Security system and methodology for providing indirect access control

• US 6,850,943 B2
• Filed: 05/08/2003
• Issued: 02/01/2005
• Est. Priority Date: 10/18/2002
• Status: Active Grant

• Current Assignee: Check Point Software Technologies Incorporated (Check Point Software Technologies Limited)
• Original Assignee: Check Point Software Technologies Incorporated (Check Point Software Technologies Limited)
• Inventors: Carr, Christopher, Teixeira, Steven L.
• Primary Examiner(s): Mizrahi, Diane D.
• Application Number:
  US10/249,803
• Publication Number:
  US 20040078591A1
• Time in Patent Office: 635 Days
• Field of Search: 707/10, 707/102, 707/100, 707/103.R, 707/4, 709/219, 709/201, 709/203, 709/207, 709/217, 709/225, 709/227, 709/228, 709/231, 709/236, 717/101, 717/102, 717/108, 717/126, 718/101, 713/201, 714/38, 714/48, 714/49, 345/764, 706/50
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system providing methods for indirect access control is described. When an attempt to access a network by a first application is detected, a determination is made as to whether at least one other application is attempting indirect network access through the first application. If at least one other application is determined to be attempting indirect network access, each such other application is evaluated to determine if it is approved for network access. If each such other application is approved for network access, access to the network is permitted. Otherwise, access to the network is denied.

Claims

1. A method for control of indirect access to a network, the method comprising:

detecting an attempt to access a network from a first application;

determining whether at least one other application is attempting indirect network access through said first application;

if at least one other application is determined to be attempting indirect network access, evaluating whether each said at least one other application is approved for network access;

if each said at least one other application is approved for network access, permitting access to the network by said first application; and

otherwise, denying access to the network.

2. The method of claim 1, wherein said detecting step includes trapping requests for network access.

3. The method of claim 1, wherein said determining step includes tracking requests for creation of a new process.

4. The method of claim 3, wherein said tracking step include determining parent processes of the new process.

5. The method of claim 4, wherein determining parent processes includes collecting information about said parent processes.

6. The method of claim 1, wherein said determining step includes tracking launching of an application by another application.

7. The method of claim 6, wherein launching of an application includes launching as a Component Object Model (COM) server.

8. The method of claim 6, wherein said tracking step includes collecting information about Component Object Model (COM) client-server relationships.

9. The method of claim 1, wherein said evaluating step includes applying a security policy for determining whether each said at least one other application is approved for network access.

10. The method of claim 9, wherein said security policy specifies which applications are allowed network access.

11. The method of claim 9, wherein said security policy specifies particular types of network access which are allowed.

12. The method of claim 1, wherein said evaluating step includes determining whether each said at least one other application is a trusted application.

13. The method of claim 1, wherein said evaluating step includes obtaining user input as to whether an application should be allowed network access.

14. The method of claim 1, wherein said attempt to access a network comprises an attempt to access the Internet.

15. The method of claim 1, wherein said denying step includes using a “

firewall”

application for selectively blocking network access.

16. A computer-readable medium having computer-executable instructions for performing the method of claim 1.

17. A downloadable set of computer-executable instructions for performing the method of claim 1.

18. In a computer system, a method for controlling indirect access to a network, said indirect access comprising access by a program to a network through at least one other program, the method comprising:

in response to launching of a first program by a second program, collecting relationship information about the first program and second program;

in response to an attempt to access a network by a given program, generating a list of programs indirectly accessing the network through the given program based upon the collected relationship information;

determining whether each program on said list is trusted under a security policy governing access to the network; and

if a program on said list is determined not to be trusted, denying access to the network.

19. The method of claim 18, wherein said collecting step includes the substeps of:

detecting creation of new processes; and

collecting information about parent-child process relationships.

20. The method of claim 18, wherein said collecting step includes the substeps of:

detecting creation of Component Object Model (COM) client-server relationships; and

collecting information about COM client-server relationships.

21. The method of claim 18, wherein said network comprises the Internet.

22. The method of claim 18, wherein said list of programs comprises a parent-child process chain.

23. The method of claim 18, wherein said list of programs comprises a chain of Component Object Model (COM) client-server relationships.

24. The method of claim 18, wherein said determining step includes determining whether each program in said list is known.

25. The method of claim 18, wherein said determining step includes determining whether any program in said list is not trusted.

26. The method of claim 18, wherein said determining step includes asking a user whether to permit access by a given program.

27. The method of claim 18, wherein said security policy includes a list of programs permitted to access the network.

28. The method of claim 18, wherein said security policy includes a list of programs not permitted to access the network.

29. The method of claim 18, wherein said security policy includes enforcement rules governing access to at least one network.

30. A computer-readable medium having computer-executable instructions for performing the method of claim 18.

31. A downloadable set of computer-executable instructions for performing the method of claim 18.

32. A system for regulating indirect access to resources, the system comprising:

a security policy governing access to resources;

a driver module for detecting creation of a new process and invoking a supervisor module;

a supervisor module for identifying all parent processes of the newly created process; and

an enforcement module for determining whether to permit access to resources based, at least in part, upon the identified parent processes and the security policy governing access to resources.

33. The system of claim 32, wherein creation of a new process includes a first application launching a second application as a Component Object Model (COM) server.

34. The system of claim 32, wherein said driver module detects launching of an application by another application.

35. The system of claim 32, wherein identifying parent process by said supervisor module includes identifying Component Object Model (COM) client-server relationships.

36. The system of claim 32, wherein said enforcement module determines whether each identified parent process is approved for access to the resources under the security policy.

37. The system of claim 32, wherein said security policy specifies particular applications which are allowed to access the resources.

38. The system of claim 32, wherein said security policy specifies particular applications which are not allowed to access the resources.

39. The system of claim 32, wherein said security policy specifies which particular resources which may be accessed.

40. The system of claim 32, wherein said enforcement module obtains user input as to whether to allow access to the resources.

41. The system of claim 32, wherein the resources include a network.

42. The system of claim 32, further comprising:

a firewall module for selectively blocking access to the resources.