IP Library › Granted Patent US 11,831,659

Granted Patent B2

US 11,831,659 · App. 16/991,592 · Granted Nov 28, 2023

Security monitoring at operating system kernel level

Inventors: James Fahrny (Parker, CO); Kyong Park (Philadelphia, PA)

Assignee: Comcast Cable Communications, LLC

H04L63/1416 G06F21/53 G06F21/54 G06F21/552 G06F21/554 G06F21/57 G06F21/64 H04L9/3239 H04L63/0823 H04L63/101 H04W12/06 G06F2221/2141 H04L63/126

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,831,659
App. No.: 16/991,592
Granted: Nov 28, 2023
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Methods and apparatus for real-time security monitoring on a computing device are presented. A system may define privileges to access hardware interfaces for each process of a plurality of processes executing on a computing device. The privileges may be defined in a privileged operating system level that controls root access to an operating system. In response to a determination that a process is attempting to access a hardware interface, the system may determine whether the process is privileged to access the hardware interface by checking the privileges. In response to determining that the process is not privileged to access the hardware interface, the intrusion detection agent may terminate the process.

Claims (165)

1. A method comprising:

storing, in encrypted memory of a computing device, one or more privileges, for a process, associated with the process accessing one or more resources of the computing device;

based on the process attempting to access a first resource of the one or more resources of the computing device, determining, via the encrypted memory and based on the stored one or more privileges, that the process is privileged to access the first resource; and

allowing, based on the determining that the process is privileged, the process to access the first resource.

2. The method of claim 1 , wherein:

the process is associated with a root level kernel of an operating system of the computing device, and

the determining and the allowing are performed by a super root level kernel, of the operating system, that is inaccessible to the root level kernel.

3. The method of claim 1 , wherein the one or more resources of the computing device comprise one or more of: a central processor, a video processor, a security processor, a memory or memory region, a file system, an audio/video output, a USB port, an Ethernet port, an antenna, a cable input, a wireless receiver, a serial port, an external memory unit, a high definition media interface, a ZigBee interface, an optical interface, an SATA interface, a key ladder, a memory-to-memory decryptor, a timer, a memory controller, a device driver, a kernel level operating system call, or a BIOS setting.

4. The method of claim 1 , wherein the encrypted memory comprises a memory of a security processor.

5. The method of claim 1 , further comprising:

detecting, for a hardware interface, a source of an incoming data packet; and

determining, via the encrypted memory, whether the source is privileged to access the hardware interface.

6. The method of claim 1 , further comprising:

based on a second process attempting to access a second resource of the one or more resources of the computing device, determining, via the encrypted memory, that the second process is not privileged to access the second resource; and

preventing, based on the determining that the second process is not privileged, the second process from accessing the second resource.

7. The method of claim 1 , further comprising:

determining, based on a validation check performed after expiration of a validity period associated with the process, that the process is valid.

8. The method of claim 1 , further comprising:

determining, for the process, a validity period based on one or more of: a behavior of the process, the one or more privileges for the process, or a risk of malicious attack via the process.

9. The method of claim 1 , further comprising:

detecting a triggering event comprising one or more of: an attempt to modify a privilege, an external instruction to modify or read a memory location, or an attempt to add code to a memory location; and

based on the detected triggering event, causing one or more of: reporting of a security breach to a remote server, displaying of a message indicating detected malicious activity, terminating a code fragment, terminating all application processes executing on the computing device, or rebooting of the computing device.

10. The method of claim 1 , wherein the determining and the allowing are performed by a super root level kernel of an operating system of the computing device, the method further comprising:

monitoring, by the super root level kernel, operations executing on each component of the computing device.

11. The method of claim 1 , wherein the determining and the allowing are performed by a super root level kernel of an operating system of the computing device, the method further comprising:

determining, by the super root level kernel and for each process attempting to access a resource of the one or more resources of the computing device, whether the attempting process is privileged to access the resource.

12. The method of claim 1 , wherein the determining and the allowing are performed by a super root level kernel of an operating system of the computing device, the method further comprising:

preventing modification of the one or more privileges by processes other than the super root level kernel.

13. A method comprising:

determining one or more privileges, for a process, associated with the process accessing one or more resources of a computing device;

determining, by a super root level kernel of an operating system of the computing device and based on the process attempting to access a first resource of the one or more resources of the computing device, that the process is privileged to access the first resource, wherein the process is associated with a root level kernel of the operating system, and wherein the super root level kernel is inaccessible to the root level kernel; and

allowing, based on the determining that the process is privileged, the process to access the first resource.

14. The method of claim 13 , wherein the one or more resources of the computing device comprise one or more of: a central processor, a video processor, a security processor, a memory or memory region, a file system, an audio/video output, a USB port, an Ethernet port, an antenna, a cable input, a wireless receiver, a serial port, an external memory unit, a high definition media interface, a ZigBee interface, an optical interface, an SATA interface, a key ladder, a memory-to-memory decryptor, a timer, a memory controller, a device driver, a kernel level operating system call, or a BIOS setting.

15. The method of claim 13 , further comprising:

based on a second process attempting to access a second resource of the one or more resources of the computing device, determining, via an encrypted memory, that the second process is not privileged to access the second resource; and

preventing, based on the determining that the second process is not privileged, the second process from accessing the second resource.

16. The method of claim 13 , further comprising:

determining, based on a validation check performed after expiration of a validity period associated with the process, that the process is valid.

17. The method of claim 13 , further comprising:

determining, for the process, a validity period based on one or more of: a behavior of the process, the one or more privileges for the process, or a risk of malicious attack via the process.

18. The method of claim 13 , further comprising:

19. The method of claim 13 , wherein the allowing is performed by the super root level kernel of the operating system, the method further comprising:

monitoring, by the super root level kernel, operations executing on each component of the computing device.

20. The method of claim 13 , wherein the allowing is performed by the super root level kernel of the operating system, the method further comprising:

21. The method of claim 13 , wherein the allowing is performed by the super root level kernel of the operating system, the method further comprising:

preventing modification of the one or more privileges by processes other than the super root level kernel.

22. A method comprising:

determining, for each process of a plurality of processes:

a validity period specific to the process; and

one or more privileges, for the process, associated with the process accessing one or more resources of a computing device;

based on a determination that a first process, of the plurality of processes, is attempting to access a first resource of the one or more resources of the computing device, determining whether the first process is privileged to access the first resource based on the one or more privileges determined for the first process;

determining, based on a validation check performed after expiration of the determined validity period associated with the first process, whether the first process is valid;

based on a determination that the first process is privileged to access the first resource and that the first process is valid, determining authorization of the first process to access the first resource; and

allowing, based on the determined authorization, the first process to access the first resource.

23. The method of claim 22 , further comprising:

storing, in an encrypted memory of the computing device, the one or more privileges determined for each process of the plurality of processes,

wherein the determining whether the first process is privileged to access the first resource comprises determining, via the encrypted memory, whether the first process is privileged to access the first resource.

24. The method of claim 22 , wherein:

the determining whether the first process is privileged to access the first resource comprises determining, by a super root level kernel of an operating system of the computing device, whether the first process is privileged to access the first resource,

the first process is associated with a root level kernel of the operating system, and

the super root level kernel is inaccessible to the root level kernel.

25. The method of claim 22 , wherein the one or more resources of the computing device comprise one or more of: a central processor, a video processor, a security processor, a memory or memory region, a file system, an audio/video output, a USB port, an Ethernet port, an antenna, a cable input, a wireless receiver, a serial port, an external memory unit, a high definition media interface, a ZigBee interface, an optical interface, an SATA interface, a key ladder, a memory-to-memory decryptor, a timer, a memory controller, a device driver, a kernel level operating system call, or a BIOS setting.

26. A computing device comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, configure the computing device to:

store, in encrypted memory of the computing device, one or more privileges, for a process, associated with the process accessing one or more resources of the computing device;

based on the process attempting to access a first resource of the one or more resources of the computing device, determine, via the encrypted memory and based on the stored one or more privileges, that the process is privileged to access the first resource; and

allow, based on determining that the process is privileged, the process to access the first resource.

27. The computing device of claim 26 , wherein the process is associated with a root level kernel of an operating system of the computing device, wherein a super root level kernel of the operating system is inaccessible to the root level kernel, and wherein the instructions, when executed by the one or more processors, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by the super root level kernel, that the process is privileged; and

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource.

28. The computing device of claim 26 , wherein the one or more resources of the computing device comprise one or more of: a central processor, a video processor, a security processor, a memory or memory region, a file system, an audio/video output, a USB port, an Ethernet port, an antenna, a cable input, a wireless receiver, a serial port, an external memory unit, a high definition media interface, a ZigBee interface, an optical interface, an SATA interface, a key ladder, a memory-to-memory decryptor, a timer, a memory controller, a device driver, a kernel level operating system call, or a BIOS setting.

29. The computing device of claim 26 , wherein the encrypted memory comprises a memory of a security processor.

30. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

detect, for a hardware interface, a source of an incoming data packet; and

determine, via the encrypted memory, whether the source is privileged to access the hardware interface.

31. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

based on a second process attempting to access a second resource of the one or more resources of the computing device, determine, via the encrypted memory, that the second process is not privileged to access the second resource; and

prevent, based on determining that the second process is not privileged, the second process from accessing the second resource.

32. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

determine, based on a validation check performed after expiration of a validity period associated with the process, that the process is valid.

33. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

determine, for the process, a validity period based on one or more of: a behavior of the process, the one or more privileges for the process, or a risk of malicious attack via the process.

34. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

detect a triggering event comprising one or more of: an attempt to modify a privilege, an external instruction to modify or read a memory location, or an attempt to add code to a memory location; and

based on the detected triggering event, cause one or more of: reporting of a security breach to a remote server, displaying of a message indicating detected malicious activity, terminating a code fragment, terminating all application processes executing on the computing device, or rebooting of the computing device.

35. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by a super root level kernel of an operating system of the computing device, that the process is privileged;

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource; and

monitor, by the super root level kernel, operations executing on each component of the computing device.

36. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by a super root level kernel of an operating system of the computing device, that the process is privileged;

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource; and

determine, by the super root level kernel and for each process attempting to access a resource of the one or more resources of the computing device, whether the attempting process is privileged to access the resource.

37. The computing device of claim 26 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by a super root level kernel of an operating system of the computing device, that the process is privileged;

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource; and

prevent modification of the one or more privileges by processes other than the super root level kernel.

38. A computing device comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, configure the computing device to:

determine, for each process of a plurality of processes:

a validity period specific to the process; and

one or more privileges, for the process, associated with the process accessing one or more resources of the computing device;

based on a determination that a first process, of the plurality of processes, is attempting to access a first resource of the one or more resources of the computing device, determine whether the first process is privileged to access the first resource based on the one or more privileges determined for the first process;

determine, based on a validation check performed after expiration of the determined validity period associated with the first process, whether the first process is valid;

based on a determination that the first process is privileged to access the first resource and that the first process is valid, determine authorization of the first process to access the first resource; and

allow, based on the determined authorization, the first process to access the first resource.

39. The computing device of claim 38 , wherein the instructions, when executed by the one or more processors, configure the computing device to:

store, in an encrypted memory of the computing device, the one or more privileges determined for each process of the plurality of processes; and

determine whether the first process is privileged to access the first resource by determining, via the encrypted memory, whether the first process is privileged to access the first resource.

40. The computing device of claim 38 , wherein the first process is associated with a root level kernel of an operating system of the computing device, wherein a super root level kernel of the operating system is inaccessible to the root level kernel, and wherein the instructions, when executed by the one or more processors, configure the computing device to:

determine whether the first process is privileged to access the first resource by determining, by the super root level kernel, whether the first process is privileged to access the first resource.

41. The computing device of claim 38 , wherein the one or more resources of the computing device comprise one or more of: a central processor, a video processor, a security processor, a memory or memory region, a file system, an audio/video output, a USB port, an Ethernet port, an antenna, a cable input, a wireless receiver, a serial port, an external memory unit, a high definition media interface, a ZigBee interface, an optical interface, an SATA interface, a key ladder, a memory-to-memory decryptor, a timer, a memory controller, a device driver, a kernel level operating system call, or a BIOS setting.

42. A non-transitory computer-readable medium storing instructions that, when executed, configure a computing device to:

store, in encrypted memory of the computing device, one or more privileges, for a process, associated with the process accessing one or more resources of the computing device;

allow, based on determining that the process is privileged, the process to access the first resource.

43. The non-transitory computer-readable medium of claim 42 , wherein the process is associated with a root level kernel of an operating system of the computing device, wherein a super root level kernel of the operating system is inaccessible to the root level kernel, and wherein the instructions, when executed, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by the super root level kernel, that the process is privileged; and

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource.

44. The non-transitory computer-readable medium of claim 42 , wherein the one or more resources of the computing device comprise one or more of: a central processor, a video processor, a security processor, a memory or memory region, a file system, an audio/video output, a USB port, an Ethernet port, an antenna, a cable input, a wireless receiver, a serial port, an external memory unit, a high definition media interface, a ZigBee interface, an optical interface, an SATA interface, a key ladder, a memory-to-memory decryptor, a timer, a memory controller, a device driver, a kernel level operating system call, or a BIOS setting.

45. The non-transitory computer-readable medium of claim 42 , wherein the encrypted memory comprises a memory of a security processor.

46. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

detect, for a hardware interface, a source of an incoming data packet; and

determine, via the encrypted memory, whether the source is privileged to access the hardware interface.

47. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

prevent, based on determining that the second process is not privileged, the second process from accessing the second resource.

48. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

determine, based on a validation check performed after expiration of a validity period associated with the process, that the process is valid.

49. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

determine, for the process, a validity period based on one or more of: a behavior of the process, the one or more privileges for the process, or a risk of malicious attack via the process.

50. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

detect a triggering event comprising one or more of: an attempt to modify a privilege, an external instruction to modify or read a memory location, or an attempt to add code to a memory location; and

51. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by a super root level kernel of an operating system of the computing device, that the process is privileged;

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource; and

monitor, by the super root level kernel, operations executing on each component of the computing device.

52. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by a super root level kernel of an operating system of the computing device, that the process is privileged;

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource; and

53. The non-transitory computer-readable medium of claim 42 , wherein the instructions, when executed, configure the computing device to:

determine that the process is privileged to access the first resource by determining, by a super root level kernel of an operating system of the computing device, that the process is privileged;

allow the process to access the first resource by allowing, by the super root level kernel, the process to access the first resource; and

prevent modification of the one or more privileges by processes other than the super root level kernel.

54. A non-transitory computer-readable medium storing instructions that, when executed, configure a computing device to:

determine, for each process of a plurality of processes:

a validity period specific to the process; and

one or more privileges, for the process, associated with the process accessing one or more resources of the computing device;

based on a determination that a first process, of the plurality of processes, is attempting to access a first resource of the one or more resources of the computing device, determine whether the first process is privileged to access the first resource based on the one or more privileges determined for the first process;

determine, based on a validation check performed after expiration of the determined validity period associated with the first process, whether the first process is valid;

allow, based on the determined authorization, the first process to access the first resource.

55. The non-transitory computer-readable medium of claim 54 , wherein the instructions, when executed, configure the computing device to:

store, in an encrypted memory of the computing device, the one or more privileges determined for each process of the plurality of processes; and

determine whether the first process is privileged to access the first resource by determining, via the encrypted memory, whether the first process is privileged to access the first resource.

56. The non-transitory computer-readable medium of claim 54 , wherein the first process is associated with a root level kernel of an operating system of the computing device, wherein a super root level kernel of the operating system is inaccessible to the root level kernel, and wherein the instructions, when executed, configure the computing device to:

determine whether the first process is privileged to access the first resource by determining, by the super root level kernel, whether the first process is privileged to access the first resource.

57. The non-transitory computer-readable medium of claim 54 , wherein the one or more resources of the computing device comprise one or more of: a central processor, a video processor, a security processor, a memory or memory region, a file system, an audio/video output, a USB port, an Ethernet port, an antenna, a cable input, a wireless receiver, a serial port, an external memory unit, a high definition media interface, a ZigBee interface, an optical interface, an SATA interface, a key ladder, a memory-to-memory decryptor, a timer, a memory controller, a device driver, a kernel level operating system call, or a BIOS setting.

Assignments (1)

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 26, 2021

From: FAHRNY, JAMES; PARK, KYONG

To: COMCAST CABLE COMMUNICATIONS, LLC

Reel/Frame 055030/0625 →

Continuity (2)

Continuation 15047138 · Feb 18, 2016

Related Publication 20210067526A1 · Mar 4, 2021