Patent ID: 7398389

Claim:
A security infrastructure for a network of a plurality of individual computer resources wherein each individual computer resource in the network of individual computer resources has an independent operating system which includes a portion of the operating system for supporting applications running in the user space of the independent operating system and a portion of the operating system, which is invisible to the user, for operating the individual computer resource and is resident in the kernel space of the independent operating system, said plurality of individual computer resources comprising a CPU, a memory, and a network interface card, said security infrastructure comprising: a computer code set constructed and arranged for loading into the kernel space of the independent operating system of each of said plurality of computer resources in the network of computer resources in the network of computer resources; said computer code set including means for identifying and preventing attempts to insert computer instructions into the kernel space and/or through the kernel space into one or more user spaces from either within or without the network of individual computer resources which computer instructions would alter the operation of the independent operating system of each computer resource in the network of computer resources; a security manager, which acts as a server in said computer network; said security manager including said computer code set loaded into the kernel space of the independent operating system of said security manager; said computer code set adapted to enable secure kernel-to-kernel communication over the network with and for monitoring the security of said computer code set constructed and arranged for loading into the kernel space of the operating system of each of said plurality of individual computer resources; wherein the kernel space of the independent operating system of each of the plurality of individual computer resources and the kernel space of the independent operating system of the security manager are secured by the security infrastructure; wherein said computer code set further includes means to authenticate communications from the application in the user space to said computer code set resident in the kernel space; wherein said computer code set further includes means to assure that communications between a first authenticated application resident within the user space are secure as said communications move through the kernel space to a second authenticated application; and wherein said computer code set prevents the operating system code resident in the kernel space from locating one or more operating system call tables or portions thereof by encrypting one or more symbol tables or portions thereof in the operating system code resident in the kernel space.