Kernel-based network security infrastructure
AssigneeCoretrace Corporation
InventorsDaniel M. Teal, Richard S. Teal
Life of this patent
Estimating the term…
Abstract
A system and method for network security using a kernel based network security infrastructure is disclosed. The method comprises the installation of a computer code set into the operating system kernel of each computer on a network and use of the computer code set to detect and stop unwanted or malicious intrusions into the kernel. Because the security feature is kernel based, a broader range of security features, such as security of communication between user-space applications and the kernel, can be implemented.
Claims54
A security infrastructure for a network of a plurality of individual computer resources wherein each individual computer resource in the network of individual computer resources has an independent operating system which includes a portion of the operating system for supporting applications running in the user space of the independent operating system and a portion of the operating system, which is invisible to the user, for operating the individual computer resource and is resident in the kernel space of the independent operating system, said plurality of individual computer resources comprising a CPU, a memory, and a network interface card, said security infrastructure comprising:
- a computer code set constructed and arranged for loading into the kernel space of the independent operating system of each of said plurality of computer resources in the network of computer resources in the network of computer resources;
- said computer code set including means for identifying and preventing attempts to insert computer instructions into the kernel space and/or through the kernel space into one or more user spaces from either within or without the network of individual computer resources which computer instructions would alter the operation of the independent operating system of each computer resource in the network of computer resources;
- a security manager, which acts as a server in said computer network;
- said security manager including said computer code set loaded into the kernel space of the independent operating system of said security manager;
- said computer code set adapted to enable secure kernel-to-kernel communication over the network with and for monitoring the security of said computer code set constructed and arranged for loading into the kernel space of the operating system of each of said plurality of individual computer resources;
- wherein the kernel space of the independent operating system of each of the plurality of individual computer resources and the kernel space of the independent operating system of the security manager are secured by the security infrastructure;
- wherein said computer code set further includes means to authenticate communications from the application in the user space to said computer code set resident in the kernel space;
- wherein said computer code set further includes means to assure that communications between a first authenticated application resident within the user space are secure as said communications move through the kernel space to a second authenticated application;
- and
- wherein said computer code set prevents the operating system code resident in the kernel space from locating one or more operating system call tables or portions thereof by encrypting one or more symbol tables or portions thereof in the operating system code resident in the kernel space.
An individual computer resource constructed and arranged for inclusion in a network of individual computer resources, which network includes at least one network security manager, said individual computer resource comprising:
- a CPU;
- a memory;
- a network interface card;
- an independent operating system which includes a user space and a kernel space;
- said independent operating system further including a portion for supporting applications running in said user space, and a portion, invisible to the user, for operating the computer resource resident in said kernel space;
- a security infrastructure including a computer code set constructed and arranged for loading into said kernel space of said operating system;
- said computer code set further including means for identifying and preventing attempts to insert computer instructions into said kernel space and/or through said kernel space into said user space from either within or without the network of individual computer resources which would alter the operation of said independent operating system of the individual computer resource;
- means for secure kernel-to-kernel communication over the network between said computer code set inside the kernel space of the independent operating system of the individual computer resource and a kernel space of an independent operating system of the at least one network security manager;
- wherein the kernel space of the independent operating system of the individual computer resource and the kernel space of the independent operating system of the network security manager are secured by the security infrastructure;
- wherein said computer code set further includes means to authenticate communications from the application in the user space to said computer code set resident in the kernel space;
- wherein said computer code set further includes means to assure that communications between a first authenticated application resident within the user space are secure as said communications move through the kernel space to a second authenticated application;
- and
- wherein said computer code set prevents the operating system code resident in the kernel space from locating one or more operating system call tables or portions thereof by encrypting one or more symbol tables or portions thereof in the operating system code resident in the kernel space.
A network of individual computer resources, said network of individual computer resources including a plurality of individual computer resources and at least one network security manager, wherein each individual computer resource in the network comprises:
- a CPU;
- a memory;
- a network interface card;
- an independent operating system which includes a user space and a kernel space;
- said independent operating system further including a portion for supporting applications running in said user space and a portion, invisible to the user, for operating the computer resource resident in the kernel space;
- a security infrastructure including a computer code set constructed and arranged for loading into said kernel space of said independent operating system;
- said computer code set including means for identifying and preventing attempts to insert computer instructions into said kernel space and/or through said kernel space into said user space from either within or without the network of individual computer resources which would alter the operation of the independent operating system of each individual computer resource in the network of individual computer resources;
- means for secure kernel to kernel communication over the network between said computer code set inside the kernel space of the independent operating system of the individual computer resource and a kernel space of an independent operating system of the at least one network security manager;
- wherein the kernel space of the independent operating system of the individual computer resource and the kernel space of the independent operating system of the network security manager are secured by the security infrastructure;
- wherein said computer code set further includes means to authenticate communications from the application in the user space to said computer code set resident in the kernel space;
- wherein said computer code set further includes means to assure that communications between a first authenticated application resident within the user space are secure as said communications move through the kernel space to a second authenticated application;
- and
- wherein said computer code set prevents the operating system code resident in the kernel space from locating one or more operating system call tables or portions thereof by encrypting one or more symbol tables or portions thereof in the operating system code resident in the kernel space.
A method for adding a security infrastructure to a network of individual computer resources wherein each individual computer resource in the network of individual computer resources has an independent operating system which includes a portion of the operating system for supporting applications running in the user space of the independent operating system and a portion of the operating system code, which is invisible to the user, for operating the individual computer resource and is resident in the kernel space of the independent operating system, said method for adding a security infrastructure to a network of individual computer resources comprising the steps of:
- loading a computer code set into the kernel space of the independent operating system of each computer resource in the network of computers, said computer code set including means for identifying and preventing attempts to insert computer instructions into the kernel space and/or through the kernel space into one or more user spaces from either within or without the network of individual computer resources which would alter the operation of the operating system of each computer resource in the network of individual computer resources;
- monitoring the security of the operating systems of the individual computer resources in the network of computer resources by secure kernel to kernel communications over the network between said computer code set inside the kernel space of the independent operating system of each computer resource in the network of computers and a kernel space of an independent operating system of a security manager;
- and
- wherein the kernel space of the independent operating system of each computer resource in the network of computers and the kernel space of the independent operating system of the security manager are secured by the security infrastructure;
- wherein said computer code set further includes means to authenticate communications from the application in the user space to the operating system code set resident in the kernel space;
- wherein said computer code set further includes means to assure that communications between a first authenticated application resident within the user space are secure as said communications move through the kernel space to a second authenticated application;
- and
- wherein said computer code set prevents the operating system code resident in the kernel space from locating one or more operating system call tables or portions thereof by encrypting one or more symbol tables or portions thereof in the operating system code resident in the kernel space.
Dependencies are inferred from the claim text.