System and method to secure a computer system by selective control of write access to a data storage medium

• US 9,600,661 B2
• Filed: 12/01/2005
• Issued: 03/21/2017
• Est. Priority Date: 12/01/2005
• Status: Active Grant

• Current Assignee: Drive Sentry Limited
• Original Assignee: Drive Sentry Limited
• Inventors: Safa, John
• Primary Examiner(s): MACKALL, LARRY T
• Application Number:
  US11/292,910
• Publication Number:
  US 20070130433A1
• Time in Patent Office: 4,128 Days
• Field of Search: 711/163
• US Class Current: 1/1
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Abstract

The present invention relates to a method and system of controlling the writing of data to a computer storage medium such as a hard drive in a computer system in order to prevent viruses or similar program code from being saved on such medium. Upon the computer system initiating a request to write data to the medium, the application embodying the method and system checks the identity of the running application requesting to perform the write. The method and system then checks a rule database to determine if such requesting application has permission to write to the medium. The system can also check that the data file type that the application seeks to write is a permitted type for that application. In response to the output of the database check, the requested write is allowed to proceed or is blocked. In the absence of a rule, the system presents the request to the computer user. The user can either grant permission or block, and such response can be included in the rule database. User responses can be collected from many instances of the invention and the collective response of users presented to a user.

Claims

1. A method of controlling write access to a mass data storage device by:

running a first process that operates in conjunction with an operating system that manages access to a data storage device, said process operating in kernel mode monitoring data storage device accesses;

detecting by use of the process an attempt by an application distinct from the first process to write data to said data storage device;

in response to such detection, interrogating a rules database wherein said rules database is comprised of a plurality of references to a corresponding plurality of applications, each reference further comprised of at least one access level associated with the corresponding application; and

controlling write access to the data storage device by the application attempting the write in dependence on a result of said interrogation;

wherein said interrogation result is comprised of the value of the access level associated with said application.

2. A method as claimed in claim 1 in which the access level is one of a plurality of levels, the levels including a first level in which no write access is allowed, a second level in which full write access is allowed, and a third level in which write access is only allowed to write data of at least one specified file type.

3. A method as claimed in claim 2 where in a case where the access level is controlled to the first level, the method further includes generating a prompt on a display requesting response from a user, receiving such response, and updating the database in dependence on such response.

4. A method as claimed in claim 3 in which the user can respond to the prompt by choosing from of a number of possible responses, the possible responses comprised of a first response for allowing write access, a second response for blocking write access and a third response for allowing write access for a specific file type.

5. A method as claimed in claim 4 in which the user can respond further by selecting from a plurality of further actions, the further actions comprised of:

storing the chosen response in the rules database.

6. The method according to claim 1 with the additional steps of determining whether a rule corresponding to said application is in the database, in response to determining that no such rule resides in the database, transmitting a query to a remote server operatively connected to the computer over a data network and receiving into said computer from the remote server at least one rule corresponding to said application.

7. The method of claim 6

further comprising:

determining that the received rule has not been tampered with.

8. The method of claim 1 where at least one rule is produced by means of inspection of a database that relates at least one application to one file type associated with data said application writes to a mass data storage device.

9. The method of any of claim 1 or 2 through claim 8 where the detecting step further comprises determining a file type that said data comprises by means of inspection of the data itself.

10. The method of claim 1 further comprising generating a prompt on a display requesting a response from a user, receiving from the user a response and where the user response is automatically encoded and uploaded over a data network to a remote stored database.

11. The method of any of claim 1 further comprising:

determining that the database does not contain rules that have been tampered with.

12. The method of claim 1 further comprising pending the write request into a queue and processing the contents in the queue in the order in which permission values are obtained.

13. The method of claim 1 further comprising determining whether the application code has been tampered with.

14. The method of claim 13 further comprising

blocking write access to the data storage device by the application if the application has been determined to be tampered with, where such blocking occurs even if the rule associated with the application would normally permit the write access.

15. A computer readable hardware device containing digital data that, when loaded into a computer and executed as a program, causes the computer to execute the method of claim 1.

16. In a computer comprising a mass data storage device and an application running on said computer in conjunction with an operating system that manages access to said data storage device, a method of controlling write access to said data storage device by said application comprising:

detecting using a process operating in kernel mode monitoring file system access an attempt by the application to write data of a designated file type to said

data storage device;

in response to said attempt, retrieving a permission value from a database comprised of data elements encoding at least one permission value associated with the application; and

controlling write access to the data storage device by the application in dependence on said permission value.

17. The method of claim 16 further comprising:

inspecting the data to determine if the data is of a type consistent with the designated file type; and

further controlling write access to the data storage device by the application in dependence on the result of the inspection step.

18. The method of claim 17 with the additional step of receiving into said computer at least one datum that relates a name of the application to at least one associated file type that has a permission value for the application to write said file type.

19. The method of claim 17 where the permission value is independent of a directory in the file structure on the data storage device where the application is attempting to write.

20. The method of claim 17 further comprising prompting a user to input what permission value should apply to the attempted write access to the data storage device.

21. The method of claim 17 wherein the permission value encodes one of a plurality of levels, the levels comprised of a first level in which no write access is allowed, a second level in which full write access is allowed, and a third level in which write access is only allowed for at least one of a specified file type.

22. The method of claim 17 where the permission values are stored in a database that pre-exists the installation of an application on the computer that executes the method.

23. The method of claim 17 where write access is denied if no permission value corresponding to the application is found in the database.

24. The method of claim 17 where the controlling step blocks write access if the data is a portable executable file.

25. The method of claim 17 further comprising the step of automatically uploading the at least one permission value from said computer to an additional computer over a data communications network.

26. The method of claim 17 further comprising the step of:

in response to a determining that there is no locally stored permission value for the application, downloading from an additional computer over a data communications network at least one permission value that is added to the database.

27. The method of claim 17 further comprising:

receiving a rule from a database stored on a remote server operatively connected to said computer by means of a data communication network in response to a query from said computer automatically generated as a result of a determination that said computer does not have such a rule for an application.

28. The method of claim 16 where the permission value is independent of a directory where the application is attempting to write.

29. The method of claim 16 further comprising prompting a user to input what permission value should apply to the attempted write access.

30. The method of claim 16 in wherein the permission value encodes one of a plurality of levels, the levels comprised of a first level in which no write access is allowed, a second level in which full write access is allowed, and a third level in which write access is only allowed to write data of at least one of a specified file type.

31. The method of claim 16 where the permission values are stored in a data structure that pre-exists the installation of the running application on the computer that executes the method.

32. The method of claim 16 where write access is denied if no permission value corresponding to the application is found in the database.

33. The method of claim 16 with the further step of generating a prompt on a user interface on said computer requesting response from a user, accepting such response, and using such response to generate a permission value, and updating the database so that future attempt by such application shall be treated in accordance with the generated permission value.

34. The method of claim 33 where the user can respond to the prompt by choosing from a number of possible responses, the possible responses comprising a first response for allowing write access, a second response for blocking write access and a third response for allowing write access of a specific file type.

35. The method of claim 33 in which the user can respond further by selecting from a plurality of further actions, the further actions comprised of:

storing the chosen response in the rules database.

36. The method of claim 16 with the additional step of:

in response to determining that no such permission value resides in the database, transmitting a request for the permission value to a remote computer operatively connected to the computer by means of a data network and receiving into said computer at least one additional permission value and storing said at least one additional permission value entry into the database stored on said computer.

37. The method of claim 16 where the controlling step blocks write access if the data is a portable executable file.

38. The method of claim 16 further comprising the step of automatically uploading at least one permission value associated with said application from said computer to an additional computer over a data communications network.

39. The method of claim 16 further comprising the step of

in response to determining that a required permission value is not present in the database, downloading from an additional computer over a data communications network at least one permission value that is added to the database.

40. The method of claim 16 where the database is stored on a remote server operatively connected to said computer by means of a data communication network.

41. A system for controlling write access to a first mass data storage device by at least one application running on a first computer system operatively connected to said first data storage device comprising:

A first rules database stored on the first computer system comprised of at least

one application identifier and at least one corresponding permission value; and

An interceptor module operating as a kernel mode process monitoring file system access on the first computer system that monitors the at least one application operating distinct from the interceptor process, where upon a write access attempt to the first mass data storage device by the at least one running application, the interceptor module controlling the write access in dependency on a permission value corresponding to the at least one application attempting the write access, where the permission value is independent of the destination directory of the attempted write.

42. The system of claim 41 further comprising a manager module operating on the first computer system that manages the contents of the first rule database.

43. The system of claim 42 where the manager module operating on the first computer system is operatively connected over one or more computer networks to a second rule database stored on a second computer system comprised of at least one application identifier and at least one corresponding permission value where the manager module is enabled to automatically update the contents of the second rule database incrementally by transmitting data over a data network from the first rule database.

44. The system of claim 43 where the second rule database stored on a second computer system is operatively connected over one or more computer networks to a corresponding plurality of manager modules operating on a plurality of corresponding computer systems.

45. The system of claim 42 further comprising an input and output interface module that enables a user of the first computer system to modify the first rule database.

46. The system of claim 43 further comprising an input and output interface module that enables a user of the first computer system to modify the second rule database by inputting a permission value into the first computer and the first computer automatically transmitting that value to the second rule database.

47. The system of claim 43 where the second rule database is further comprised of permission values that, when operated on by the interceptor module cause the interceptor to perform at least one of the operations:

allow write access, block write access, allow write access of a specified file type.

48. The system of claim 43 where the specified file type is an executable file type and the corresponding permission value denies access to the data storage device to write an executable file.

49. The system of claim 43 where the second database is further comprised of at least one signature value corresponding to the at least one application identifier.

50. The system of claim 43 where the second database is further comprised of at least one file type value corresponding to the at least one application identifier.

51. The system of claim 41 where the first rule database is encrypted.

52. The system of claim 41 where the first rule database is further comprised of permission values that, when operated on by the interceptor module cause the interceptor to perform at least one of the operations:

allow write access, block write access, allow write access to a specified file type.

53. The system of claim 52 where the specified file type is an executable file type and the corresponding permission value denies write access to the data storage device to store the executable file type.

54. The system of claim 41 where the first database is further comprised of at least one signature value corresponding to the at least one application identifier.

55. The system of claim 41 where the first database is further comprised of at least one file type value corresponding to the at least one application identifier.

56. A system for maintaining from a central server a plurality of remote rule databases running on a plurality of corresponding remote computers operatively connected by a data communication network to the central server, each remote rule database comprised of at least one permission value designating permission to write to a mass data storage device associated with at least one application comprising:

A central rule database residing on the central server, said central rule database comprised of at least one data element, said element comprised of at least two entries, the first being an application identifier and the second at least one permission value associated with said application designating permission to write to a mass data storage device;

A module that receives from the plurality of remote computers requests for permission values corresponding to application identifiers, said request being comprised of at least one application identifier, where the owners of at least two of the plurality of remote computers are different; and

A module that transmits the requested permission values retrieved from the central rule database to the requesting remote computers in order to cause a process operating on the requesting remote computer in kernel mode that monitors file system access to permit or deny access based on the transmitted permission values.

57. The system of claim 56 where the plurality of remote rule databases are encrypted.

58. The system of claim 56 where the at least one data element

is further comprised of at least one signature associated with the at least one application.