IP Library › Granted Patent US 9,565,214
Granted Patent B2
US 9,565,214 · App. 15/056,563 · Granted Feb 7, 2017

Real-time module protection

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,565,214
App. No.
15/056,563
Granted
Feb 7, 2017
Kind
B2
Abstract

Technologies for securing an electronic device include trapping an attempt to access a secured system resource of the electronic device, determining a module associated with the attempt, determining a subsection of the module associated with the attempt, the subsection including a memory location associated with the attempt, accessing a security rule to determine whether to allow the attempted access based on the determination of the module and the determination of the subsection, and handling the attempt based on the security rule. The module includes a plurality of distinct subsections.

Claims (60)

1. At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the non-transitory machine readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:

identify an execution entity attempting to access a secured system resource of an electronic device;

identify a memory location including an instruction address within a subsection of the execution entity that caused the attempt;

determine a byte string corresponding to a range including the memory location that caused the attempt, the range to include a defined number of bytes surrounding the memory location; and

compare the byte string against mappings of the subsection in security rules to determine whether to allow the attempt based on the security rules.

2. The medium of claim 1 , wherein the memory location identifies a point of origin of the attempt.

3. The medium of claim 1 , further comprising instructions for causing the processor to:

identify another memory location as a target point of the attempt; and

access the security rule to determine whether to allow the attempt further based upon the target point of the attempt.

4. The medium of claim 1 , further comprising instructions for causing the processor to:

identify another subsection as a target of the attempt and as a data subsection; and

determine whether to allow the attempt further based upon the identification of the other subsection as a target of the attempted access and as a data subsection.

5. The medium of claim 1 , further comprising instructions for causing the processor to:

identify another subsection as a target of the attempt and as a header subsection; and

determine whether to allow the attempt further based upon the identification of the other subsection as a target of the attempt and as a header subsection.

6. The medium of claim 1 , further comprising instructions for causing the processor to:

identify another subsection as a target of the attempt and as a code subsection; and

determine whether to allow the attempt further based upon the identification of the other subsection as a target of the attempt and as a code subsection.

7. The medium of claim 1 , further comprising instructions for causing the processor to:

identify a target of the attempt as a code subsection; and

based at least on an identification of the target of the attempt as a code subsection, deny an attempted write to the code subsection.

8. The medium of claim 1 , further comprising instructions for causing the processor to:

identify a target of the attempt as a header subsection; and

based at least on an identification of the target of the attempt as a header subsection, deny an attempted write to the header subsection.

9. The medium claim 1 , further comprising instructions for causing the processor to:

identify a target of the attempt as a data subsection; and

based at least on an identification of the target of the attempt as a data subsection, allow an attempted write to the data subsection.

10. The medium of claim 1 , further comprising instructions for causing the processor to identify the execution entity, identify the memory location, and compare the byte string at a level below all of the operating systems of the electronic device.

11. A system for securing an electronic device, comprising:

a memory;

a processor;

a secured system resource; and

one or more security agents including instructions resident in the memory and operable for execution by the processor, wherein the security agents are configured to:

identify an execution entity attempting to access a secured system resource of an electronic device;

identify a memory location including an instruction address within a subsection of the execution entity that caused the attempt;

determine a byte string corresponding to a range including the memory location that caused the attempt, the range to include a defined number of bytes surrounding the memory location; and

compare the byte string against mappings of the subsection in security rules to determine whether to allow the attempt based on the security rules.

12. The system of claim 11 , wherein the security agents are further configured to identify the execution entity, identify the memory location, and compare the byte string at a level below all of the operating systems of the electronic device.

13. The system of claim 11 , wherein the memory location identifies a point of origin of the attempt.

14. The system of claim 11 , wherein the security agents are further configured to:

identify another memory location that identifies a target point of the attempt; and

allow the attempted access further based upon the target point of the attempt.

15. The system of claim 11 , wherein the security agents are further configured to:

identify another subsection as a target of the attempt and as a data subsection; and

allow the attempted access further based upon the identification of the other subsection as a target of the attempt and as a data subsection.

16. The system of claim 11 , wherein the security agents are further configured to:

identify another subsection as a target of the attempt and as a header subsection; and

allow the attempted access further based upon the identification of the other subsection as a target of the attempt and as a header subsection.

17. The system of claim 11 , wherein the security agents are further configured to:

identify another subsection as a target of the attempt and as a code subsection; and

allow the attempted access further based upon the identification of the other subsection as a target of the attempt and as a code subsection.

18. The system of claim 11 , wherein the security agents are further configured to:

identify a target of the attempt as a code subsection; and

based at least on an identification of the target of the attempt as a code subsection, deny an attempted write to the code subsection.

19. The system of claim 11 , wherein the security agents are further configured to:

identify a target of the attempt as a header subsection; and

based at least on an identification of the target of the attempt as a header subsection, deny an attempted write to the header subsection.

20. The system of claim 11 , wherein the security agents are further configured to:

identify a target of the attempt as a data subsection; and

based at least on an identification of the target of the attempt as a data subsection, allow an attempted write to the data subsection.

Assignments (1)
CORRECTIVE ASSIGNMENT TO CORRECT THE THE PATENT TITLES AND REMOVE DUPLICATES IN THE SCHEDULE PREVIOUSLY RECORDED AT REEL: 059354 FRAME: 0335. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Recorded Jun 23, 2022
From: MCAFEE, LLC
To: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT
Reel/Frame 060792/0307 →