System and method for the managed security control of processes on a computer system

• US 7,673,137 B2
• Filed: 01/03/2003
• Issued: 03/02/2010
• Est. Priority Date: 01/04/2002
• Status: Active Grant

• Current Assignee: Taasera Licensing LLC (Quest Patent Research Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Hackenberger, William Frank, Satterlee, Thomas James
• Primary Examiner(s): LaForgia; Christian
• Assistant Examiner(s): Jackson; Jenise E
• Application Number:
  US10/336,299
• Publication Number:
  US 20040025015A1
• Time in Patent Office: 2,615 Days
• Field of Search: 713164-165, 713/167, 726/14, 726/22, 726/24, 726/26
• US Class Current: 713/164
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Managing and controlling the execution of software programs with a computing device to protect the computing device from malicious activities. A protector system implements a two-step process to ensure that software programs do not perform malicious activities which may damage the computing device or other computing resources to which the device is coupled. In the first phase, the protector system determines whether a software program has been previously approved and validates that the software program has not been altered. If the software program is validated during the first phase, this will minimize or eliminate security monitoring operations while the software program is executing during the second phase. If the software program cannot be validated, the protector system enters the second phase and detects and observes executing activities at the kernel level of the operating system so that suspicious actions can be anticipated and addressed before they are able to do harm to the computing device.

Claims

1. A system for managing security of a computing device comprising:

a pre-execution module operable for receiving notice from the computing device'"'"'s operating system that a new program is being loaded onto the computing device;

a validation module coupled to the pre-execution monitor operable for determining whether the program is valid;

a detection module coupled to the pre-execution monitor operable for intercepting a trigger from the computing device'"'"'s operating system; and

an execution module coupled to the detection module and operable for monitoring, at the operating system kernel of the computing device, the program in response to the trigger intercepted by the detection module.

2. The system of claim 1, wherein the pre-execution module is further operable for suspending loading of the program onto the computing device.

3. The system of claim 1, wherein the pre-execution module is further operable for retrieving validation data.

4. The system of claim 1, wherein the execution module is further operable for deciding whether to terminate the trigger intercepted by the detection module.

5. The system of claim 1, wherein the execution module is further operable for retrieving authorization data and deciding how to respond to the trigger intercepted by the detection module.

6. A computer implemented method for implementing security for a computing device comprising the steps of:

interrupting the loading of a new program for operation with the computing device;

validating the new program;

if the new program is validated, permitting the new program to continue loading and to execute in connection with the computing device;

if the new program is not validated, monitoring the new program while it loads and executes in connection with the computing device, wherein the step of monitoring the new program while it executes is performed at the operating system kernel of the computing device.

7. The method of claim 6, wherein the step of interrupting the loading of a new program comprises:

intercepting a signal from the computing device'"'"'s operating system that the new program is loading, and

suspending the loading of the new program.

8. The method of claim 6, wherein the step of monitoring the new program comprises intercepting a signal from the computing device'"'"'s operating system.

9. The method of claim 6, wherein the step of validating the new program comprises determining whether the new program corresponds with an approved program.

10. The method of claim 6, wherein the step of validating the new program comprises comparing a checksum for the new program with a previously determined checksum.

11. The method of claim 6, wherein the step of validating the new program comprises analyzing characteristics of the new program.

12. The method of claim 6, wherein the step of monitoring the new program comprises controlling the files the new program attempts to access during execution of the new program.

13. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 6.

14. A computer-implemented method for implementing security for a computing device, comprising the steps of:

identifying an allowed program that is permitted to execute on the computing device;

receiving a signal that a new program is going to be executed on the computing device;

suspending the execution of the new program on the computing device;

determining whether the new program is the same as the allowed program;

if the new program is the same as the allowed program, permitting the new program to execute on the computing device; and

if the new program is not the same as the allowed program, monitoring the new program while allowing it to execute on the computing device, wherein the step of monitoring the new program while allowing it to execute is performed at the operating system kernel of the computing device.

15. The method of claim 14, wherein the step of receiving a signal that a new program is going to be executed is performed at the operating system kernel of the computing device.

16. The method of claim 14, wherein the step of determining whether the new program is the same as the allowed program comprises:

computing a checksum for the new program, and

comparing the new program'"'"'s checksum to a checksum for the allowed program.

17. The method of claim 14, wherein the step of determining whether the new program is the same as the allowed program comprises determining whether the new program has been modified.

18. The method of claim 14, wherein the step of monitoring the new program while allowing it to execute comprises controlling the files the program attempts to access during execution of the new program on the computing device.

19. The method of claim 14, wherein the step of monitoring the new program while allowing to execute comprises controlling the registry settings the new program attempts to access during execution of the new program on the computing device.

20. The method of claim 14, wherein the step of monitoring the new program while allowing it to execute comprises controlling the network activity of the new program.

21. The method of claim 14, wherein the step of monitoring the new program while allowing it to execute comprises determining whether a user has previously approved operation of the new program.

22. The method of claim 14, further comprising the step of terminating the execution of the new program if the program performs suspicious activities.

23. The method of claim 14, further comprising the step of taking remedial measures to protect the security of other computing device components if the new program is not the same as the allowed program.

24. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 14.

25. A computer-implemented method for performing security for a computer device during a pre-execution phrase comprising the steps of:

identifying an allowed program that is permitted to execute with the computing device;

receiving a signal that a new program is being loaded for execution with the computing device;

suspending the loading of the new program;

comparing the new program to the allowed program; and

determining whether the new program is valid;

if the new program is valid, permitting the new program to execute on the computing device; and

if the new program is not valid, monitoring the new program while allowing it to execute on the computing device, wherein the step of monitoring the new program while allowing it to execute is performed at the operating system kernel of the computing device.

26. The method of claim 25, wherein the step of receiving a signal comprises receiving a signal from the computing device'"'"'s operating system kernel.

27. The method of claim 25, wherein the step of comparing the new program to the allowed program comprises comparing a checksum of the new program to a checksum of the allowed program.

28. The method of claim 25, wherein the step of determining whether the new program is valid comprises determining whether a checksum of the new program corresponds to a checksum of the allowed program.

29. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 25.