Patent ID: 7562214
Filing Date: 2009-07-14
Classification: G06F

Abstract:
1. A method for detecting an attack on a data processing system installed on a kernel layer, the method comprising, in the data processing system installed on the kernel layer: providing, at the kernel layer, an initial secret; binding, at the kernel layer, the initial secret to data indicative of an initial state of the system, which is installed on the kernel layer between a hardware layer and an operating system layer, via a collision resistant cryptographic function; recording, at the kernel layer, state changing administrative actions performed on the system in a log, the state changing administrative actions comprising one or more of: an installation of kernel modules and an alternation of system run-level codes; prior to performing each state changing administrative action, at the kernel layer, generating a new secret by performing the collision resistant cryptographic function on a combination of data indicative of the administrative action and the previous secret, erasing the previous secret, and recording the new secret in a place of the previous secret; evolving, at the kernel layer, the initial secret based on the log to produce an evolved secret; comparing, at the kernel layer, the evolved secret with the new secret; determining, at the kernel layer, that the system is uncorrupted if the comparison indicates a match between the evolved secret and the new secret; and determining, at the kernel layer, that the system is corrupted if the comparison indicates a mismatch between the evolved secret and the new secret, wherein the cryptographic function comprises a one-way hash function and the hash function comprises an exponentiation function.