system, the first security control module including instructions for;

transmitting to a remote security server a policy identifier, wherein the policy identifier identifies a security policy that applies to the first operating system and applies to the one or more first applications;

receiving from the remote security server a cryptographic key uniquely associated with the first security control module;

periodically using the cryptographic key to securely retrieve from the remote security server a respective set of commands, wherein the respective set of commands is selected by the remote security server according to;

(i) the identified security policy, (ii) a current state of the first operating system, and (iii) a current state of the one or more first applications; and

executing each command in the respective set of commands, wherein each command (i) modifies execution of an executable program or process, (ii) collects information about the first operating system, about the security control module, or about the one or more first applications, or (iii) performs an action that modifies data associated with the first operating system, data associated with the security control module, or data associated with the one or more first applications.

2. The computing device of claim 1, wherein the respective set of commands includes a command to (i) update a firewall policy for the first operating system or (ii) collect information about the first security control module according to a set of self-verification factors.

3. The computing device of claim 1, wherein the first security control module further includes instructions that execute when the respective set of commands includes one or more commands to collect information about the first operating system, about the security control module, or about the one or more first applications, the further instructions securely transmitting the collected information to the remote security server for evaluation.

4. The computing device of claim 3, wherein securely transmitting the collected information includes using the cryptographic key and data shared with the remote security server to digitally sign and encrypt the collected information prior to transmitting the collected information to the remote security server.

5. The computing device of claim 1, wherein one or more of the commands in the respective set are scheduled to repeat execution at a predetermined time or at predetermined time intervals.

6. The computing device of claim 1, wherein the respective set of commands includes (i) a command to reinitialize the first security control module, (ii) a command to terminate execution of the first operating system, or (iii) a command to collect configuration settings of one or more files or directories stored in the memory.

7. The computing device of claim 1, wherein the respective set of commands includes (i) a command to collect password information for one or more users of the first operating system, (ii) a command to collect information regarding network communication ports for the first operating system, or (iii) a command to collect information regarding one or more processes running in the memory.

8. The computing device of claim 1, wherein the computing device is an embedded component of an automobile or an embedded component of an electrical appliance.

9. The computing device of claim 1, further comprising a hypervisor module, wherein the hypervisor module instantiates virtual machines on the computing device, and the first operating system is executing within a first virtual machine instantiated in the memory by the hypervisor module.

10. The computing device of claim 9, wherein the memory stores a second virtual machine instantiated by the hypervisor module, the second virtual machine includes a second operating system and a second security control module, the second security control module is executed by one or more of the processing units to monitor and control security of the second operating system and security of one or more second applications executing within the second operating system, and memory allocated to the first virtual machine is distinct from memory allocated to the second virtual machine.

11. The computing device of claim 1, wherein the current state of the first operating system includes one or more of:

a current set of processes running in the first operating system;

a current set of authorized users of the first operating system;

a current set of files and directories accessible to the first operating system;

current metadata for files and directories accessible to the first operating system;

or

current content of one or more configuration files for the first operating system.

12. The computing device of claim 1, wherein the current state of the one or more first applications includes one or more of:

information that identifies which of the one or more first applications are running;

a current set of authorized users of the one or more first applications;

a current set of files and directories associated with the one or more first applications;

current metadata for files and directories associated with the one or more first applications;

or

current content of one or more configuration files for the one or more first applications.

13. The method of claim 1, wherein the one or more first applications are determined by the identified security policy.

14. The method of claim 1, wherein the identified security policy has an associated set of commands and an associated set of rules for evaluating operational data of the device.

15. A security server, comprising:

one or more processing units;

memory;

a token generation module, wherein the token generation module is stored in the memory and executed by one or more of the processing units, the token generation module including instructions for;

receiving a request from a security control module running within a first an operating system on a remote computing device distinct from the security server, wherein the request includes a policy identifier that identifies a security policy;

generating a unique agent identity token, which includes a cryptographic key; and

transmitting the agent identity token to the security control module; and

an integrity validation module, wherein the integrity validation module is stored in the memory and executed by one or more of the processing units, the integrity validation module including instructions for;

selecting a first set of commands according to;

(i) the identified security policy, (ii) a current state of the operating system, (iii) a current state of the security control module, and (iv) a current state of one or more applications running in the operating system on the remote computing device;

placing the first set of commands in a command queue for retrieval and execution by the security control module on the remote computing device;

securely receiving from the security control module data collected at the remote computing device by executing one or more of the commands in the first set of commands;

using the data collected at the remote computing device to evaluate integrity of protected systems corresponding to the data collected; and

selecting a second set of commands according to the identified security policy and results of the integrity evaluation, and placing the second set of commands in the command queue for retrieval and execution by the security control module on the remote computing device.

16. The security server of claim 15, wherein evaluating integrity of a respective protected system uses a respective set of rules stored at the security server.

17. The security server of claim 16, wherein, when a rule of the respective set of rules fails, the integrity validation module posts a corrective or proactively protective action to the command queue for retrieval by the security control module.

18. The security server of claim 15, wherein securely receiving the data collected uses the cryptographic key and data shared with the remote computing device to decrypt the received data and verify a digital signature.

19. The security server of claim 15, wherein the first set of commands includes a command to update a firewall policy for the remote computing device.

20. The security server of claim 15, wherein the integrity validation module further includes instructions that execute prior to selecting the first set of commands, the further instructions for:

securely receiving from the security control module data collected about the security control module according to a set of self-verification factors;

using the data collected about the security control module to evaluate integrity of the security control module; and

when the evaluation identifies an integrity failure, placing one or more corrective commands in the command queue for retrieval and execution by the security control module on the remote computing device.

21. The security server of claim 15, wherein the first set of commands includes:

a first command to update self-verification factors stored at the remote computing device;

a second command to collect data about the security control module, wherein the second command uses the updated self-verification factors; and

a third command to communicate the collected data to the security server for evaluation.

22. The security server of claim 21, wherein the second and third commands specify that they are to be repeated at a predetermined time or at predetermined time intervals.

23. The security server of claim 15, wherein the first set of commands includes a command to:

(i) reinitialize the security control module,

(ii) terminate execution of the operating system on the remote computing device,

(iii) collect configuration settings of one or more files or directories stored in memory associated with the operating system on the remote computing device, or

(iv) collect password information for one or more users of the operating system on the remote computing device.

24. The security server of claim 15, wherein the first set of commands includes a command to collect information regarding network communication ports for the security control module.

25. The security server of claim 15, wherein the first set of commands includes a command to collect (i) information regarding one or more processes running in memory associated with the operating system on the remote computing device or (ii) information that identifies what processes are running in memory associated with the operating system on the remote computing device.

26. The security server of claim 15, wherein the protected systems include (i) the operating system on the remote computing device, (ii) the security control module, or (iii) the one or more applications running in the operating system on the remote computing device.

27. The security server of claim 15, wherein the current state of the operating system includes one or more of:

a current set of processes running in the operating system;

a current set of authorized users of the operating system;

a current set of files and directories accessible to the operating system;

current metadata for files and directories accessible to the operating system;

or

current content of one or more configuration files for the operating system.

28. The security server of claim 15, wherein the current state of the one or more applications includes one or more of:

information that identifies which of the one or more applications are running;

a current set of authorized users of the one or more applications;

a current set of files and directories associated with the one or more applications;

current metadata for files and directories associated with the one or more applications;

or

current content of one or more configuration files for the one or more applications.

29. The security server of claim 15, wherein the current state of the security control module includes one or more of:

a current set of files and directories associated with the security control module;

current metadata for files and directories associated with the security control module;

or

current content of one or more configuration files for the security control module.

30. A non-transitory computer readable storage medium storing one or more programs configured for execution by a computing device having one or more processors and memory, the one or more programs comprising a security control module to monitor and control security of an operating system and security of one or more applications executing within the operating system, the security control module including instructions for:

transmitting to a remote security server a policy identifier, wherein the policy identifier identifies a security policy that applies to the operating system and applies to the one or more applications;

receiving from the remote security server a cryptographic key uniquely associated with the security control module;

periodically using the cryptographic key to securely retrieve from the remote security server a respective set of commands, wherein the respective set of commands is selected by the remote security server according to;

(i) the identified security policy, (ii) a current state of the first operating system, and (iii) a current state of the one or more applications; and

executing each command in the respective set of commands, wherein each command (i) modifies execution of an executable program or process, (ii) collects information about the operating system or about the one or more applications, or (iii) performs an action that modifies data associated with the operating system or data associated with the one or more applications.