Method and system for preventing and detecting security threats
AssigneeIrdeto B.V.
InventorRon Vandergeest
Life of this patent
Estimating the term…
Abstract
A system and method is provided for implementing platform security on a consumer electronic device having an open development platform. The device is of the type which includes an abstraction layer operable between device hardware and application software. A secured software agent is provided for embedding within the abstraction layer forming the operating system. The secured software agent is configured to limit access to the abstraction layer by either blocking loadable kernel modules from loading, blocking writing to the system call table or blocking requests to attach debug utilities to certified applications or kernel components.
Claims16
A secured software agent embedded within an OS kernel of a device, the secured software agent being stored as computer readable instructions in a non-transient memory of the device, the device executing an operating system and application software, the computer readable code including instructions for causing the device to accomplish the following functions at runtime:
- in response to a request, from a requesting process, to use a debug utility to debug a target process of an application, determine whether the requesting process has privileges to allow the debug utility to attach to the target process;
- and
- deny the debug request when the requesting process does not have privileges to allow the debug utility to attach to the target process.
A method for controlling debug requests in a computing device, the device executing an operating system and application software:
- in response to a request, from a requesting process, to use a debug utility to debug a target process of an application, determining at runtime, by a secured software agent embedded within an OS kernel of the device, whether the requesting process has privileges to allow the debug utility to attach to the target process;
- and
- denying the debug request when the requesting process does not have privileges to allow the debug utility to attach to the target process.
Dependencies are inferred from the claim text.