Securing interprocess communications
AssigneeSophos Limited
InventorRichard S. Teal
Life of this patent
Estimating the term…
Abstract
Endpoint security is improved by monitoring and controlling interprocess communications through a kernel-based endpoint protection driver. A list of protected computing objects such as registry keys, files, processes and directories is stored in the kernel and secured with reference to a trust authority external to the kernel and the endpoint. Protected processes are further controlled from unauthorized access and use by monitoring all interprocess communications through the endpoint protection driver and preventing unprotected processes from passing (potentially unsafe) data to protected processes.
Claims15
A computer program product for securing interprocess communications in an operating system of an endpoint that includes a kernel space for operating system functions and a user space for user programs, the computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on the endpoint, performs the steps of:
- storing a tamper protection cache in the kernel space on the endpoint, the tamper protection cache identifying at least two protected processes for protection when executing in the user space;
- in the tamper protection cache, storing a digital signature for each of the at least two protected processes, the digital signature signed with a private key that provides a root of trust from a trust authority external to the endpoint;
- monitoring execution of processes in the user space of the endpoint with an endpoint protection driver executing in the kernel space;
- directing an interprocess communication from a first process in the user space to a second process in the user space through the endpoint protection driver;
- and
- when the second process is a first one of the at least two protected processes identified in the tamper protection cache, conditionally permitting the first process to provide data to the second process only when the first process is a second one of the at least two protected processes identified in the tamper protection cache.
A method for securing interprocess communications on an endpoint, the method comprising:
- storing a tamper protection cache in a kernel space of an operating system on the endpoint, wherein a memory of the endpoint includes the kernel space and a user space, and wherein the tamper protection cache identifies at least two protected processes for protection when executing in the user space, and the tamper protection cache stores a digital signature for each of the at least two protected processes, the digital signature signed with a private key that provides a root of trust from a trust authority external to the endpoint;
- monitoring execution of processes in the user space of the endpoint with an endpoint protection driver executing in the kernel space;
- directing an interprocess communication from a first process in the user space to a second process in the user space through the endpoint protection driver;
- and
- conditionally managing the interprocess communication according to a protected status of each of the first process and the second process in the tamper protection cache.
A method for securing interprocess communications on an endpoint, the method comprising:
- storing a tamper protection cache in a kernel space of an operating system on the endpoint, wherein a memory of the endpoint includes the kernel space and a user space, and wherein the tamper protection cache identifies at least two protected processes for protection, and the tamper protection cache stores a digital signature for each of the at least two protected processes, the digital signature signed with a private key that provides a root of trust from a trust authority external to the endpoint;
- monitoring execution of processes executing in the memory of the endpoint with an endpoint protection driver executing in the kernel space;
- directing an interprocess communication from a first process in the memory to a second process in the memory through the endpoint protection driver;
- and
- conditionally managing the interprocess communication according to a protected status of each of the first process and the second process in the tamper protection cache.
A system comprising:
- an endpoint containing a memory;
- an operating system executing on the endpoint, the operating system dividing the memory into a kernel space for operating system functions and a user space for execution of user programs;
- a tamper protection cache stored in the kernel space of the memory, the tamper protection cache identifying at least two protected processes for protection when executing in the user space, and the tamper protection cache storing a digital signature for each of the at least two protected processes, the digital signature signed with a private key that provides a root of trust from a trust authority external to the endpoint;
- and
- an endpoint protection driver executing in the kernel space of the memory, the endpoint protection driver configured to monitor execution of processes in the user space and to detect an interprocess communication from a first process in the user space to a second process in the user space, the endpoint protection driver further configured to control the interprocess communication by, when the second process is a first one of the at least two protected processes identified in the tamper protection cache, conditionally permitting the first process to provide data to the second process only when the first process is a second one of the at least two protected processes identified in the tamper protection cache.
Dependencies are inferred from the claim text.