Method and system for preventing and detecting security threats
AssigneeIrdeto B.V.
InventorRon Vandergeest
Life of this patent
Estimating the term…
Abstract
A system and method is provided for implementing platform security on a consumer electronic device having an open development platform. The device is of the type which includes an abstraction layer operable between device hardware and application software. A secured software agent is provided for embedding within the abstraction layer forming the operating system. The secured software agent is configured to limit access to the abstraction layer by either blocking loadable kernel modules from loading, blocking writing to the system call table or blocking requests to attach debug utilities to certified applications or kernel components.
Claims6
A method for increasing security of a computing device having at least one processor executing an operating system and application software, the method comprising:
- embedding a secured software agent within an OS kernel of the device;
- the OS kernel receiving a ptrace debug request from a process;
- the OS kernel passing the ptrace debug request to the secured software agent;
- the secured software agent determining whether the ptrace debug request attempts to attach to any one of a certified application and a component of the abstraction layer;
- and
- blocking the request when the ptrace debug request attempts to attach to any one of a certified application and a component of the abstraction layer.
An apparatus for increasing security of a computing device, the apparatus comprising:
- at least one processor executing an operating system and application software;
- and
- at least one memory storing instructions which, when executed by the at least one processor, cause the at least one processor to:
- embed a secure software agent embedded within an OS kernel of the device;
- in response to the OS kernel receiving a ptrace debug request from a process;
- the OS kernel to pass the ptrace debug request to the secured software agent;
- determine by the secured software agent whether the ptrace debug request attempts to attach to any one of a certified application and a component of the abstraction layer;
- and
- block by the secured software the request when the ptrace debug request attempts to attach to any one of a certified application and a component of the abstraction layer.
A secured software agent embedded within an OS kernel of a computing device having at least one processor executing an operating system and application software for increasing security of the device, the secured software agent including code which causes the device to:
- in response to the OS kernel receiving a ptrace debug request from a process;
- the OS kernel passing the ptrace debug request to the secured software agent;
- determine whether the process ptrace debug request attempts to attach to any one of a certified application and a component of the abstraction layer;
- and
- block the request when the ptrace debug request attempts to attach to any one of a certified application and a component of the abstraction layer.
Dependencies are inferred from the claim text.