Registry monitoring system and method
A registry monitoring method particularly applicable to a system ( 100 ) in which protected data is transmitted to a recipient computer. The method comprises requesting a handle for a registry key to a calling process, requesting a registry key value for the handle, modifying and deleting keys and values of protected data locations, and obtaining security clearance to complete the requests by checking secured process lists and rejection lists. Also included are a registry monitoring system, a secured data transmission system including registry monitorings, a machine-readable medium comprising a program to monitor a registry ( 110 ), and a computer configured to monitor a registry ( 110 ).
1. A method of monitoring a registry comprising:
requesting a handle for a registry key to a calling process;
requesting a registry key value for the handle; and
obtaining security clearance to complete the requests, wherein at least one security clearance parameter has an adjustable threshold, said threshold being adjustable by a system command in association with one or more of the requests, and wherein obtaining said security clearance includes:
(i.) determining a process ID and registry key value;
(ii.) determining whether the process is secured by checking a secured process list;
(iii.) if the process is secured, determining whether the registry key is on the rejection list;
(iv.) if the registry key is on the rejection list, denying the process access to the registry key value;
(v.) if the process is not on the secured list, completing the request;
(vi.) if the registry key is not on the rejection list and the process is on the secured process list, processing the value request and determining whether the value is on the rejection list;
(vii.) if the value is not on the rejection list, allowing the request to be completed; and
(viii.) if the value is on the rejection list, denying access to the registry key value.
2. The method of claim 1 further comprising after requesting a handle for a registry key to a calling process:
determining a process ID and registry key;
determining whether the process is secured by checking a secured process list;
if the process is secured, determining whether the registry key is on a rejection list;
if the registry key is on the rejection list, denying the process access to the registry key; and
if the process is not on the secured list or if the registry key name is not on the rejection list, completing the request.
3. The method of claim 1 further comprising after modifying and deleting handles and values:
determining a process ID;
determining whether the process is secured by checking whether the process is on a secured process list;
if the process is not on the secured process list, completing the request; and
if the process is on the secured process list, not allowing the request to be completed.
4. A registry monitoring system wherein the registry is monitored by a method comprising:
requesting a handle for a registry key to a calling process;
requesting a registry key value for the handle; and
obtaining security clearance to complete the requests, wherein at least one security clearance permission has an adjustable thresholds, wherein said threshold is reestablished in association with one or more of the requests, and wherein obtaining said security clearance includes:
(i.) determining a process ID and registry key value;
(ii.) determining whether the process is secured by checking a secured process list;
(iii.) if the process is secured, determining whether the registry key is on the rejection list;
(iv.) if the registry key is on the rejection list, denying the process access to the registry key value;
(v.) if the process is not on the secured list, completing the request;
(vi.) if the registry key is not on the rejection list and the process is on the secured process list, processing the value request and determining whether the value is on the rejection list;
(vii.) if the value is not on the rejection list, allowing the request to be completed; and
(viii.) if the value is on the rejection list, denying access to the registry key value.
5. The registry monitoring system of claim 4 further comprising after requesting a handle for a registry key to a calling process:
determining a process ID and registry key;
determining whether the process is secured by checking a secured process list;
if the process is secured, determining whether the registry key is on a rejection list;
if the registry key is on the rejection list, denying the process access to the registry key; and
if the process is not on the secured list or if the registry key name is not on the rejection list, completing the request.
6. The registry monitoring system of claim 4 further comprising after modifying and deleting handles and values:
determining a process ID;
determining whether the process is secured by checking whether the process is on a secured process list;
if the process is not on the secured process list, completing the request; and
if the process is on the secured process list, not allowing the request to be completed.
7. A computer configured to monitor a registry according to a method comprising:
requesting a handle for a registry key to a calling process;
requesting a registry key value for the handle;
obtaining security clearance to complete the requests, wherein obtaining said security clearance includes:
(i.) determining a process ID and registry key value;
(ii.) determining whether the process is secured by checking a secured process list;
(iii.) if the process is secured, determining whether the registry key is on the rejection list;
(iv.) if the registry key is on the rejection list, denying the process access to the registry key value;
(v.) if the process is not on the secured list, completing the request;
(vi.) if the registry key is not on the rejection list and the process is on the secured process list, processing the value request and determining whether the value is on the rejection list;
(vii.) if the value is not on the rejection list, allowing the request to be completed; and
(viii.) if the value is on the rejection list, denying access to the registry key value; and
adjusting a threshold of at least one security clearance parameter, said threshold being adjustable in association with one or more of the requests.
8. The computer of claim 7 further comprising after requesting a handle for a registry key to a calling process:
determining a process ID and registry key;
determining whether the process is secured by checking a secured process list;
if the process is secured, determining whether the registry key is on a rejection list;
if the registry key is on the rejection list, denying the process access to the registry key; and
if the process is not on the secured list or if the registry key name is not on the rejection list, completing the request.
9. The computer of claim 7 further comprising after modifying and deleting handles and values:
determining a process ID;
determining whether the process is secured by checking whether the process is on a secured process list;
if the process is not on the secured process list, completing the request; and
if the process is on the secured process list, not allowing the request to be completed.
10. A machine-readable medium comprising a program to monitor a registry according to a method comprising:
requesting a handle for a registry key to a calling process;
requesting a registry key value for the handle;
obtaining security clearance to complete the requests, wherein obtaining said security clearance includes:
(i.) determining a process ID and registry key value;
(ii.) determining whether the process is secured by checking a secured process list;
(iii.) if the process is secured, determining whether the registry key is on the rejection list;
(iv.) if the registry key is on the rejection list, denying the process access to the registry key value;
(v.) if the process is not on the secured list, completing the request;
(vi.) if the registry key is not on the rejection list and the process is on the secured process list, processing the value request and determining whether the value is on the rejection list;
(vii.) if the value is not on the rejection list, allowing the request to be completed; and
(viii.) if the value is on the rejection list, denying access to the registry key value; and
adjusting a threshold of at least one security clearance permission, said threshold being adjustable in association with one or more of the requests.
11. The machine-readable medium of claim 10 further comprising after requesting a handle for a registry key to a calling process:
determining a process ID and registry key;
determining whether the process is secured by checking a secured process list;
if the process is secured, determining whether the registry key is on a rejection list;
if the registry key is on the rejection list, denying the process access to the registry key; and
if the process is not on the secured list or if the registry key name is not on the rejection list, completing the request.
12. The machine-readable medium of claim 10 further comprising after modifying and deleting handles and values:
determining a process ID;
determining whether the process is secured by checking whether the process is on a secured process list;
if the process is not on the secured process list, completing the request; and
if the process is on the secured process list, not allowing the request to be completed.
13. A computer implemented secured data transmission system having a receiver to access secured file content provided by a sender, wherein the receiver includes a registry monitoring system wherein the registry is monitored by a method comprising:
requesting a handle for a registry key to a calling process;
requesting a registry key value for the handle; and
obtaining security clearance to complete the requests, wherein a threshold of at least one security clearance parameter is adjustable via a system command in association with one or more of the requests, and wherein obtaining said security clearance includes:
(i.) determining a process ID and registry key value;
(ii.) determining whether the process is secured by checking a secured process list;
(iii.) if the process is secured, determining whether the registry key is on the rejection list;
(iv.) if the registry key is on the rejection list, denying the process access to the registry key value;
(v.) if the process is not on the secured list, completing the request;
(vi.) if the registry key is not on the rejection list and the process is on the secured process list, processing the value request and determining whether the value is on the rejection list;
(vii.) if the value is not on the rejection list allowing the request to be completed; and
(viii.) if the value is on the rejection list denying access to the registry key value.
14. The computer implemented secured data transmission system of claim 13 further comprising after requesting a handle for a registry key to a calling process:
determining a process ID and registry key;
determining whether the process is secured by checking a secured process list;
if the process is secured, determining whether the registry key is on a rejection list;
if the registry key is on the rejection list, denying the process access to the registry key; and
if the process is not on the secured list or if the registry key name is not on the rejection list, completing the request.
15. The computer implemented secured data transmission system of claim 13 further comprising after modifying and deleting handles and values:
determining a process ID;
determining whether the process is secured by checking whether the process is on a secured process list;
if the process is not on the secured process list, completing the request; and
if the process is on the secured process list, not allowing the request to be completed.
16. A registry monitoring system comprising:
at least one machine-readable medium for:
receiving a handle request for a registry key to a calling process; receiving a registry key value request for the handle; granting security clearance to complete the requests according to a method comprising:
(i.) determining a process ID and registry key value;
(ii.) determining whether the process is secured by checking a secured process list;
(iii.) if the process is secured, determining whether the registry key is on the rejection list;
(iv.) if the registry key is on the rejection list, denying the process access to the registry key value;
(v.) if the process is not on the secured list, completing the request;
(vi.) if the registry key is not on the rejection list and the process is on the secured process list, processing the value request and determining whether the value is on the rejection list;
(vii.) if the value is not on the rejection list, allowing the request to be completed; and
(viii.) if the value is on the rejection list, denying access to the registry key value; and adjusting a threshold of at least one security clearance permission by a system command, said threshold being adjustable in association with one or more of the requests.
17. The registry monitoring system of claim 16 , further comprising denying security clearance when at least one security clearance permission is satisfied.
18. The registry monitoring system of claim 16 , wherein said at least one security clearance permission is associated with the elapsed time since said handle or registry key value has been previously requested.
19. The registry monitoring system of claim 16 , wherein said at least one security clearance permission is associated with the number of times said handle or registry key value has been previously requested.
20. The registry monitoring system of claim 16 , wherein said at least one security clearance permission is associated with the date in which said handle or registry key value was previously requested.
21. The registry monitoring system of claim 16 , wherein said at least one security clearance permission is associated with the accumulated time said handle or registry key value has been previously accessed.
22. The registry monitoring system of claim 21 , wherein said previous access includes modifying and deleting keys and values of protected data locations.
23. The registry monitoring system of claim 16 , wherein said at least one machine-readable medium includes at least one device driver.
24. A method of monitoring a registry comprising:
receiving a handle request for a registry key to a calling process;
receiving a registry key value request for the handle;
granting security clearance to complete the requests according to a method comprising:
(i.) determining a process ID and registry key value;
(ii.) determining whether the process is secured by checking a secured process list;
(iii.) if the process is secured, determining whether the registry key is on the rejection list;
(iv.) if the registry key is on the rejection list, denying the process access to the registry key value;
(v.) if the process is not on the secured list, completing the request;
(vi.) if the registry key is not on the rejection list and the process is on the secured process list, processing the value request and determining whether the value is on the rejection list;
(vii.) if the value is not on the rejection list, allowing the request to be completed; and
(viii.) if the value is on the rejection list, denying access to the registry key value; and
adjusting a threshold of at least one security clearance parameter, said threshold being adjustable in association with one or more of the requests.
25. The method of claim 24 , further comprising denying security clearance when at least one security clearance parameter is satisfied.
26. The method of claim 24 , wherein said at least one security clearance parameter is associated with the elapsed time since said handle or registry key value has been previously requested.
27. The method of claim 24 , wherein said at least one security clearance parameter is associated with the number of times said handle or registry key value has been previously requested.
28. The method of claim 24 , wherein said at least one security clearance parameter is associated with the date in which said handle or registry key value was previously requested.
29. The method of claim 24 , wherein said at least one security clearance parameter is associated with the accumulated time said handle or registry key value has been previously accessed.
30. The method of claim 29 , wherein said previous access includes modifying and deleting keys and values of protected data locations.