Reactive anti-tampering system for protected services in an enterprise computing system

• US 8,756,594 B2
• Filed: 10/28/2011
• Issued: 06/17/2014
• Est. Priority Date: 10/28/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Zeitlin, Eli, Borshack, Ronen, Umansky, Alex
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US13/283,635
• Publication Number:
  US 20130111462A1
• Time in Patent Office: 963 Days
• Field of Search: 717124-129, 717/176, 717170-175, 709203-204
• US Class Current: 717/174
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

An enterprise computing system may utilize a management infrastructure that interacts with protected services in the system. The management infrastructure accepts requests through an anti-tamper procedure that specifies a tamper event, a crucial service to be protected, and a remedial action that may be applied when the tamper event occurs on the protected service. The anti-tamper procedure may be created by a system administrator and distributed to one or more client devices in the system. The management infrastructure monitors a protected service in accordance with the operations and actions specified in the anti-tamper procedure thereby ensuring that the integrity of the system is preserved.

Claims

1. A method implemented on a client device having at least one processor, comprising:

receiving a request to monitor for occurrence of a tamper event affecting a protected service executing on the client device, the protected service including an instance of a program that provides a function critical for operation of the client device, the request distributed by a system administrator, the request comprising a remedial action for remedying the tamper event and a provider that provides data from the protected service, the client device part of an enterprise computing system having multiple client devices;

utilizing a management infrastructure to monitor the protected service for an occurrence of a tamper event through data received from the provider and to initiate a remedial action in response to detecting occurrence of the tamper event, wherein the provider communicates directly with the protected service;

receiving data from the provider that indicates that the tamper event has occurred at the protected service; and

applying the remedial action to the protected service,

wherein the tamper event, the protected service and the remedial action are specified through executable instructions.

2. The method of claim 1, wherein the management infrastructure is Windows Management Instrumentation.

3. The method of claim 1, wherein the tamper event is a removal of a protected service and the remedial action is to install the protected service.

4. The method of claim 1, wherein the tamper event stops a protected service and the remedial action restarts the protected service.

5. The method of claim 1, wherein the tamper event changes a service configuration of a protected service and the remedial action restores the service configuration of the protected service to an original state.

6. The method of claim 1, wherein the tamper event deletes a file associated with a protected service and the remedial action restores the file.

7. The method of claim 1, wherein the tamper event uninstalled an application associated with a protected service and the remedial action installs the application.

8. The method of claim 1, wherein the tamper event alters security properties of a protected service and the remedial action restores the security properties to an original state.

9. The method of claim 1, wherein the tamper event and the remedial action are defined through a script file.

10. A computer-readable storage medium storing thereon processor-executable instructions, that when executed perform actions, the actions comprising:

receiving a request to monitor a protected service, the protected service providing a critical function, the request distributed by a system administrator, the request comprising a remedial action for remedying an event and a provider that provides data from the protected service;

utilizing a management infrastructure to monitor the protected service for an occurrence of an event through data received from the provider and to initiate a remedial action in response to detecting occurrence of the event, wherein the provider communicates directly with the protected service;

receiving data from the provider that indicates that the event has occurred at the protected service; and

applying the remedial action to the protected service,

wherein the event, the protected service and the remedial action are specified through executable instructions.

11. A computer-readable storage medium of claim 10, wherein the event affects execution of a protected service, wholly or in part, and the remedial action restores execution of the protected service.

12. A computer-readable storage medium of claim 10, wherein the event alters a service configuration of a protected service and the remedial action restores the service configuration to an original state.

13. A computer-readable storage medium of claim 10, wherein the event affects a process associated with a protected service and the remedial action reactivates the process.

14. A computer-readable storage medium of claim 10, wherein the event changes security properties associated with a protected service and the remedial action restores the security properties to an original state.

15. A computer-readable storage medium of claim 10, wherein the event uninstalls an application associated with a protected service and the remedial action installs the application.

16. A system, comprising:

at least one processor and a memory;

the memory including;

a management infrastructure, having a programming interface that interacts with a protected service, the protected service comprising an instance of a program that provides a function critical for operation of the client device;

a script file having a first set of executable instructions that requests the management infrastructure to monitor the protected service for occurrence of an event, a second set of executable instructions that specify a remedial action that the management infrastructure performs on a protected service, and a provider that obtains data from the protected service; and

a plurality of providers, each provider coupled to the management infrastructure and a protected service, the provider configured to receive instructions from the management infrastructure and to provide data in response to instructions,

wherein the management infrastructure monitors the protected service through data obtained from at least one select provider.

17. The system of claim 16, wherein the first set of executable instructions request the management infrastructure to monitor stoppage of the protected service and the second set of executable instructions restart the protected service.

18. The system of claim 16, wherein the first set of executable instructions request the management infrastructure to monitor for removal of the protected service and the second set of executable instructions install the protected service.

19. The system of claim 16, wherein the first set of executable instructions request the management infrastructure to monitor for alteration of a feature of the protected service and the second set of executable instructions restore the protected service to an original state.