# US 2021/0279328 A1 · Method and system for preventing and detecting security threats > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0279328 A1 - Document ID: US20210279328A1 - Status: Published application - Kind: A1 - Application number: 17/319,193 - Filed: 2021-05-13 - Published: 2021-09-09 - Earliest claimed: 2014-09-29 - Assignees: Irdeto B.V. - Applicants: Irdeto B.V. - Inventors: Ron Vandergeest - Web page: https://patentgrep.com/patent/US20210279328A1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/54: by adding security routines or objects to programs - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method is provided for implementing platform security on a consumer electronic device having an open development platform. The device is of the type which includes an abstraction layer operable between device hardware and application software. A secured software agent is provided for embedding within the abstraction layer forming the operating system. The secured software agent is configured to limit access to the abstraction layer by either blocking loadable kernel modules from loading, blocking writing to the system call table or blocking requests to attach debug utilities to certified applications or kernel components. ## Claims ### Claim 1 A secured software agent embedded within an OS kernel of a device, the secured software agent being stored as computer readable instructions in a non-transient memory of the device, the device executing an operating system and application software, the computer readable code including instructions for causing the device to accomplish the following functions at runtime: in response to a request, from a requesting process, to use a debug utility to debug a target process of an application, determine whether the requesting process has privileges to allow the debug utility to attach to the target process; and deny the debug request when the requesting process does not have privileges to allow the debug utility to attach to the target process. ### Claim 2 (depends on 1) The secured software agent of claim 1, wherein the request is received by the OS kernel and redirected to the secured software agent. ### Claim 3 (depends on 2) The secured software agent of claim 2, wherein the request is redirected to the secured software agent via a Linux Security Module (LSM) functionality. ### Claim 4 (depends on 1) The secured software agent of claim 1, wherein the function of determine whether the requesting process has privileges to allow the debug utility to attach to the target process comprises determining whether the target process has been integrity verified or is an OS kernel process and determining that the requesting does not have privileges to allow the debug utility to attach to the target process when the target process has been integrity verified or is an OS kernel process. ### Claim 5 (depends on 1) The secured software agent of claim 1, wherein the function of determine whether the requesting process has privileges to allow the debug utility to attach to the target process comprises determining a first ID associated with the requesting process, determining a second ID associated with the target process, and determining whether the first ID and the second ID are in a same ID group. ### Claim 6 (depends on 5) The secured software agent of claim 5, wherein the first ID is a user ID associated with the requesting process and the second ID is a user ID associated with the target process. ### Claim 7 (depends on 1) The secured software agent of claim 1, wherein the debug utility is a process tracing utility. ### Claim 8 (depends on 1) The secured software agent of claim 1, wherein the debug utility is a debug daemon. ### Claim 9 A method for controlling debug requests in a computing device, the device executing an operating system and application software: in response to a request, from a requesting process, to use a debug utility to debug a target process of an application, determining at runtime, by a secured software agent embedded within an OS kernel of the device, whether the requesting process has privileges to allow the debug utility to attach to the target process; and denying the debug request when the requesting process does not have privileges to allow the debug utility to attach to the target process. ### Claim 10 (depends on 9) The method of claim 9, wherein the request is received by the OS kernel and redirected to the secured software agent. ### Claim 11 (depends on 10) The method of claim 10, wherein the request is redirected to the secured software agent via a Linux Security Module (LSM) functionality. ### Claim 12 (depends on 9) The method of claim 9, wherein the determining whether the requesting process has privileges to allow the debug utility to attach to the target process comprises determining whether the target process has been integrity verified or is an OS kernel process and determining that the requesting does not have privileges to allow the debug utility to attach to the target process when the target process has been integrity verified or is an OS kernel process. ### Claim 13 (depends on 9) The method of claim 9, wherein the determining whether the requesting process has privileges to allow the debug utility to attach to the target process comprises determining a first ID associated with the requesting process, determining a second ID associated with the target process, and determining whether the first ID and the second ID are in a same ID group. ### Claim 14 (depends on 13) The method of claim 13, wherein the first ID is a user ID associated with the requesting process and the second ID is a user ID associated with the target process. ### Claim 15 (depends on 9) The method of claim 9, wherein the debug utility is a process tracing utility. ### Claim 16 (depends on 9) The method of claim 9, wherein the debug utility is a debug daemon.