Method and system to protect software-based network-connected devices from advanced persistent threat

• US 9,954,871 B2
• Filed: 05/06/2015
• Issued: 04/24/2018
• Est. Priority Date: 05/06/2015
• Status: Active Grant

• Current Assignee: Hand Held Products Incorporated (Honeywell International Inc.)
• Original Assignee: Hand Held Products Incorporated (Honeywell International Inc.)
• Inventors: Hussey, Robert Michael, Figwer, Kai J.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US14/705,407
• Publication Number:
  US 20160330218A1
• Time in Patent Office: 1,084 Days
• Field of Search: 726 22- 24, 726 26- 30, 713187-188, 709224
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method of protecting a network-connected device from an advanced persistent threat cyber-attack is provided. A network-connected device having an operating system, a memory, memory instructions holding executable program instructions, and being communication enabled, is protected from an advanced persistent threat by steps of detecting the advanced persistent threat due to the presence of rogue software in the memory instructions of the network-connected device and locking-down the communications of the network-connected device. The network-connected device may be provided with low-level routines that are correlated to the memory instructions. Detecting the advanced persistent threat may be comprised of authenticating the memory instructions of the network-connected device by using the installed low-level routines.

Claims

1. A method of protecting a network-connected device from an advanced persistent threat cyber-attack, the network-connected device having an operating system, a memory, memory instructions holding executable program instructions, and being communication enabled, comprising the steps of:

authenticating the executable program instructions of the network-connected device using installed routines, the routine installed at a low level of the network device and being correlated to the memory instructions;

detecting the advanced persistent threat due to the presence of rogue software in the memory instructions of the network-connected device by running the routines prior to the device running the executable program instructions; and

locking-down the communications of the network-connected device when rogue software is detected.

2. The method of claim 1, wherein the routines are computing checksum blocks routines;

and the authenticating step comprises;

generating checksums for the memory instructions before the network-connected device is deployed for the first time; and

comparing the checksum block routines to the checksums for the memory instructions.

3. The method of claim 2, wherein the generating step is accomplished when the memory instructions are loaded into the memory.

4. The method of claim 2, wherein the generating step is accomplished prior to executing the instructions for the first time.

5. The method of claim 2, wherein the low level of the network-connected device is part of the operating system.

6. The method of claim 5, further comprising the step of installing the checksum block routines when the operating system is installed.

7. The method of claim 5, further comprising the step of installing the checksum block routines into the operating system before the network-connected device is deployed for the first time.

8. The method of claim 2, wherein the locking-down step is initiated if the checksums for the memory instructions are not authenticated by the checksum block routines in the comparing step.

9. The method of claim 2, further comprising the step of:

protecting the checksum block routines from unauthorized changes.

10. A system for protecting a network-connected device from an advanced persistent threat cyber-attack, the network-connected device being wireless communication enabled and having an operating system, a central processing unit, a memory, executable program instructions loaded into the memory;

the operating system, central processing unit, memory and executable program instructions being communicatively linked;

the system comprising;

routines installed in a low-level of the network-connected device, the routines being correlated to the executable program instructions before the network-connected device is deployed for the first time;

the central processing unit being configured to allow the routines to authenticate the executable program instructions before the central processing unit executes the program instructions;

the routines being configured to lock-down communications between the network-connected device and other devices if the routine finds instructions in the memory which do not correlate to the executable program instructions in the memory.

11. The system of claim 10, further comprising:

checksums generated for the executable programs in the memory, and wherein the routines are computing checksum block routines, the checksum block routines being configured to authenticate the checksums in the executable programs.

12. The system of claim 11, further comprising a security scheme to protect the checksum block routines.

13. The system of claim 12, wherein the security scheme is a public key and private key cryptography.

14. The system of claim 12, wherein the security scheme is a two-factor scheme, the two-factor authentication requiring that a notification be sent to a party responsible for the network-connected device before any changes in the memory instructions or the checksums can be made.

15. The system of claim 10, wherein the central processing unit is configured to allow the routines to authenticate all the executable program instructions in the memory before the central processing unit executes the program instructions.

16. The system of claim 10, further comprising diagnostic routines configured to run on the network-connected device when in communications lock-down, the diagnostic routines being configured to identify details of the advanced persistent threat cyber-attack.

17. The system of claim 10, further comprising updating routines configured to run on the network-connected device when in communications lock-down, the updating routines being configured to update the executable program instructions to a pre-advanced persistent threat cyber-attack state.

18. The system of claim 10, further comprising an alert indicator, the alert indicator being communicatively linked to the routines, the alert indicator being initialized when the routines lock-down the network-connected device.

19. The system of claim 18, wherein the alert indicator is selected from an audio alarm and a visual indicator.