US 2019/0102551 A1 · USING INDIRECTION TO FACILITATE SOFTWARE UPGRADES

Abstract

A security agent for a host computing device may be implemented with multiple levels of indirection from an operating system (OS) kernel of the computing device in order to facilitate software upgrades for the security agent. An unserviceable kernel-mode component of the security agent may directly interface with the OS kernel and hook into a function (e.g., a security callback function) of the OS kernel in a first level of indirection, while a serviceable kernel-mode component of the security agent, which is upgradable, may indirectly interface with the OS kernel via the unserviceable kernel-mode component in a second level of indirection. The serviceable kernel-mode component may be configured to process events, and/or data related thereto, received from the OS kernel via the unserviceable kernel-mode component in order to monitor activity on the computing device for malware attacks.

Claims20

Dependent claims

A system comprising:

one or more processors;
and
memory storing:
an operating system (OS) kernel configured to be operated by the one or more processors to invoke a security callback function in response to execution of a process on the system;
an unserviceable kernel-mode component configured to be operated by the one or more processors to:
hook the security callback function so that the security callback function points to the unserviceable kernel-mode component in a first level of indirection;
and
forward a security callback query received from the OS kernel to a serviceable kernel-mode component in a second level of indirection;
the serviceable kernel-mode component configured to be operated by the one or more processors to:
receive the security callback query forwarded from the unserviceable kernel-mode component;
and
return a response to the security callback query indicating whether the execution of the process is permitted to continue;
and
computer-executable instructions that, when executed by the one or more processors, cause the system to install a software upgrade to upgrade the serviceable kernel-mode component.

11 more elements

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform actions comprising:

installing a security agent on the computing device, the security agent comprising:
an unserviceable kernel-mode component that directly interfaces with an operating system (OS) kernel of the computing device and hooks into a function of the OS kernel in a first level of indirection;
and
a serviceable kernel-mode component that indirectly interfaces with the OS kernel via the unserviceable kernel-mode component in a second level of indirection to receive events from the OS kernel via the unserviceable kernel-mode component;
receiving, by the computing device, a software upgrade to upgrade the serviceable kernel-mode component;
and
installing the software upgrade to load a new version of the serviceable kernel-mode component.

4 more elements

Dependencies are inferred from the claim text.

Using indirection to facilitate software upgrades

Life of this patent

Using indirection to facilitate software upgrades

Life of this patent

Abstract

Claims20