KERNEL-BASED PROTECTION OF COMPUTER PROCESSES

Computer security apparatus including a kernel driver configured to be executed by a computer in a kernel mode and to thereupon perform protecting a process of a first computer software application executed by the computer, where the protecting is performed in accordance with a protection policy, receiving an instruction from the process to modify the protection policy, modifying the protection policy in accordance with the instruction, and protecting the process in accordance with the protection policy after it has been modified in accordance with the instruction.

FIELD

The invention relates generally to computer security.

BACKGROUND

Modern computer operating system typically maintain separate “user space” and “kernel space” regions of computer memory. Kernel space is accessed directly by operating system components, a main component of which is known as the “kernel,” as well as by various kernel drivers and hardware device drivers, when they are executed by the computer's central processing unit (CPU) in “kernel mode”. User space memory is allocated to user processes, which are instances of software applications that are not operating system components, such as web browsers and word processing software, where user processes are typically executed by the CPU in “user mode”. Kernel space can be accessed by user processes only indirectly through the use of system calls, which are requests that are sent by user processes to the operating system, where such requests are for services that are performed by the kernel.

One common kernel task is to protect user processes and their associated resources by simply preventing access thereto by other user processes. However, as malicious parties employ various ways to compromise computer security, new computer security methods ought to be contemplated.

SUMMARY

In one aspect of the invention a computer security method is provided including protecting a process of a first computer software application executed by a computer, where the protecting is performed in accordance with a protection policy, receiving an instruction from the process to modify the protection policy, modifying the protection policy in accordance with the instruction, and protecting the process in accordance with the protection policy after it has been modified in accordance with the instruction, where the protecting, receiving, and modifying are performed by a kernel driver executed by the computer.

In another aspect of the invention any of the protecting, receiving, and modifying are performed after determining that a digital signature is valid, where the digital signature is of an executable file of the first computer software application, and where the determining is performed by the kernel driver executed by the computer.

In another aspect of the invention the protecting includes detecting an attempt, by a process of a second computer software application executed by the computer, to access an object associated with the first computer software application, determining whether a digital signature is valid, where the digital signature is of an executable file of the second computer software application, and allowing or preventing access to the object by the second computer software application in accordance with the protection policy, where the protection policy is at least partly based on whether the digital signature is valid, where the detecting, determining, allowing, and preventing are performed by the kernel driver executed by the computer.

In another aspect of the invention the protecting includes receiving a decryption key from the process of the first computer software application, receiving a request from the process of the first computer software application to receive the decryption key, determining whether a digital signature is valid, where the digital signature is of the first computer software application, and providing or not providing the decryption key to the process in accordance with the protection policy, where the protection policy is at least partly based on whether the digital signature is valid, where the receiving, determining, allowing, providing, and not providing are performed by the kernel driver executed by the computer.

In another aspect of the invention the method further includes encrypting the decryption key after receiving the decryption key from the process of the first computer software application, and decrypting the encrypted decryption key, if the digital signature is valid, prior to providing the decryption key to the process of the first computer software application.

In another aspect of the invention the protecting includes receiving an encrypted message from the process of the first computer software application, where the message is encrypted using a public key of a key pair, determining whether a digital signature is valid, where the digital signature is of an executable file of the first computer software application, and if the digital signature is valid, decrypting the encrypted message using a private key of the key pair, encrypting a response to the message using the private key, and providing the encrypted response to the process of the first computer software application, where the receiving, determining, decrypting, encrypting, and providing are performed by the kernel driver executed by the computer.

In another aspect of the invention computer security apparatus is provided including a kernel driver configured to be executed by a computer in a kernel mode and thereupon to perform protecting a process of a first computer software application executed by the computer, where the protecting is performed in accordance with a protection policy, receiving an instruction from the process to modify the protection policy, modifying the protection policy in accordance with the instruction, and protecting the process in accordance with the protection policy after it has been modified in accordance with the instruction.

In another aspect of the invention the kernel driver is configured to perform any of the protecting, receiving, and modifying after the kernel driver determines that a digital signature is valid, where the digital signature is of an executable file of the first computer software application.

In another aspect of the invention the kernel driver is configured to perform the protecting by detecting an attempt, by a process of a second computer software application executed by the computer, to access an object associated with the first computer software application, determining whether a digital signature is valid, where the digital signature is of an executable file of the second computer software application, and allowing or preventing access to the object by the second computer software application in accordance with the protection policy, where the protection policy is at least partly based on whether the digital signature is valid.

In another aspect of the invention the kernel driver is configured to perform the protecting by receiving a decryption key from the process of the first computer software application, receiving a request from the process of the first computer software application to receive the decryption key, determining whether a digital signature is valid, where the digital signature is of the first computer software application, and providing or not providing the decryption key to the process in accordance with the protection policy, where the protection policy is at least partly based on whether the digital signature is valid, where the receiving, determining, allowing, providing, and not providing are performed by the kernel driver executed by the computer.

In another aspect of the invention the kernel driver is configured to encrypt the decryption key after receiving the decryption key from the process of the first computer software application, and decrypt the encrypted decryption key, if the digital signature is valid, prior to providing the decryption key to the process of the first computer software application.

In another aspect of the invention the kernel driver is configured to perform the protecting by receiving an encrypted message from the process of the first computer software application, where the message is encrypted using a public key of a key pair, determining whether a digital signature is valid, where the digital signature is of an executable file of the first computer software application, and if the digital signature is valid, decrypting the encrypted message using a private key of the key pair, encrypting a response to the message using the private key, and providing the encrypted response to the process of the first computer software application.

In another aspect of the invention the first computer software application is a web browser.

In another aspect of the invention where the object is a process or a thread of a process.

DETAILED DESCRIPTION

Reference is now made toFIG.1, which is a simplified conceptual illustration of a computer security system, constructed and operative in accordance with an embodiment of the invention, and additionally toFIGS.2and3, which are simplified flowchart diagrams of exemplary methods of operation of the system ofFIG.1, operative in accordance with an embodiment of the invention. In the system ofFIG.1and methods ofFIG.2andFIG.3, a kernel driver100is configured in accordance with conventional techniques to be executed by a computer102in kernel mode, such as where computer102runs the Windows™ operating system, commercially available from Microsoft Corporation of Redmond, WA.

In accordance with an embodiment of the invention, kernel driver100is configured to protect a process104, where process104is an instance of a computer software application106that is also executed by computer102. In one embodiment, computer software application106is a software application that is not an operating system component, such as the Enterprise Browser™, commercially available from Island Technology, Inc. of Dallas, TX, or another web browser or word processing software. In another embodiment, computer software application106is an operating system component, such as a kernel driver or a hardware device driver. In one embodiment, kernel driver100is configured to determine that computer software application106is among one or more specific computer software applications or types of computer software applications whose processes kernel driver100is configured to protect.

Further in accordance with an embodiment of the invention, kernel driver100is configured to protect process104in accordance with one or more protection policies, collectively referred to herein as protection policy108. In one embodiment, protection policy108is preconfigured with kernel driver100. In another embodiment, protection policy108is provided to kernel driver100, such as by process104or by an administrator of computer102. Protection policy108may indicate any type of protection known to be provided by any known operating system kernel or kernel driver for any process executed by a computer, such as by controlling access to process104or any object associated with process104, such as its memory space, threads, handles, process environment settings, execution contexts, process and thread environment blocks, and loaded modules.

Further in accordance with an embodiment of the invention, kernel driver100is configured to receive an instruction110from process104to modify protection policy108, such as in the form of a system call. In one example, protection policy108disallows requests by user processes other than process104to access locations within the memory of computer102that are allocated to process104, such as memory locations in which executable instructions of process104are stored and memory locations into which process104stores data. Instruction110then indicates that this protection is to be modified to allow requests by specified user processes to receive such access. Kernel driver100is further configured to modify protection policy108in accordance with instruction110, preferably after kernel driver100determines, in accordance with conventional techniques, that process104is authorized to provide such instructions. In one embodiment, kernel driver100determines that process104is so authorized by determining that a digital signature112of computer software application106is valid, such as where computer software application106is an executable file that was executed by computer102to create process104. Kernel driver100then continues to protect process104in accordance with protection policy108after it has been modified in accordance with instruction110.

In one embodiment, kernel driver100is configured to identify a process114as being an instance of a computer software application116that is also executed by computer102, for the purpose of enabling kernel driver100to determine, in accordance with protection policy108, whether or not requests by process114to be given access to process104or any object associated with process104are to be allowed. In one embodiment, kernel driver100is configured to determine that computer software application116is among one or more specific computer software applications or types of computer software applications that kernel driver100is configured to evaluate in this manner. In one embodiment, kernel driver100is configured to determine whether a digital signature118of computer software application116is valid, such as where computer software application116is an executable file that was executed by computer102to create process114, where protection policy108is at least partly based on whether the digital signature is valid. Where computer102runs the Windows™ operating system, kernel driver100may be configured to monitor access requests to process and thread objects by registering a callback to the OS object operation callback facility, such as by using the ObRegisterCallbacks routine family. Kernel driver100may be configured to specifically monitor access to PsProcessType and PsThreadType objects.

Reference is now made toFIG.4, which is a simplified conceptual illustration of a computer security system, constructed and operative in accordance with an embodiment of the invention, and additionally toFIG.5, which is a simplified flowchart diagram of an exemplary method of operation of the system ofFIG.4, operative in accordance with an embodiment of the invention. The system ofFIG.4is substantially similar to the system ofFIG.1except as is otherwise described hereinbelow. In the system ofFIG.4and method ofFIG.5, kernel driver100is configured to protect process104by receiving a decryption key400from process104, such as where process104uses decryption key400to decrypt data that are encrypted by process104. Kernel driver100then encrypts decryption key400, such as by using an encryption/decryption key402generated by kernel driver100or acquired elsewhere, and returns encrypted decryption key400, now denoted as element400′, to process104.

In one embodiment kernel driver100stores encryption/decryption key402in a special registry key that are protected by kernel driver100, in accordance with conventional techniques, from access by unauthorized processes. Where computer102runs the Windows™ operating system, this may be done by registering the kernel driver100as a registry filter driver using the kernel registry filtering infrastructure as provided by the CmRegisterCallback routine family and blocking access to the special registry key by any process, except when requested by process104and if allowed by protection policy108.

Thereafter, such as when process104wishes to decrypt data that may be decrypted using decryption key400, process104sends encrypted decryption key400′ to kernel driver100and requests its decryption, whereupon kernel driver100retrieves encryption/decryption key402, decrypts encrypted decryption key400′, and provides the decrypted decryption key400to process104. In this manner, process104need not maintain its own copy of decryption key400. In one embodiment, kernel driver100determines, as described above, whether digital signature112of process104's executable file, is valid, and then provides, or doesn't provide, decrypted decryption key400to process104in accordance with protection policy108, where protection policy108is at least partly based on whether the digital signature is valid. In one embodiment, encryption/decryption key402includes separate encryption and decryption keys to encrypt and decrypt decryption keys400and400′ respectively in accordance with conventional techniques.

Reference is now made toFIG.6, which is a simplified conceptual illustration of a computer security system, constructed and operative in accordance with an embodiment of the invention, and additionally toFIG.7, which is a simplified flowchart diagram of an exemplary method of operation of the system ofFIG.6, operative in accordance with an embodiment of the invention. The system ofFIG.6is substantially similar to the system ofFIG.1except as is otherwise described hereinbelow. In the system ofFIG.6and method ofFIG.7, kernel driver100is configured to receive a message600from process104, where message600is encrypted in accordance with conventional techniques, such as using a public key602of a key pair604that also includes a private key606, prior to kernel driver100receiving message600. Kernel driver100decrypts encrypted message600, such as using private key606, encrypts a response608, such as using private key606, and provides the encrypted response608to process104. In one embodiment, kernel driver100determines, as described above, whether digital signature112of process104's executable file, is valid, and then provides, or doesn't provide, encrypted response608to process104in accordance with protection policy108, where protection policy108is at least partly based on whether the digital signature is valid.

Any aspect of the invention described herein may be implemented in computer hardware and/or computer software embodied in a non-transitory, computer-readable medium in accordance with conventional techniques, the computer hardware including one or more computer processors, computer memories, I/O devices, and network interfaces that interoperate in accordance with conventional techniques.

The flowchart illustrations and block diagrams in the drawing figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the invention. In this regard, each block in the flowchart illustrations or block diagrams may represent a module, segment, or portion of computer instructions, which comprises one or more executable computer instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in a block may occur out of the order noted in the drawing figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the flowchart illustrations and block diagrams, and combinations of such blocks, can be implemented by special-purpose hardware-based and/or software-based systems that perform the specified functions or acts.

The descriptions of the various embodiments of the invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments.