System and method for protecting cloud services from unauthorized access and malware attacks

• US 8,661,547 B1
• Filed: 04/18/2013
• Issued: 02/25/2014
• Est. Priority Date: 12/25/2012
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Kononov, Eldar M., Lapushkin, Anton S., Efremov, Andrey A.
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US13/866,006
• Time in Patent Office: 313 Days
• Field of Search: 726/5, 726/24, 726/29, 713/176, 713/188
• US Class Current: 726/24
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Disclosed are systems, methods and computer program products for protecting cloud security services from unauthorized access and malware attacks. In one example, a cloud server receives one or more queries from security software of the user device. The server analyzes a system state and configuration of the user device to determine the level of trust associated with the user device. The server also analyzes the one or more queries received from the security software to determine whether to update the level of trust associated with the user device. The server determines, based on the level of trust, how to process the one or more queries. Finally, the server provides responses to the one or more queries from the security software based on the determination of how to process the one or more queries.

Claims

1. A method for processing queries from a user device by a server, comprising:

receiving, by the server, from a security software deployed on a user device, a system state and configuration information of the user device;

analyzing, by the server, the collected system state and configuration information to determine a level of trust associated with the user device;

receiving, by the server, one or more queries from a security software of the user device directed to one or more services provided by the server, wherein the security software is configured to follow different procedures for contacting different services;

analyzing the one or more queries received from the security software to determine whether the security software followed a correct procedure for contacting one or more services, wherein the correct procedure includes contacting different services in a specific order;

based on the determination of whether the security software followed a correct or incorrect procedure for contacting the server, determining whether to update or not update the level of trust associated with the user device;

determining, based on the level of trust, how to process the one or more queries; and

providing different responses to the one or more queries from the security software based on the determination of how to process the one or more queries.

2. The method of claim 1, wherein analyzing a system state and configuration information of the user device further includes checking for one or more of:

execution of various OS processes and services on the user device;

periodic rebooting or updating of the OS of the user device;

installation, execution or deletion of programs on the user device;

Internet browsing activity on the user device;

installations and updates of the security software of the user device;

keystrokes, mouse clicks and mouse movements on the user device; and

movements of a user via a webcam of the user device.

3. The method of claim 1, wherein analyzing the one or more queries received from the security software further includes checking for changes in the state and configuration of the user device in a predefined time period since the last system state and configuration analysis of the user device to determine whether to update or not the level of trust of the user device.

4. The method of claim 1, wherein analyzing the one or more queries received from the security software further includes checking for changes in the location of the user device in a predefined time period to determine whether to update or not the level of trust of the user device.

5. The method of claim 1, wherein analyzing the one or more queries received from the security software further includes:

assigning a unique identifier to the user device with security software deployed thereon;

checking whether a query from the security software includes an encrypted unique identifier associated with the user device and a hash sum of the data contained in the query;

decrypting the unique identifier and verifying that the decrypted unique identifier is associated with the user device from which the query was received;

computing a hash sum of the data contained in the received query and comparing the computed hash sum of the received data with the hash sum included in the received query to determine whether the data contained in the query was modified; and

determining based on the results of the verification of the unique identifier and comparison of the hash sums whether to update or not the level of trust of the user device.

6. The method of claim 1, wherein determining, based on the level of trust, how to process the one or more queries includes performing one or more of:

rejecting one or more queries from the security software;

processing the data contained in a query using a file reputation service and sending a response with the results of file reputation analysis to the security software;

processing the data contained in a query using a whitelist service and sending a response with the results of whitelist analysis to the security software;

processing the data contained in a query using a statistics service and sending a response with the results of statistics analysis to the security software;

processing the data contained in a query using an anti-spam service and sending a response with the results of anti-spam analysis to the security software; and

providing an update to the security software of the user device.

7. A system for processing queries from a user device by a server, the system comprising;

a hardware processor configured to;

receive from a security software deployed on a user device, a system state and configuration information of the user device;

analyze, the collected system state and configuration information to determine a level of trust associated with the user device;

receive one or more queries from a security software of the user device directed to one or more services provided by the server, wherein the security software is configured to follow different procedures for contacting different services;

analyze the one or more queries received from the security software to determine whether the security software followed a correct procedure for contacting one or more services, wherein the correct procedure includes contacting different services in a specific order;

based on the determination of whether the security software followed a correct or incorrect procedure for contacting the server, determine whether to update or not update the level of trust associated with the user device;

determine, based on the level of trust, how to process the one or more queries; and

provide different responses to the one or more queries from the security software based on the determination of how to process the one or more queries.

8. The system of claim 7, wherein to analyze a system state and configuration information of the user device, the processor further configured to perform check for one or more of:

execution of various OS processes and services on the user device;

periodic rebooting or updating of the OS of the user device;

installation, execution or deletion of programs on the user device;

Internet browsing activity on the user device;

installations and updates of the security software of the user device;

keystrokes, mouse clicks and mouse movements on the user device; and

movements of a user via a webcam of the user device.

9. The system of claim 7, wherein to analyze the one or more queries received from the security software, the processor further configured to check for changes in the state and configuration of the user device in a predefined time period since the last system state and configuration analysis of the user device to determine whether to update or not the level of trust of the user device.

10. The system of claim 7, to analyze the one or more queries received from the security software, the processor further configured to check for changes in the location of the user device in a predefined time period to determine whether to update or not the level of trust of the user device.

11. The system of claim 7, to analyze the one or more queries received from the security software, the processor further configured to:

assign a unique identifier to the user device with security software deployed thereon;

check whether a query from the security software includes an encrypted unique identifier associated with the user device and a hash sum of the data contained in the query;

decrypt the unique identifier and verify that the decrypted unique identifier is associated with the user device from which the query was received;

compute a hash sum of the data contained in the received query and compare the computed hash sum of the received data with the hash sum included in the received query to determine whether the data contained in the query was modified; and

determine based on the results of the verification of the unique identifier and comparison of the hash sums whether to update or not the level of trust of the user device.

12. The system of claim 7, wherein to determine, based on the level of trust, how to process the one or more queries, the processor configured to performing one or more of:

reject one or more queries from the security software;

process the data contained in a query using a file reputation service and send a response with the results of file reputation analysis to the security software;

process the data contained in a query using a whitelist service and send a response with the results of whitelist analysis to the security software;

process the data contained in a query using a statistics service and send a response with the results of statistics analysis to the security software;

process the data contained in a query using an anti-spam service and send a response with the results of anti-spam analysis to the security software; and

provide an update to the security software of the user device.

13. A computer program product embedded in a non-transitory computer-readable storage medium, the computer program product comprising computer-executable instructions for processing queries from a user device by a server, including instructions for:

receiving, by the server, from a security software deployed on a user device, a system state and configuration information of the user device;

analyzing, by the server, the collected system state and configuration information to determine a level of trust associated with the user device;

receiving, by the server, one or more queries from a security software of the user device directed to one or more services provided by the server, wherein the security software is configured to follow different procedures for contacting different services;

analyzing the one or more queries received from the security software to determine whether the security software followed a correct procedure for contacting one or more services, wherein the correct procedure includes contacting different services in a specific order;

based on the determination of whether the security software followed a correct or incorrect procedure for contacting the server, determining whether to update or not update the level of trust associated with the user device;

determining, based on the level of trust, how to process the one or more queries; and

providing different responses to the one or more queries from the security software based on the determination of how to process the one or more queries.

14. The computer program product of claim 13, wherein instructions for analyzing a system state and configuration information of the user device include instructions for checking for one or more of:

execution of various OS processes and services on the user device;

periodic rebooting or updating of the OS of the user device;

installation, execution or deletion of programs on the user device;

Internet browsing activity on the user device;

installations and updates of the security software of the user device;

keystrokes, mouse clicks and mouse movements on the user device; and

movements of a user via a webcam of the user device.

15. The computer program product of claim 13, wherein instructions for analyzing the one or more queries received from the security software further include instructions for checking for changes in the state and configuration of the user device in a predefined time period since the last system state and configuration analysis of the user device to determine whether to update or not the level of trust of the user device.

16. The computer program product of claim 13, wherein instructions for analyzing the one or more queries received from the security software further include instructions for checking for changes in the location of the user device in a predefined time period to determine whether to update or not the level of trust of the user device.

17. The computer program product of claim 13, wherein instructions for determining, based on the level of trust, how to process the one or more queries, include instructions for one or more of:

rejecting one or more queries from the security software;

processing the data contained in a query using a file reputation service and sending a response with the results of file reputation analysis to the security software;

processing the data contained in a query using a whitelist service and sending a response with the results of whitelist analysis to the security software;

processing the data contained in a query using a statistics service and sending a response with the results of statistics analysis to the security software;

processing the data contained in a query using an anti-spam service and sending a response with the results of anti-spam analysis to the security software; and

providing an update to the security software of the user device.