Temporary process deprivileging

• US 9,723,006 B2
• Filed: 06/27/2015
• Issued: 08/01/2017
• Est. Priority Date: 06/27/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Zhang, Zheng, Merrill, Clint R., Mehta, Kunal, Teddy, John D., Schmugar, Craig D., Aktas, Erdem
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US14/752,902
• Publication Number:
  US 20160381024A1
• Time in Patent Office: 766 Days
• Field of Search: None
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

There is disclosed in an example a computing apparatus, including: a process deprivilging engine operable for: recognizing that a process has an undetermined reputation; intercepting a first access request directed to a first resource; determining that the first resource is not owned by the process; and at least partially blocking access to the first resource. There is further disclosed a method of providing the process deprivileging engine, and one or more computer-readable mediums having stored thereon executable instructions for providing the process deprivileging engine.

Claims

1. A computing apparatus, comprising:

a process deprivileging engine operable for;

recognizing that a process has an undetermined reputation;

intercepting a first access request by the process directed to a first resource;

determining that the first resource is not owned by the process; and

based at least in part on the undetermined reputation and the determination that the first resource is not owned by the process, at least partially blocking access to the first resource.

2. The computing apparatus of claim 1, wherein the process deprivileging engine is further operable for:

intercepting a second access request directed to a second resource;

determining that the second resource is owned by the process; and

permitting access to the second resource.

3. The computing apparatus of claim 1, wherein the process deprivileging engine is further operable for:

intercepting a third access request directed to a third resource;

determining that the third resource is owned by a user owning the process, and that the resource is not owned by the process; and

permitting read-only access to the third resource.

4. The computing apparatus of claim 1, wherein the process deprivileging engine is further operable for determining that the first access request is a safe access, and restoring privileges to the process.

5. The computing apparatus of claim 1, wherein the process deprivileging engine is further operable for determining that the first access request is an auto-blocked access, and terminating the process.

6. The computing apparatus of claim 1, wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving an affirmative response, and restoring privileges to the process.

7. The computing apparatus of claim 1, wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving a negative response, and terminating the process.

8. One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions for providing a deprivileging engine operable for:

recognizing that a process has an undetermined reputation;

intercepting a first access request by the process directed to a first resource;

determining that the first resource is not owned by the process; and

based at least in part on the undetermined reputation and the determination that the first resource is not owned by the process, at least partially blocking access to the first resource.

9. The one or more tangible, non-transitory computer-readable storage mediums of claim 8, wherein the process deprivileging engine is further operable for:

intercepting a second access request directed to a second resource;

determining that the second resource is owned by the process; and

permitting access to the second resource.

10. The one or more tangible, non-transitory computer-readable storage mediums of claim 8, wherein the process deprivileging engine is further operable for:

intercepting a third access request directed to a third resource;

determining that the third resource is owned by a user owning the process, and that the resource is not owned by the process; and

permitting read-only access to the third resource.

11. The one or more tangible, non-transitory computer-readable storage mediums of claim 8, wherein the process deprivileging engine is further operable for determining that the first access request is a safe access, and restoring privileges to the process.

12. The one or more tangible, non-transitory computer-readable storage mediums of claim 8, wherein the process deprivileging engine is further operable for determining that the first access request is an auto-blocked access, and terminating the process.

13. The one or more tangible, non-transitory computer-readable storage mediums of claim 8, wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving an affirmative response, and restoring privileges to the process.

14. The one or more tangible, non-transitory computer-readable storage mediums of claim 8, wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving a negative response, and terminating the process.

15. A computer-implemented method of providing a process deprivileging engine, comprising:

recognizing that a process has an undetermined reputation;

intercepting a first access request by the process directed to a first resource;

determining that the first resource is not owned by the process; and

based at least in part on the undetermined reputation and the determination that the first resource is not owned by the process, at least partially blocking access to the first resource.

16. The computer-implemented method of claim 15, further comprising:

intercepting a second access request directed to a second resource;

determining that the second resource is owned by the process; and

permitting access to the second resource.

17. The computer-implemented method of claim 15, further comprising:

intercepting a third access request directed to a third resource;

determining that the third resource is owned by a user owning the process, and that the resource is not owned by the process; and

permitting read-only access to the third resource.

18. The computer-implemented method of claim 15, further comprising determining that the first access request is a safe access, and restoring privileges to the process.

19. The computer-implemented method of claim 15, further comprising determining that the first access request is an auto-blocked access, and terminating the process.

20. The computer-implemented method of claim 15, further comprising prompting a user for a verification input, receiving an affirmative response, and restoring privileges to the process.

21. The computer-implemented method of claim 15, further comprising prompting a user for a verification input, receiving a negative response, and terminating the process.