Secure management of process properties
An endpoint has a tamper protection cache that identifies protected computing objects, along with a process cache that stores information for processes executing on the endpoint. By securing the tamper protection cache with reference to a trust authority external to the endpoint, or the operating system for the endpoint, computing objects listed in the tamper protection cache can be protected against unauthorized modifications from malware or other malicious or otherwise potentially unsafe code.
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on an endpoint, performs the steps of:
storing a process cache in a kernel space of an operating system on the endpoint, the endpoint having a memory that includes the kernel space and a user space and the process cache storing at least one property for a first process executing in the user space;
storing a tamper protection cache in the kernel space, the tamper protection cache identifying one or more protected computing objects on the endpoint including the first process, wherein a record of the first process in the tamper protection cache is cryptographically secured with reference to a trust authority external to the operating system;
monitoring changes to the process cache with a kernel driver;
detecting a requested change from a second process executing on the endpoint to the at least one property of the first process with the kernel driver; and
conditionally approving the requested change from the kernel driver only when the second process is included in the one or more protected computing objects identified in the tamper protection cache.
2. A method for managing properties of processes on an endpoint, the method comprising:
storing a process cache in a kernel space of an operating system on the endpoint, the endpoint having a memory that includes the kernel space and a user space and the process cache storing at least one property for a first process executing in the user space;
storing a tamper protection cache in the kernel space, the tamper protection cache identifying one or more protected computing objects on the endpoint, wherein a record of the first process in the tamper protection cache is cryptographically secured with reference to a trust authority external to the operating system;
monitoring changes to the process cache with a kernel driver;
detecting a requested change from a second process executing on the endpoint to the at least one property of the first process with the kernel driver; and
conditionally approving the requested change from the kernel driver based on a security rule and the tamper protection cache.
3. The method of claim 2 wherein the first process is a software firewall executing on the endpoint.
4. The method of claim 2 wherein conditionally approving the requested change includes reversing the requested change after the requested change is entered into the process cache.
5. The method of claim 2 wherein conditionally approving the requested change includes approving the requested change when the second process is identified as one of the one or more protected computing objects in the tamper protection cache.
6. The method of claim 2 wherein conditionally approving the requested change includes approving the requested change when neither the first process nor the second process is identified as one of the one or more protected computing objects in the tamper protection cache.
7. The method of claim 2 wherein conditionally approving the requested change includes, when the first process is identified as one of the protected computing objects in the tamper protection cache, approving the requested change only when the second process is also identified as one of the one or more protected computing objects in the tamper protection cache.
8. The method of claim 2 wherein the requested change includes a change to a registry key associated with the first process.
9. The method of claim 8 wherein the registry key is identified as one of the one or more protected computing objects in the tamper protection cache.
10. The method of claim 2 wherein the first process executes from a directory location identified as one of the one or more protected computing objects in the tamper protection cache.
11. The method of claim 2 wherein the tamper protection cache is secured by a trust authority external to the operating system.
12. The method of claim 2 wherein the tamper protection cache is secured with a digital signature from a remote trust authority.
13. The method of claim 2 wherein the requested change includes a change in at least one of process privileges or a user for the first process.
14. A system comprising:
an endpoint having a memory and an operating system that organizes the memory into a user space and a kernel space;
a process cache stored in the kernel space of the operating system, the process cache storing at least one property for a first process executing in the user space;
a tamper protection cache stored in the kernel space of the operating system, the tamper protection cache identifying one or more protected computing objects on the endpoint, wherein a record of the first process in the tamper protection cache is cryptographically secured with reference to a trust authority external to the operating system; and
a kernel driver in the kernel space of the operating system, the kernel driver configured to monitor changes to the process cache, to detect a requested change by a second process executing on the endpoint to the at least one property of the first process, and to conditionally approve the requested change from the kernel driver based on a security rule and the tamper protection cache.
15. The system of claim 14 wherein the first process is a software firewall executing on the endpoint.
16. The system of claim 14 wherein the kernel driver is configured to undo an unapproved change by reversing the requested change after the requested change is entered into the process cache.
17. The system of claim 14 wherein the kernel driver is configured to conditionally approve the requested change by approving the requested change only when the second process is identified as one of the one or more protected computing objects in the tamper protection cache.
18. The system of claim 14 wherein the kernel driver is configured to conditionally approve the requested change by approving the requested change when neither the first process nor the second process is identified as one of the one or more protected computing objects in the tamper protection cache.
19. The system of claim 14 wherein the kernel driver is configured to conditionally approve the requested change when the first process is identified as one of the one or more protected computing objects in the tamper protection cache by approving the requested change only when the second process is also identified as one of the one or more protected computing objects in the tamper protection cache.
20. The system of claim 14 wherein the tamper protection cache is secured by a trust authority external to the operating system.