Kernel-based protection of computer processes

Abstract

The computer security device includes a kernel driver executed by a computer in kernel mode, the kernel driver configured to perform the steps of protecting a process of a first computer software application executed by the computer, the protecting step being performed based on a protection policy, receiving an instruction from the process to modify the protection policy, modifying the protection policy based on the instruction, and protecting the process based on the protection policy after modifying the protection policy based on the instruction.

Description

[Technical Field]

[0001] The present invention relates generally to computer security. [Background technology]

[0002] Modern computer operating systems typically maintain separate "user space" and "kernel space" areas of computer memory. Kernel space is accessed directly by an operating system component, whose main components are known as the "kernel," as well as by various kernel and hardware device drivers, when executed by the computer's central processing unit (CPU) in "kernel mode." User space memory is allocated to user processes, which are instances of software applications that are not operating system components, such as web browsers and word processing software, that are typically executed by the CPU in "user mode." Kernel space can be accessed by user processes only indirectly through the use of system calls, which are requests sent by the user process to the operating system, and such requests are for services performed by the kernel.

[0003] One common kernel task is to protect user processes and their associated resources by simply preventing access by other user processes. However, malicious actors use a variety of methods to violate computer security, so new computer security methods must be considered. Summary of the Invention

[0004] In one aspect of the present invention, a computer security method is provided, comprising the steps of: protecting a process of a first computer software application executed by a computer, the protecting step being performed based on a protection policy; receiving an instruction from the process to modify the protection policy; modifying the protection policy based on the instruction; and protecting the process based on the protection policy after modifying the protection policy based on the instruction, wherein the protecting step, the receiving step, and the modifying step are performed by a kernel driver executed by the computer.

[0005] In another aspect of the invention, any of the protecting, receiving, and modifying steps is performed after determining that a digital signature is valid, the digital signature being for an executable file of the first computer software application, and the determination being performed by the kernel driver executed by the computer.

[0006] In another aspect of the present invention, the protecting step includes the steps of detecting an attempt to access an object associated with the first computer software application by a process of a second computer software application executed by the computer; determining whether a digital signature is valid, the digital signature being of an executable file of the second computer software application; and allowing or preventing access to the object by the second computer software application based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid, and the detecting step, the determining step, the allowing step, and the preventing step are performed by the kernel driver executed by the computer.

[0007] In another aspect of the present invention, the protecting step includes the steps of receiving a decryption key from the process of the first computer software application; receiving a request to receive the decryption key from the process of the first computer software application; determining whether a digital signature is valid, the digital signature being of the first computer software application; and providing or not providing the decryption key to the process based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid, and the receiving step, the determining step, the allowing step, the providing step, and the not providing step are performed by the kernel driver executed by the computer.

[0008] In another aspect of the invention, the method further includes the steps of encrypting the decryption key after receiving the decryption key from the process of the first computer software application, and, if the digital signature is valid, decrypting the encrypted decryption key before providing the decryption key to the process of the first computer software application.

[0009] In another aspect of the invention, the protecting step includes the steps of receiving an encrypted message from the process of the first computer software application, the message being encrypted using a public key of a key pair; determining whether a digital signature is valid, the digital signature being for an executable file of the first computer software application; and, if the digital signature is valid, decrypting the encrypted message using a private key of the key pair, encrypting a response to the message using the private key, and providing the encrypted response to the process of the first computer software application, wherein the receiving, determining, decrypting, encrypting, and providing steps are performed by the kernel driver executed by the computer.

[0010] In another aspect of the present invention, a computer security apparatus is provided that includes a kernel driver executed by a computer in kernel mode, the kernel driver configured to perform the steps of protecting a process of a first computer software application executed by the computer, the protecting step being performed based on a protection policy, receiving an instruction from the process to modify the protection policy, modifying the protection policy based on the instruction, and protecting the process based on the protection policy after modifying the protection policy based on the instruction.

[0011] In another aspect of the present invention, the kernel driver is configured to perform any of the protecting step, the receiving step, and the modifying step after determining that a digital signature is valid, the digital signature being for an executable file of the first computer software application.

[0012] In another aspect of the present invention, the kernel driver is configured to perform the protection steps by detecting an attempt to access an object associated with the first computer software application by a process of a second computer software application executed by the computer; determining whether a digital signature is valid, the digital signature being of an executable file of the second computer software application; and allowing or preventing access to the object by the second computer software application based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid.

[0013] In another aspect of the present invention, the kernel driver is configured to perform the protection steps by steps of receiving a decryption key from the process of the first computer software application; receiving a request to receive the decryption key from the process of the first computer software application; determining whether a digital signature is valid, the digital signature being of the first computer software application; and providing or not providing the decryption key to the process based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid, and the receiving, determining, allowing, providing, and not providing steps are performed by the kernel driver executed by the computer.

[0014] In another aspect of the invention, the kernel driver is configured to encrypt the decryption key after receiving it from the process of the first computer software application, and, if the digital signature is valid, decrypt the encrypted decryption key before providing it to the process of the first computer software application.

[0015] In another aspect of the invention, the kernel driver is configured to perform the protecting step by receiving an encrypted message from the process of the first computer software application, the message being encrypted using a public key of a key pair; determining whether a digital signature is valid, the digital signature being for an executable file of the first computer software application; and, if the digital signature is valid, decrypting the encrypted message using a private key of the key pair, encrypting a response to the message using the private key, and providing the encrypted response to the process of the first computer software application.

[0016] In another aspect of the invention, the first computer software application is a web browser.

[0017] In another aspect of the invention, the object is a process or a thread of a process. [Brief explanation of the drawings]

[0018] Aspects of the present invention will be more fully understood and appreciated from the following detailed description read in conjunction with the accompanying drawings, in which:

[0019] [Figure 1] 1 is a simplified schematic diagram of a computer security system constructed and operative in accordance with one embodiment of the present invention; [Figure 2]2 is a simplified flowchart illustrating an exemplary method of operation of the system of FIG. 1 , operated in accordance with one embodiment of the present invention. [Figure 3] 2 is a simplified flowchart illustrating an exemplary method of operation of the system of FIG. 1 , operated in accordance with one embodiment of the present invention. [Figure 4] 1 is a simplified conceptual diagram of a computer security system constructed and operative in accordance with one embodiment of the present invention; [Figure 5] 5 is a simplified flowchart illustrating an exemplary method of operation of the system of FIG. 4. [Figure 6] 1 is a simplified conceptual diagram of a computer security system constructed and operative in accordance with one embodiment of the present invention; [Figure 7] 7 is a simplified flowchart illustrating an exemplary method of operation of the system of FIG. 6, operated in accordance with one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0020] Reference is now made to Figure 1, which is a simplified conceptual diagram of a computer security system constructed and operative in accordance with one embodiment of the present invention. Reference is also made to Figures 2 and 3, which are simplified flowcharts illustrating an exemplary method of operation of the system of Figure 1, operative in accordance with one embodiment of the present invention. In the system of Figure 1 and the methods of Figures 2 and 3, kernel driver 100 is configured to be executed by computer 102 in kernel mode, in accordance with conventional techniques, such as when computer 102 runs the Windows operating system commercially available from Microsoft Corporation of Redmond, Washington.

[0021] According to one embodiment of the present invention, kernel driver 100 is configured to protect process 104, which is an instance of computer software application 106 also executed by computer 102. In one embodiment, computer software application 106 is a software application that is not an operating system component, such as Enterprise Browser® available from Island Technology, Inc. of Dallas, Texas, or another web browser or word processing software. In another embodiment, computer software application 106 is an operating system component, such as a kernel driver or a hardware device driver. In one embodiment, kernel driver 100 is configured to determine that computer software application 106 is one of one or more specific computer software applications or one or more types of computer software applications for which kernel driver 100 is configured to protect processes.

[0022] Additionally, in accordance with one embodiment of the present invention, kernel driver 100 is configured to protect process 104 based on one or more protection policies, collectively referred to herein as protection policy 108. In one embodiment, protection policy 108 is pre-configured in kernel driver 100. In another embodiment, protection policy 108 is provided to kernel driver 100, such as by an administrator of process 104 or computer 102. Protection policy 108 may represent any type of protection known to be provided by any known operating system kernel or kernel driver for any process executed by a computer by, for example, controlling access to process 104 or any objects associated with process 104, such as its memory space, threads, handles, process environment settings, execution context, process and thread environment blocks, and loaded modules.

[0023] Additionally, according to one embodiment of the present invention, kernel driver 100 is configured to receive instructions 110, such as in the form of a system call, from process 104 to modify protection policy 108. In one example, protection policy 108 disallows requests by user processes other than process 104 to access locations in computer 102's memory assigned to process 104, such as memory locations where executable instructions for process 104 are stored and memory locations where process 104 stores data. Instructions 110 then indicate that this protection should be modified to allow the request by the particular user process to receive such access. Kernel driver 100 is further configured to modify protection policy 108 based on instructions 110, preferably after kernel driver 100 has determined, based on prior art techniques, that process 104 is authorized to provide such instructions. In one embodiment, kernel driver 100 determines that process 104 is so authorized by determining that digital signature 112 of computer software application 106 is valid, such as when computer software application 106 is an executable file that is executed by computer 102 to create process 104. The kernel driver 100 then modifies the protection policy 108 based on the instruction 110 and then continues to protect the process 104 based on the protection policy 108 .

[0024] In one embodiment, kernel driver 100 is configured to identify process 114 as an instance of a computer software application 116 that is also executed by computer 102, for the purpose of enabling kernel driver 100 to determine, based on protection policy 108, whether a request by process 114 to access process 104 or any object associated with process 104 should be granted. In one embodiment, kernel driver 100 is configured to determine that computer software application 116 is one of one or more specific computer software applications or one or more types of computer software applications that kernel driver 100 is configured to so evaluate. In one embodiment, kernel driver 100 is configured to determine whether a digital signature 118 of computer software application 116 is valid, such as when computer software application 116 is an executable file that is executed by computer 102 to create process 114, and protection policy 108 is based at least in part on whether the digital signature is valid. If computer 102 runs the Windows operating system, kernel driver 100 may be configured to monitor requests to access process and thread objects by registering callbacks with the OS object manipulation callback mechanism, for example, by using the ObRegisterCallbacks family of routines. Kernel driver 100 may be configured to specifically monitor accesses to PsProcessType and PsThreadType objects.

[0025]

[0033] Reference is now made to Fig. 4, which is a simplified conceptual diagram of a computer security system constructed and operative in accordance with one embodiment of the present invention. Reference is also made to Fig. 5, which is a simplified flowchart illustrating an exemplary method of operation of the system of Fig. 4, operating in accordance with one embodiment of the present invention. The system of Fig. 4 is substantially similar to the system of Fig. 1, except as otherwise described below. In the system and method of Fig. 4, kernel driver 100 is configured to protect process 104 by receiving a decryption key 400 from process 104, such as when process 104 uses decryption key 400 to decrypt data encrypted by process 104. Kernel driver 100 then encrypts decryption key 400, such as by using encryption / decryption key 402 generated by kernel driver 100 or obtained elsewhere, and returns encrypted decryption key 400, shown here as element 400', to process 104.

[0026] In one embodiment, kernel driver 100 stores encryption / decryption key 402 in a special registry key that is protected from access by unauthorized processes by kernel driver 100, in accordance with conventional techniques. If computer 102 runs a Windows® operating system, this may be done by registering kernel driver 100 as a registry filter driver using the kernel registry filtering infrastructure provided by the CmRegisterCallback family of routines, blocking access to the special registry key by any process except as requested by process 104 and as permitted by protection policy 108.

[0027] Subsequently, when process 104 desires to decrypt data that can be decrypted using decryption key 400, for example, process 104 sends encrypted decryption key 400′ to kernel driver 100 requesting its decryption, and kernel driver 100 then retrieves encryption / decryption key 402, decrypts encrypted decryption key 400′, and provides decrypted decryption key 400 to process 104. In this manner, process 104 does not need to maintain its own copy of decryption key 400. In one embodiment, kernel driver 100 determines whether digital signature 112 of process 104's executable file is valid, as described above, and then provides or does not provide decrypted decryption key 400 to process 104 based on protection policy 108, which is based at least in part on whether the digital signature is valid. In one embodiment, encryption / decryption key 402 includes separate encryption and decryption keys for encrypting and decrypting decryption keys 400 and 400′, respectively, in accordance with conventional techniques.

[0028] Reference is now made to Figure 6, which is a simplified conceptual diagram of a computer security system constructed and operative in accordance with one embodiment of the present invention. Reference is also made to Figure 7, which is a simplified flowchart illustrating an exemplary method of operation of the system of Figure 6, operative in accordance with one embodiment of the present invention. The system of Figure 6 is substantially similar to the system of Figure 1, except as otherwise described below. In the system and method of Figure 6, kernel driver 100 is configured to receive a message 600 from process 104, and message 600 is encrypted according to conventional techniques, such as by using public key 602 of key pair 604, which also includes private key 606, before kernel driver 100 receives message 600. Kernel driver 100 decrypts encrypted message 600, such as by using private key 606, encrypts a response 608, such as by using private key 606, and provides encrypted response 608 to process 104. In one embodiment, kernel driver 100 determines whether digital signature 112 of the executable file of process 104 is valid, as described above, and then provides or does not provide encrypted response 608 to process 104 based on protection policy 108, which is based at least in part on whether the digital signature is valid.

[0029] Any aspect of the invention described herein may be implemented in computer hardware and / or computer software embodied in a non-transitory computer-readable medium in accordance with conventional techniques, where the computer hardware includes one or more computer processors, computer memory, I / O devices, and network interfaces that interoperate in accordance with conventional techniques.

[0030] It should be understood that, as used herein, the term "processor" or "device" is intended to include any processing device, such as, for example, one that includes a CPU (Central Processing Unit) and / or other processing circuitry. It should also be understood that the term "processor" or "device" may refer to more than one processing device, and that various elements associated with a processing device may be shared by other processing devices.

[0031] As used herein, the term "memory" is intended to include memory associated with a processor or CPU, such as, for example, RAM, ROM, fixed memory devices (e.g., hard drives), removable memory devices (e.g., diskettes), flash memory, etc. Such memory may be considered a computer-readable storage medium.

[0032] Furthermore, as used herein, the phrase "input / output device" or "I / O device" is intended to include, for example, one or more input devices (e.g., keyboard, mouse, scanner, etc.) for inputting data into a processing unit, and / or one or more output devices (e.g., speaker, display, printer, etc.) for presenting results associated with a processing unit.

[0033] Embodiments of the invention may include systems, methods, and / or computer program products. The computer program product may include a computer-readable storage medium having computer-readable program instructions that cause a processor to perform aspects of the invention.

[0034] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or ridge-in-groove structures having instructions recorded thereon, and any suitable combination of the foregoing. Computer-readable storage medium, as used herein, should not be construed as being, per se, a transitory signal such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0035] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or can be downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0036] Computer-readable program instructions for carrying out operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the present invention, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer-readable program instructions utilizing state information of the computer-readable program instructions to customize the electronic circuitry.

[0037] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0038] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for performing the functions / acts specified in the flowchart and / or block diagram blocks. These computer-readable program instructions may be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer-readable storage medium having instructions stored thereon comprises an article of manufacture containing instructions for performing aspects of the functions / acts specified in the flowchart and / or block diagram blocks.

[0039] The computer-readable program instructions may be loaded into a computer, other programmable apparatus, or other device to cause the computer, other programmable data processing apparatus, or other device to perform a series of operational steps to create a computer-implemented process, such that the instructions operating on the computer, other programmable apparatus, or other device perform the functions / acts identified in the flowchart and / or block diagram blocks.

[0040] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of computer instructions, which includes one or more executable computer instructions for implementing the specified logical function(s). In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, depending on the functionality involved, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may even be executed in the reverse order. It should also be noted that each block in the flowcharts and block diagrams, and combinations of these blocks, may be implemented by dedicated hardware-based systems and / or dedicated software-based systems that perform the specified functions or operations.

[0041] The description of various embodiments of the present invention has been presented for purposes of illustration and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments.

Claims

1. protecting a process of a first computer software application executed by a computer, said protecting step being performed based on a protection policy; receiving an instruction from the process to modify the protection policy; modifying the protection policy based on the instruction; modifying the protection policy based on the instruction and then protecting the process based on the protection policy; Including, The computer security method, wherein the protecting step, the receiving step, and the modifying step are performed by a kernel driver executed by the computer.

2. The computer security method of claim 1 , wherein the first computer software application is a web browser.

3. 2. The computer security method of claim 1, wherein any of the protecting step, the receiving step, and the modifying step is performed after determining that a digital signature is valid, the digital signature being of an executable file of the first computer software application, and the determination being performed by the kernel driver executed by the computer.

4. The protection step comprises: detecting an attempt to access an object associated with the first computer software application by a process of a second computer software application executed by the computer; determining whether a digital signature is valid, the digital signature being for an executable file of the second computer software application; allowing or preventing access to the object by the second computer software application based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid; and Including, 2. The computer security method of claim 1, wherein the detecting, determining, allowing, and preventing steps are performed by the kernel driver executed by the computer.

5. The computer security method of claim 4 , wherein the object is a process or a thread of a process.

6. The protection step comprises: receiving a decryption key from the process of the first computer software application; receiving a request from the process of the first computer software application to receive the decryption key; determining whether a digital signature is valid, said digital signature being of said first computer software application; providing or not providing the decryption key to the process based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid; Including, 2. The computer security method of claim 1, wherein the receiving step, the determining step, the permitting step, the providing step, and the not providing step are performed by the kernel driver executed by the computer.

7. 7. The computer security method of claim 6, wherein the decryption key is encrypted after receiving the decryption key from the process of the first computer software application, the method further comprising the step of decrypting the encrypted decryption key before providing the decryption key to the process of the first computer software application if the digital signature is valid.

8. The protection step comprises: receiving an encrypted message from the process of the first computer software application, the message being encrypted using a public key of a key pair; determining whether a digital signature is valid, the digital signature being for an executable file of the first computer software application; If the digital signature is valid, decrypting the encrypted message using the private key of the key pair; encrypting a response to the message using the private key; providing the encrypted response to the process of the first computer software application; Including, The computer security method of claim 1 , wherein the receiving, determining, decrypting, encrypting, and providing steps are performed by the kernel driver executed by the computer.

9. Kernel drivers run by the computer in kernel mode the kernel driver includes: protecting a process of a first computer software application executed by the computer, the protecting step being performed based on a protection policy; receiving instructions from the process to modify the protection policy; modifying the protection policy based on the instruction; modifying the protection policy based on the instruction and then protecting the process based on the protection policy; 1. A computer security device configured to:

10. The computer security apparatus of claim 9 , wherein the first computer software application is a web browser.

11. 10. The computer security apparatus of claim 9, wherein the kernel driver is configured to perform any of the protecting step, the receiving step, and the modifying step after determining that a digital signature is valid, the digital signature being for an executable file of the first computer software application.

12. The kernel driver detecting an attempt to access an object associated with the first computer software application by a process of a second computer software application executed by the computer; determining whether a digital signature is valid, the digital signature being for an executable file of the second computer software application; allowing or preventing access to the object by the second computer software application based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid; 10. The computer security apparatus of claim 9, configured to perform the protecting step by:

13. The computer security apparatus of claim 12 , wherein the object is a process or a thread of a process.

14. The kernel driver receiving a decryption key from the process of the first computer software application; receiving a request from the process of the first computer software application to receive the decryption key; determining whether a digital signature is valid, said digital signature being of said first computer software application; providing or not providing the decryption key to the process based on the protection policy, the protection policy being based at least in part on whether the digital signature is valid; 10. The computer security apparatus of claim 9, wherein the receiving, determining, allowing, providing, and not providing steps are performed by the kernel driver executed by the computer.

15. 15. The computer security apparatus of claim 14, wherein the kernel driver is configured to encrypt the decryption key after receiving it from the process of the first computer software application, and, if the digital signature is valid, decrypt the encrypted decryption key before providing it to the process of the first computer software application.

16. The kernel driver receiving an encrypted message from the process of the first computer software application, the message being encrypted using a public key of a key pair; determining whether a digital signature is valid, the digital signature being for an executable file of the first computer software application; If the digital signature is valid, decrypting the encrypted message using the private key of the key pair; encrypting a response to the message using the private key; providing the encrypted response to the process of the first computer software application.

10. The computer security apparatus of claim 9, configured to perform the protecting step by:

Images