Abstract:
Application authorization management is provided without installation of an agent at an operating system level. A component runs outside of the operating system, in an AMT environment. AMT is utilized to examine the operating system for applications. Identified applications are checked against a whitelist or a blacklist. Responsive to determining that an identified application is not authorized, AMT is used to redirect input/output requests targeting the application to an alternative image, which can, for example, warn the user that the application is not authorized.

Description:
TECHNICAL FIELD 
     This invention pertains generally to computer security, and more specifically to enforcing application management on a computer without requiring direct interaction with the operating system. 
     BACKGROUND 
     Computer security software, such as policy enforcement and configuration management solutions, typically requires deployment of an agent within the operating system of the computer being protected. However, the act of agent deployment itself assumes the existence of a level of control and management over the computers to be protected which often does not exist. It is the very computers for which such control is not available that are most in need of protection. 
     Active management technology (AMT), such as Intel&#39;s vPro AMT, is a hardware based technology that provides a runtime environment separate and independent from that of the main general purpose operating system. AMT typically uses a secondary processor on the motherboard of a computer to enable “out of band” interaction with the main operating system. In addition to running independently of the general purpose operating system, the AMT environment can be communicated with independently. It would be desirable to leverage the AMT environment to address the computer security shortcomings discussed above. 
     SUMMARY 
     Application authorization management is provided without installation of an agent at an operating system level. A component runs outside of the operating system, in an AMT environment. AMT is utilized to examine the operating system for applications. Identified applications are checked against a whitelist or a blacklist. Responsive to determining that an identified application is not authorized, AMT is used to redirect input/output requests targeting the application to an alternative image, which can, for example, warn the user that the application is not authorized. 
     The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram illustrating providing application blacklisting and whitelisting without installation of an agent at an operating system level, according to some embodiments of the present invention. 
         FIG. 2  is a flowchart illustrating steps for application whitelisting without installation of an agent at an operating system level, according to some embodiments of the present invention. 
     
    
    
     The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
     DETAILED DESCRIPTION 
       FIG. 1  illustrates a system for providing application blacklisting/whitelisting without installation of an agent at an operating system level, according to some embodiments of the present invention. It is to be understood that although various components are illustrated and described above as separate entities, each illustrated component represents a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a component is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries. 
     As illustrated in  FIG. 1 , a security component  101  runs “out of band” in an AMT environment  103  on a computer  105 , without directly interacting with the operating system  107 . The security component  101  communicates with the AMT  103  in order to perform an examination of the operating system  107  image for applications  109 , all without running an agent on the operating system  107 . The security component then runs a security check on found applications  109  to determine whether they are authorized to be run on the computer  105 . This security check can comprise determining whether each found application  109  is on a whitelist  111  of applications  109  permitted to be run on the computer  105 , and/or determining whether the applications  109  are present on a blacklist  113  of disallowed entities. This/these list(s)  111 / 113  can be local, or the checks can be in the form of a query made to a remote entity (e.g., a server, not illustrated) on which the list(s)  111 / 113  is/are maintained. In other embodiments, the security check can comprise an action other than a whitelist  111 /blacklist  113  check. For example, the security check can be in the form of a heuristic analysis to identify suspicious applications and/or checking the application for known malicious code signatures. 
     Responsive to determining that an application  109  is not legitimate, the security component  101  uses the virtualization of block input/output (IO) feature of AMT  103  to manage the application  109 . More specifically, when the security component  101  identifies a suspect application  109 , it uses the AMT block virtualization to remap the blocks containing the application file  109  (or in some embodiments its file table (e.g., MFT) entry), such that the security component  101  provides an alternative “image”  115  of the file  109  to the operating system  107 , through the AMT  103 . In other words, I/O requests for the file table entry record or its related sectors are redirected to alternative sectors, on which the alternative image  115  is stored. In some embodiments, the alternative image  115  is stored on the same physical disk as the original file  109  (which remains unmoved and unmodified). In other embodiments, the alternative image  115  is stored remotely (not illustrated). The redirected alternative image  115  can comprise, for example, no operation (NOP) code, or code that provides a notification to the user that the application  109  is not approved for execution on the computer  105 . It is to be understood that in different operating environments, file table entries are in different internal formats based on the file system instantiation (e.g., FAT and NTFS (MFT) under Windows, for Linux iNodes, etc.). All such file system formats are within the scope of different embodiments of the present invention. 
     It is to be understood that an alternative image  115  is typically specific to a given set of operating systems (e.g., Windows, Linux, etc.). For example, Linux code to notify the user that the application  109  is not approved would not likely run under Windows, etc. To address this, a group of alternative images  115  can be maintained, one (or more) for each supported platform. Because only so many operating system sets would likely be supported, the number of alternative images  115  used in the various embodiments would be very manageable. 
     Note that the main operating system  107  does not contain any type of agent, nor is it aware that the underlying translation occurs. Note further that no changes are actually made to the file system. Instead, the security agent  101  simply redirects I/O requests for the application  109  to the alternative image  115 . 
       FIG. 2  illustrates steps for application  109  whitelisting without installation of an agent at an operating system level, according to some embodiments of the present invention. As illustrated in  FIG. 2 , the security component  101  communicates  201  with the AMT  103 , in order to scan  203  the operating system for applications  109 . The security component  101  compares  205  found applications  109  to a whitelist  111  of permitted applications  109 . Responsive to determining  207  that a given application  109  is not on the whitelist  111 , the security component  101  utilizes the AMT virtualization of block IO feature to redirect  209  I/O requests for the application  109  to an alternative image  115 , which warns the user that the application  109  is not permitted to run on the computer  105 . 
     As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Furthermore, it will be readily apparent to those of ordinary skill in the relevant art that where the present invention is implemented in whole or in part in software, the software components thereof can be stored on computer readable media as computer program products. Any form of computer readable medium can be used in this context, such as magnetic or optical storage media. Additionally, software portions of the present invention can be instantiated (for example as object code or executable images) within the memory of any computing device. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.