Secure management of process properties
AssigneeSophos Limited
InventorRichard S. Teal
Life of this patent
Estimating the term…
Abstract
An endpoint has a tamper protection cache that identifies protected computing objects, along with a process cache that stores information for processes executing on the endpoint. By securing the tamper protection cache with reference to a trust authority external to the endpoint, or the operating system for the endpoint, computing objects listed in the tamper protection cache can be protected against unauthorized modifications from malware or other malicious or otherwise potentially unsafe code.
Claims20
A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on an endpoint, performs the steps of:
- storing a process cache in a kernel space of an operating system on the endpoint, the endpoint having a memory that includes the kernel space and a user space and the process cache storing at least one property for a first process executing in the user space;
- storing a tamper protection cache in the kernel space, the tamper protection cache identifying one or more protected computing objects on the endpoint including the first process, wherein a record of the first process in the tamper protection cache is cryptographically secured with reference to a trust authority external to the operating system;
- monitoring changes to the process cache with a kernel driver;
- detecting a requested change from a second process executing on the endpoint to the at least one property of the first process with the kernel driver;
- and
- conditionally approving the requested change from the kernel driver only when the second process is included in the one or more protected computing objects identified in the tamper protection cache.
A method for managing properties of processes on an endpoint, the method comprising:
- storing a process cache in a kernel space of an operating system on the endpoint, the endpoint having a memory that includes the kernel space and a user space and the process cache storing at least one property for a first process executing in the user space;
- storing a tamper protection cache in the kernel space, the tamper protection cache identifying one or more protected computing objects on the endpoint, wherein a record of the first process in the tamper protection cache is cryptographically secured with reference to a trust authority external to the operating system;
- monitoring changes to the process cache with a kernel driver;
- detecting a requested change from a second process executing on the endpoint to the at least one property of the first process with the kernel driver;
- and
- conditionally approving the requested change from the kernel driver based on a security rule and the tamper protection cache.
A system comprising:
- an endpoint having a memory and an operating system that organizes the memory into a user space and a kernel space;
- a process cache stored in the kernel space of the operating system, the process cache storing at least one property for a first process executing in the user space;
- a tamper protection cache stored in the kernel space of the operating system, the tamper protection cache identifying one or more protected computing objects on the endpoint, wherein a record of the first process in the tamper protection cache is cryptographically secured with reference to a trust authority external to the operating system;
- and
- a kernel driver in the kernel space of the operating system, the kernel driver configured to monitor changes to the process cache, to detect a requested change by a second process executing on the endpoint to the at least one property of the first process, and to conditionally approve the requested change from the kernel driver based on a security rule and the tamper protection cache.
Dependencies are inferred from the claim text.