# US 10,454,956 B2 · Insider attack resistant system and method for cloud services integrity checking > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,956 B2 - Document ID: US10454956B2 - Status: Granted - Kind: B2 - Application number: 16/101,924 - Filed: 2018-08-13 - Published: 2019-01-03 - Granted: 2019-10-22 - Earliest claimed: 2015-08-13 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Thusitha Jayawardena; Jeffrey E. Bickford; Mikhail Istomin; John Liefert; Gokul Singaraju; Christopher Van Wart - Web page: https://patentgrep.com/patent/US10454956B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 9/45512: {Command shells} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0712: {in a virtual computing platform, e.g. logically partitioned systems} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An insider attack resistant system for providing cloud services integrity checking is disclosed. In particular, the system utilizes an automated integrity checking script and virtual machines to check the integrity of a service. The system may utilize the integrity checking script and virtual machines to execute a set of operations associated with the service so as to check the integrity of the service. When executing the set of operations, the system may only have access to the minimum level of access to peripherals that is required for each operation in the set of operations to be executed. After each operation is executed, the system may log each result for each operation, and analyze each result to determine if a failure exists for any of the operations. If a failure exists, the system may determine that a change in an expected system behavior associated with the service has occurred. ## Claims ### Claim 1 A system, comprising: a memory that stores instructions; and a processor that executes the instructions to perform operations, the operations comprising: executing, during a first mode, a set of operations associated with a service to check an integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for at least one operation in the set of operations to be executed, wherein the minimum level of access is established by suspending access to a network port, wherein the minimum level of access is imposed by utilizing a firewall; executing, when the system is in a second mode, the set of operations associated with the service based on a full level of access to the peripheral; and determining, during the first mode or the second mode, whether a failure of the at least one operation in the set of operations has occurred. ### Claim 2 (depends on 1) The system of claim 1, wherein the operations further comprise determining, if the failure of the at least one operation in the set of operations has occurred, that a change in a system behavior associated with the service has occurred. ### Claim 3 (depends on 2) The system of claim 2, wherein the operations further comprise generating an alert after determining that the change in the system behavior associated with the service has occurred. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further comprise performing an action to correct the failure. ### Claim 5 (depends on 1) The system of claim 1, wherein the operations further comprise modifying the service after determining that the failure has occurred. ### Claim 6 (depends on 1) The system of claim 1, wherein the operations further comprise executing an anti-virus program to remove malware associated with the failure. ### Claim 7 (depends on 1) The system of claim 1, wherein the operations further comprise identifying an attacker associated with malware associated with the failure. ### Claim 8 (depends on 1) The system of claim 1, wherein the operations further comprise identifying a cause of the failure. ### Claim 9 (depends on 1) The system of claim 1, wherein the operations further comprise identifying a cause of a change in a system behavior associated with the service. ### Claim 10 (depends on 1) The system of claim 1, wherein the operations further comprise logging a result generated based on the executing of the set of operations. ### Claim 11 (depends on 10) The system of claim 10, wherein the determining of whether the failure of the at least one operation in the set of operations has occurred is based on analyzing the result. ### Claim 12 (depends on 1) The system of claim 1, wherein the firewall is a hypervisor layer firewall. ### Claim 13 (depends on 1) The system of claim 1, wherein the operations further comprise imposing the minimum level of access by utilizing a software-defined networking script. ### Claim 14 A method, comprising: executing, during a first mode, a set of operations associated with a service to check an integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for at least one operation in the set of operations to be executed, wherein the minimum level of access is established by suspending access to a network port, wherein the minimum level of access is imposed by utilizing a firewall; executing, when the system is in a second mode, the set of operations associated with the service based on a full level of access to the peripheral; and determining, based on the executing of the set of operations and during the first or second mode, that a change in a system behavior associated with the service has occurred, wherein the determining is performed by utilizing instructions from a memory that are executed by a processor. ### Claim 15 (depends on 14) The method of claim 14, further comprising launching an integrity checking script to execute the set of operations associated with the service. ### Claim 16 (depends on 14) The method of claim 14, further comprising activating a virtual machine to check the integrity of the service. ### Claim 17 (depends on 14) The method of claim 14, further comprising determining if an operation in the set of operations has failed. ### Claim 18 (depends on 14) The method of claim 14, further comprising generating an alert in response to determining that the change in the system behavior associated with the service has occurred. ### Claim 19 (depends on 14) The method of claim 14, further comprising identifying a cause of the change in the system behavior associated with the service. ### Claim 20 A computer-readable device comprising instructions, which when executed by a processor, cause the processor to perform operations comprising: executing, during a first mode, a set of operations associated with a service to check an integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for at least one operation in the set of operations to be executed, wherein the minimum level of access is established by suspending access to a network port, wherein the minimum level of access is imposed by utilizing a firewall; executing, when the system is in a second mode, the set of operations associated with the service based on a full level of access to the peripheral; and logging each result for each operation in the set of operations, wherein each result for each operation is generated based on executing each operation in the set of operations.