# US 2021/0342484 A1 · Method and device for dynamic control, at file level, of the integrity of program files in a persistent memory of a computer, computer program and computer incorporating same

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0342484 A1
- Document ID: US20210342484A1
- Status: Published application
- Kind: A1
- Application number: 17/210,430
- Filed: 2021-03-23
- Published: 2021-11-04
- Earliest claimed: 2020-03-27
- Assignees: Bull SAS
- Applicants: Bull SAS
- Inventors: Luc CRETI; Dominique TRONCHE; Jean-Michel LENOTT
- Web page: https://patentgrep.com/patent/US20210342484A1

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method is disclosed for dynamic control, at file level, of the integrity of a set of files stored in a persistent memory of a computer. An embodiment comprises mounting (52) an overlay file system of the Overlayfs type, with a “lower” directory containing the files which is marked as read-only, and with an “upper” directory containing any file resulting from a modification of the files of the “lower” directory by virtue of a copy-on-write mechanism. A denylist of files from the “lower” directory to be excluded from the integrity control is created and maintained (53). An integrity violation (56) of a file is detected if a copy of said file is identified in the “upper” directory. Another embodiment utilizes the concept of containerization, which natively implements file mounting by overlays of the Overlayfs type.

## Claims

### Claim at position 1

1-16. (canceled)

### Claim 17

A method for dynamic control, at file level, of the integrity of a set of files stored in a persistent memory (11) of a computer (1), said method comprising:
allocating (52) a first memory space (242, 342, 642M, 642N) in the persistent memory (11) of the computer (1), in which are stored files (251, 301, 303, 304) the integrity of which must be controlled;
allocating (52) a second memory space (243, 343, 643M, 643N, 643Ma) in the persistent memory of the computer, separate from the first memory space;
locking to read-only (52), of the first memory space containing the files (251, 301, 303, 304) the integrity of which must be controlled;
implementing a copy-on-write mechanism with respect to the files (251, 301,303, 304) contained in the first memory space, ensuring the creation of a copy of at least one of said files in the second memory space when the at least one file is modified and the redirection of all instances of subsequent access to the at least one file to said copy of the at least one file in the second memory space;
creating (53) a list, said created list corresponding to a list called denylist (220), of files from the second memory space to be excluded from the integrity control, or a list called allowlist, of files from the second memory space to be included in the integrity control;
dynamic inspection (55), at predetermined times during the operation of the computer, of the second memory space in order to identify files therein with the exception of the files from the denylist (220) or to identify files therein from the allowlist;
detecting (56) an integrity violation of a file from among the files the integrity of which must be controlled, stored in the first memory space, if a copy of said file is identified in the second memory space; and
at least one predetermined action (57), executed in response to the detection of an integrity violation of a file from among the files the integrity of which must be controlled, from the first memory space.

### Claim 18 (depends on 17)

The method according to claim 17, in which the list created corresponds to a denylist and the dynamic inspection (55) of the second memory space makes it possible to identify files therein, with the exception of the files of said denylist (220).

### Claim 19 (depends on 18)

The method according to claim 18, in which the presence alone of any file in the second memory space with the exclusion of the files of the denylist is interpreted as the detection of a violation or of a risk of violation of the integrity of a file stored in the first memory space.

### Claim 20 (depends on 17)

The method according to claim 17, in which the list created corresponds to an allowlist and the dynamic inspection (55) of the second memory space makes it possible to identify files of said allowlist therein.

### Claim 21 (depends on 20)

The method according to claim 20, in which the presence alone of any file in the second memory space corresponding to the files of the allowlist is interpreted as the detection of a violation or of a risk of violation of the integrity of a file stored in the first memory space.

### Claim 22 (depends on 17)

The method according to claim 17, in which the files the integrity of which must be controlled (251, 301, 303, 304) contained in the first memory space contain program code associated with applications, for example program code associated with security applications, and in which the list created can be adapted in order to identify in particular any data file created, modified and/or deleted in the second memory space by said security applications or by other applications the program files of which are also contained in the second memory space, as well as said program files corresponding to said other applications, if appropriate.

### Claim 23 (depends on 17)

The method according to claim 17, in which an action executed in response to the detection of an integrity violation of one of the files the integrity of which must be controlled from the first memory space is a corrective action, intended to eliminate the identified file.

### Claim 24 (depends on 17)

The method according to claim 17, comprising mounting (52) an overlay file system, with as lower directory, the first memory space which contains the files the integrity of which must be controlled and which is marked as read-only, and with as upper directory the second memory space containing any file resulting from a modification, a creation or a deletion of the files the integrity of which must be controlled, from the lower directory.

### Claim 25 (depends on 17)

The method according to claim 17, comprising the implementation of a containerization platform, in which each container (61, 62) comprises the first memory space as a read-only overlay common to all the containers using the same file image the integrity of which must be controlled, and also comprises the second memory space as a read-write overlay specific to each container and which contains all the modifications introduced to the container.

### Claim 26 (depends on 25)

The method according to claim 25, comprising the creation of a list of containers to be monitored, and, for each container to be monitored, the creation of a denylist of the files of said container to be excluded from the integrity control.

### Claim 27 (depends on 26)

The method according to claim 26, in which the presence alone of any created, modified and/or deleted temporary file in the second memory space with the exclusion of the files of said container to be excluded from integrity control of the denylist is interpreted (56) as the detection of a violation or of a risk of violation of the integrity of one of the files the integrity of which must be controlled, stored in the first memory space.

### Claim 28 (depends on 25)

The method according to claim 25, comprising the creation of a list of containers to be monitored, and, for each container to be monitored, the creation of an allowlist of the files of said container to be included in the integrity control.

### Claim 29 (depends on 17)

The method according to claim 17 wherein said method is implemented on an information technology device (1).

### Claim 30 (depends on 29)

The method according to claim 29, wherein the data necessary for the dynamic inspection as well as the list(s) created, are placed in a memory zone protected by a low-level integrity control system of said information technology device (1).

### Claim 31 (depends on 29)

The method according to claim 29 wherein said computer comprises information technology device.

### Claim 32 (depends on 17)

The method according to claim 17 wherein said computer comprises a computer program product comprising one or more sequences of instructions stored on a memory media readable by a machine comprising a processor, said sequences of instructions being suitable for carrying out said method when the program is read from the memory media and executed by the processor.