Back to results
US 10,242,182 B2Granted
Computer security system and method
AssigneeSecure Vector, Inc.
InventorsJames B. Kargman, Peter Scott, Jeffrey Bromberger
Life of this patent
Estimating the term…
Abstract
A method is provided for protecting a computer system, comprising creating an isolated process, then assigning a first process group to the process; creating an additional group process within the first process group; performing a first determination by an application programming interface (API) that the additional group process is within the first process group, and as a result of the first determination, causing the additional group process to inherit and duplicate a handle of the process. Process communications and control within isolated groups is permitted freely, whereas process control by an isolated process for non-isolated processes or isolated processes in different groups is constrained or prohibited.
Claims9
A method for protecting a computer system, comprising:
- attaching a security descriptor to a process running on a processor of the computer system that has been previously started;
- associating with the security descriptor an isolation indicator that, by the isolation indicator itself, indicates the process is running in an isolation mode, thereby rendering the process as an isolated process, the isolated process running with a plurality of non-isolated processes in a common environment;
- calling a kernel routine by the isolated process that is also callable by a non-isolated process that is not running in isolation mode, the non-isolated process is among the plurality of non-isolated processes;
- attempting to perform an operation on an object by the kernel routine called by the isolated process;
- determining, by a filter driver running in kernel mode, whether the kernel routine is requesting the operation on behalf of the isolated process or the non-isolated process;
- when the operation is requested on behalf of the isolated process, performing the operation utilizing a pseudo storage area;
- and
- when the operation is requested on behalf of the non-isolated process, then performing the operation utilizing an actual storage area in which the object of the computer system resides;
- providing, for resources associated with the operation in the pseudo storage area, an indication to restrict access to solely from within the isolated process;
- and
- restricting the access to the resources to being solely from within the isolated process based on the indication.
8 more elements
A computer device for protecting a computer system, comprising:
- a memory, and a processor, the processor configured to:
- attach a security descriptor to a process running on the processor of the computer system that has been previously started;
- associate with the security descriptor an isolation indicator that, by the isolation indicator itself, indicates the process is running in an isolation mode, thereby rendering the process as an isolated process, the isolated process running with a plurality of non-isolated processes in a common environment;
- call a kernel routine by the isolated process that is also callable by a non-isolated process that is not running in isolation mode, the non-isolated process is among the plurality of non-isolated processes;
- attempt to perform an operation on an object by the kernel routine called by the isolated process;
- determine, by a filter driver running in kernel mode, whether the kernel routine is requesting the operation on behalf of the isolated process or the non-isolated process;
- when the operation is requested on behalf of the isolated process, perform the operation utilizing a pseudo storage area;
- and when the operation is requested on behalf of the non-isolated process, perform the operation utilizing an actual storage area in which the object of the computer system resides;
- provide, for resources associated with the operation in the pseudo storage area, an indication to restrict access to solely from within the isolated process;
- and
- restrict the access to the resources to being solely from within the isolated process based on the indication.
8 more elements
A method for protecting a computer system, comprising:
- calling a kernel routine by an isolated process that is also callable by a non-isolated process that is not running in an isolation mode, the non-isolated process is among the plurality of non-isolated processes;
- attempting to perform an operation on an object by the kernel routine called by the isolated process;
- determining, by a filter driver running in kernel mode, whether the kernel routine is requesting the operation on behalf of the isolated process or the non-isolated process;
- when the operation is requested on behalf of the isolated process, performing the operation utilizing a pseudo storage area;
- and
- when the operation is requested on behalf of the non-isolated process, then performing the operation utilizing an actual storage area in which the object of the computer system resides;
- providing, for resources associated with the operation in the pseudo storage area, an indication to restrict access to solely from within the isolated process;
- and
- restricting the access to the resources to being solely from within the isolated process based on the indication.
6 more elements
Dependencies are inferred from the claim text.