Back to results
US 8,775,802 B1Granted
Computer security system and method
AssigneeSecure Vector, Inc.
InventorsJames B. Kargman, Peter Scott, Jeffrey Bromberger
Life of this patent
Estimating the term…
Abstract
A method is provided for protecting a computer system, comprising creating an isolated process, then assigning a first process group to the process; creating an additional group process within the first process group; performing a first determination by an application programming interface (API) that the additional group process is within the first process group, and as a result of the first determination, causing the additional group process to inherit and duplicate a handle of the process. Process communications and control within isolated groups is permitted freely, whereas process control by an isolated process for non-isolated processes or isolated processes in different groups is constrained or prohibited.
Claims12
A method for protecting a computer system, comprising:
- attaching a security descriptor to a process running on a processor of the computer system that has been previously started;
- associating with the security descriptor an isolation indicator that, by itself, indicates the process is to run in an isolation mode, thereby rendering it as an isolated process, the isolated process running with non-isolated processes in a common environment;
- calling a kernel routine by the isolated process that is also callable by a non-isolated process that is not running in isolation mode;
- attempting to write to an object of a disk or a registry by the kernel routine called by the isolated process;
- determining, by a filter driver running in kernel mode, whether the kernel routine is requesting the write on behalf of the isolated process or the non-isolated process;
- if the write is requested on behalf of the isolated process, then performing the write in a pseudo storage area;
- and
- if the write is requested on behalf of the non-isolated process, then performing the write in an actual storage area in which the disk, registry, or other actual system or process data resides;
- wherein if the requested write is a first object write, then copying the object from the actual storage area to the pseudo storage area;
- assigning a first process group to the isolated process;
- creating an additional group process within the first process group;
- performing a first determination by an application programming interface (API) that the additional group process is within the first process group, and as a result of the first determination, causing the additional group process to inherit and duplicate a handle of the isolated process.
9 more elements
A method for protecting a computer system, comprising:
- attaching a security descriptor to a process running on a processor of the computer system that has been previously started;
- associating with the security descriptor an isolation indicator that, by itself, indicates the process is to run in an isolation mode, thereby rendering it as an isolated process, the isolated process running with non-isolated processes in a common environment;
- calling a kernel routine by the isolated process that is also callable by a non-isolated process that is not running in isolation mode;
- attempting to write to an object of a disk or a registry by the kernel routine called by the isolated process;
- determining, by a filter driver running in kernel mode, whether the kernel routine is requesting the write on behalf of the isolated process or the non-isolated process;
- if the write is requested on behalf of the isolated process, then performing the write in a pseudo storage area;
- and
- if the write is requested on behalf of the non-isolated process, then performing the write in an actual storage area in which the disk, registry, or other actual system or process data resides;
- wherein if the requested write is a first object write, then copying the object from the actual storage area to the pseudo storage area;
- utilizing a communication element that allows inter-process communication between the isolated process and an other isolated process within a first process group, but blocks inter-process communication between the isolated process and a further process that is not within the first process group.
7 more elements
A method for protecting a computer system, comprising:
- attaching a security descriptor to a process running on a processor of the computer system that has been previously started;
- associating with the security descriptor an isolation indicator that, by itself, indicates the process is to run in an isolation mode, thereby rendering it as an isolated process, the isolated process running with non-isolated processes in a common environment;
- calling a kernel routine by the isolated process that is also callable by a non-isolated process that is not running in isolation mode;
- attempting to write to an object of a disk or a registry by the kernel routine called by the isolated process;
- determining, by a filter driver running in kernel mode, whether the kernel routine is requesting the write on behalf of the isolated process or the non-isolated process;
- if the write is requested on behalf of the isolated process, then performing the write in a pseudo storage area;
- and
- if the write is requested on behalf of the non-isolated process, then performing the write in an actual storage area in which the disk, registry, or other actual system or process data resides;
- wherein if the requested write is a first object write, then copying the object from the actual storage area to the pseudo storage area;
- providing a user mode library for patching import and export tables for isolated process groups to control the isolated process from performing calls into system application program interface routines that could allow the isolated process from modifying, controlling, or terminating the non-isolated process or a process from a different process group.
7 more elements
Dependencies are inferred from the claim text.