Source: https://patents.google.com/patent/US8595170B2/en
Timestamp: 2019-10-19 18:22:04
Document Index: 441326963

Matched Legal Cases: ['§119', 'application No. 008153343', 'Application No. 08153343', 'application No. 08', 'application No. 008153343', 'application No. 08']

US8595170B2 - Stateful reference monitor - Google Patents
US8595170B2
US8595170B2 US11/865,344 US86534407A US8595170B2 US 8595170 B2 US8595170 B2 US 8595170B2 US 86534407 A US86534407 A US 86534407A US 8595170 B2 US8595170 B2 US 8595170B2
US11/865,344
US20080022359A1 (en
2007-10-01 Priority to US11/865,344 priority patent/US8595170B2/en
2008-01-24 Publication of US20080022359A1 publication Critical patent/US20080022359A1/en
2008-10-08 Assigned to CISCO TECHNOLOGY, INC. reassignment CISCO TECHNOLOGY, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CISCO SYSTEMS, INC.
2013-11-26 Publication of US8595170B2 publication Critical patent/US8595170B2/en
229940004975 INTERCEPTOR Drugs 0 claims description 16
The present application is a continuation of U.S. application Ser. No. 10/071,328, filed on Feb. 8, 2002, issued as U.S. Pat. No. 7,290,266 on Oct. 30, 2007, which claims priority under 35 U.S.C. §119(e) to U.S. Provisional Patent Application Ser. No. 60/298,590, filed on Jun. 14, 2001.
While (!done) { get next instruction switch (Opcode) { case 1: Action 1 case 2: Action 2 case 3: Action 3 } }
{ get next instruction switch (opcode) { case realOpcode 1: replace opcode by integer = 1; case realOpcode 2: replace opcode by integer = 2; ... } }
The stateful reference monitor 104 uses a state database 207 to hold information for periods of time, and uses this information to improve the quality of its decisions.
This request is broken down into fields, and each field is copied into a separate location in the state database 207. Additionally, the type of request is noted.
1. A real-time stateful reference monitor software product comprising, on a non-transitory machine-readable medium, a sequence of instructions defining:
a storage area where real-time state information is stored and from which the real-time state information is restored;
wherein the real-time state information comprises information that events associated with a first user, occurred within a certain time, and that events associated with a second user occurred at a particular time; and wherein the real-time state information is dynamically updated as the events, associated with the first user and the second user, are received at the storage area;
plural interceptors identifying and governing activity of requests, from the first user and the second user, for operating system resources by enforcing a decision to allow or block the activity;
a monitor which computes a decision to allow or block a particular activity, from the first user, identified by a particular interceptor comprising:
a plurality of rules which define permissible resource references in view of the activity of requests identified by the interceptors, and in view of the real-time state information comprising both the events associated with the first user and the events associated with the second user;
a rule interpreter which applies the rules to the real-time state information including both the events associated with the first user and the events associated with the second user, and to the particular activity identified by the particular interceptor;
wherein the rules are triggered when the first user and the second user are different users, and the rules are not triggered when the first user and the second user are the same user.
2. The software product of claim 1, wherein at least one of the plural interceptors is a pre-existing element of a conventional computer operating system.
3. The software product of claim 1, wherein the rules can be modified without restarting the real-time reference monitor.
4. The software product of claim 3, wherein the storage area has contents which are preserved when the rules are modified.
5. The software product of claim 1, wherein the plural interceptors correspond to more than one resource type and wherein the storage area is a single storage area.
6. The software product of claim 1, further comprising:
7. The software product of claim 6, further comprising: an application program interface that can send messages to application programs on other systems.
8. The software product of claim 1, wherein the plural interceptors monitor two or more of file access, registry access, network access, object access, system call access, keyboard access, external inputs and user input.
9. The software product of claim 1, wherein the plural interceptors correspond to more than one resource type, the storage area is a single storage area, and the plural interceptors are operable to monitor at least two of file access, registry access, network access, object access, system call access, keyboard access, external inputs and user inputs.
10. A method of implementing a real-time stateful reference monitor, comprising the machine-implemented steps of:
intercepting, from a first user, an activity of requests for operating system resources;
storing the activity in a storage area, wherein the storage area contains real-time state information that are related to prior requests for the operating system resources and that are received from the first user and a second user;
wherein the real-time state information comprises information that events associated with the first user, occurred within a certain time, and events associated with the second user occurred at a particular time; and wherein the real-time state information is dynamically updated as the events, associated with the first user and the second user, are received at the storage area;
computing a decision to allow or block the activity, from the first user, based on an application of a set of rules to the activity and to the real-time state information including both the events associated with the first user and the events associated with the second user, wherein the set of rules defines permissible resource references in view of the activity and in view of the real-time state information comprising both the events associated with the first user and the events associated with the second user;
wherein the rules are triggered when the first user and the second user are different users, and the rules are not triggered when the first user and the second user are the same user;
governing the activity by enforcing the decision to allow or block the activity;
11. The method of claim 10, wherein the intercepting is done by a pre-existing element of a conventional computer operating system.
12. The method of claim 10, wherein the set of rules can be modified without restarting the real-time reference monitor.
13. The method of claim 12, wherein the storage area has contents which are preserved when the set of rules are modified.
14. The method of claim 10, wherein the activity corresponds to more than one resource type and wherein the storage area is a single storage area.
15. The method of claim 10, further comprising: sending a message to an application program on the same system.
16. The method of claim 15, further comprising: sending a message to an application program on a different system.
17. The method of claim 10, wherein the intercepting further comprises monitoring two or more of file access, registry access, network access, object access, system call access, keyboard access, external inputs and user input.
18. The method of claim 10, wherein the activity corresponds to more than one resource type, the storage area is a single storage area, and the intercepting further comprises monitoring two or more of file access, registry access, network access, object access, system call access, keyboard access, external inputs and user input.
US11/865,344 2001-06-14 2007-10-01 Stateful reference monitor Active 2025-01-18 US8595170B2 (en)
US10/071,328 Continuation US7290266B2 (en) 2001-06-14 2002-02-08 Access control by a real-time stateful reference monitor with a state collection training mode and a lockdown mode for detecting predetermined patterns of events indicative of requests for operating system resources resulting in a decision to allow or block activity identified in a sequence of events based on a rule set defining a processing policy
US14/089,109 Continuation US9141812B2 (en) 2001-06-14 2013-11-25 Stateful reference monitor
US20080022359A1 US20080022359A1 (en) 2008-01-24
US8595170B2 true US8595170B2 (en) 2013-11-26
DE102006035275A1 (en) 2006-07-27 2008-01-31 Sia Syncrosoft A method of managing resources
Benatar,M. et al. "Access control systems: From host-centric to network-centric computing", IBM Systems Journal, vol. 35, No. 1. 1996. *
Beznosov,K. "Engineering Access Control for Distributed Enterprise Applications" PhD Disseration, Florida Internationsl University, Miami, Florida. Jul. 18, 2000. *
Communication from EPC for foreign patent application No. 008153343.2 dated Aug. 30, 2011, 4 pages.
Communication Pursuant to Article 94(3) EPC, in co-pending European Patent Application No. 08153343.2-2212/1944676 having an issuance date of Feb. 24, 2009.
Current Claims in application No. 08 153 343.2-1956, dated Apr. 2013, 2 pages.
Current claims in EPC patent application No. 008153343.2., 2 pages, dated Aug. 2011.
Debar,H. et al. "A revised taxonomy for intrusion-detection systems" Annals of Telecommunications vol. 55. No. 7-8. DOI: 10.1007/BF02994844. Jul. 2000. pp. 361-378. *
European Patent Office, "Search Report" in application No. 08 153 343.2-1956 dated Apr. 16, 2013, 4 pages.
Google Groups, "Windows NT Security for Paranoid Systems Administrator", dated May 3, 2000, 8 pages.
Ilgun, K. et al. "State Transition Analysis: A Rule-Based Intrusion Detection Approach". IEEE Trans. on Software Engineering, vol. 21, No. 3, Mar. 1995. pp. 181-199. *
Jaeger,T. et al. "Operating System Protection for Fine-Grained Programs" Proc. of the 7th USENIX Security Symposium. San Antonio, Texas, Jan. 26-29, 1998. 16 pages. *
Kaplan,Y. "API Spying Techniqes for Windows 9x, NT and 2000", 2000. *
Kozubik, J., "Windows NT Security for the Paranoid System Administrator" dated May 3, 2000, 8 pages.
Reference Monitor, Wikipedia, http://en.wikipedia.org/wiki/Reference-monitor, 2 pages.
Reference Monitor, Wikipedia, http://en.wikipedia.org/wiki/Reference—monitor, 2 pages.
Wikipedia, "Reference Monitor" last modified on Jul. 21, 2011, 2 pages.
Windows NT Security for the Paranoid System Administrator by J. Kozubik, Internet Citation May 3, 2000, retrieved form the Internet: URL:http//groups.google.com/groups (XP-002259631); retrieved on Oct. 29, 2003.
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CISCO SYSTEMS, INC.;REEL/FRAME:021652/0147