Granted Patent B2

US 7,206,935 · App. 10/123,878 · Granted Apr 17, 2007

Abstract

Claims (52)

1. A method for protecting a network appliance against a security breach, comprising:

determining if an AP process is an AP aware process; determining if the AP process is an AP unaware process;

determining a current signature for the AP process executing on the network appliance;

determining an expected signature for the AP process; comparing the current signature with the expected signature; and

terminating the AP process when the current signature and expected signature do not match;

wherein the comparing occurs at predetermined intervals and the predetermined intervals relate to a clock speed of the network appliance.

2. The method in claim 1 , further comprising, sending an encrypted response to the AP aware process when the current signature and expected signature match.

3. The method in claim 1 , wherein determining the current signature further comprises: sending an initiation signal; and receiving the current signature from the AP process through a communication channel.

4. The method in claim 3 , wherein the communication channel uses a TCP/IP protocol.

5. The method in claim 1 , wherein determining the current signature further comprises; receiving the current signature from a process monitor if the AP process has been determined to be an AP unaware process.

6. The method in claim 1 , wherein the current signature and the expected signature comprises identification data associated with the AP process.

7. The method of claim 6 , wherein the identification data is selected from process identification, version information, memory usage, and run time data, associated with the AP process.

8. The method in claim 1 , further comprising determining if the process fails, and if the process fails, restarting the process.

9. The method of claim 1 , further comprising receiving an update message; and when the update message has been received: terminating the AP process; updating the AP process; and restarting the AP process.

10. A method for protecting a process on a network appliance against a security breach, comprising:

starting the process on the network appliance when the process is listed in a process list;

determining a current signature of the process;

determining an expected signature for the process;

determining if the signature is valid by comparing the current signature with the expected signature;

if the signature is not valid, terminating the process, otherwise, sending an encrypted response to the process; and

receiving an update message, and in response to receiving the update message updating the process, wherein updating the process further comprises: terminating the process; updating the process; and restarting the updated process when the update is complete.

11. The method of claim 10 , further comprising determining if the process fails, and if the process fails restarting the process.

12. The method of claim 10 , wherein the determining if the signature is valid by comparing, occurs at predetermined intervals and the predetermined intervals relate to a clock speed of the network appliance.

13. A network appliance, comprising:

a processor and a computer-readable medium;

an operating environment executing on the processor from the computer-readable medium;

a network interface unit arranged to communicate with a network;

a data store including an expected signature for a process; and

an appliance protector program executing under the control of the operating system and operative to perform actions, including: determining a current signature of the process, determining the expected signature of the process, determining when the signature is valid by comparing the current signature with the expected signature at predetermined intervals that relate to a clock speed of the network appliance, and, when the signature is determined to not be valid, terminating the process.

14. The network appliance of claim 13 , wherein the data store further comprises a process list; and wherein the appliance protector program starts processes listed within the process list.

15. The network appliance of claim 13 , wherein the data store further comprises encryption data; and when the appliance protector program determines when the signature is valid, the appliance protector sends a response that is encrypted using the encryption data.

16. The network appliance of claim 13 , further comprising an update process; wherein the update process updates the process.

17. The network appliance of claim 13 , wherein the appliance protector program is operative to perform actions including: receiving an update message, and in response to receiving the update message updating the process, wherein updating the process further comprises: terminating the process; updating the process; and restarting the updated process when the update is complete.

18. A network appliance, comprising:

processing means for executing an operating environment;

interface means for communicating with a network;

storing means for storing an expected signature for a process; and

appliance protection means for determining a current signature of the process, determining the expected signature of the process, determining if the signature is valid by comparing the current signature with the expected signature at predetermined intervals that relate to a clock speed of the network appliance, and, if the signature is determined to not be valid, terminating the process.

19. The network appliance of claim 18 , wherein the appliance protection means is arranged to perform: receiving an update message, and in response to receiving the update message updating the process, wherein updating the process further comprises: terminating the process; updating the process; and restarting the updated process when the update is complete.

20. A machine-readable medium comprising instructions for causing a computer to:

start a process on a network appliance if the process is listed in a process list;

determine a current signature of the process;

determine an expected signature for the process;

determine if the signature is valid by comparing the current signature with the expected signature at predetermined intervals that relate to a clock speed of the network appliance; and

if the signature is not valid, terminate the process, otherwise, send an encrypted response to the process.

21. the machine-readable medium of claim 20 , comprising instructions for causing a computer to perform: receiving an update message, and in response to receiving the update message updating the process, wherein updating the process further comprises: terminating the process; updating the process; and restarting the updated process when the update is complete.

22. A method for protecting a network appliance against a security breach, comprising:

determining if an AP process is an AP aware process; determining if the AP process is an AP unaware process;

determining a current signature for the AP process executing on the network appliance;

determining an expected signature for the AP process; comparing the current signature with the expected signature;

terminating the AP process when the current signature and expected signature do not match; and

receiving an update message; and when the update message has been received: terminating the AP process; updating the AP process; and restarting the AP process.

Assignments (9)