Granted Patent B1

US 10,628,560 · App. 15/701,128 · Granted Apr 21, 2020

Inventors: Joseph Siranni (Ithaca, NY); Matthew Donovan (Trumansburg, NY)

Assignee: ARCHITECTURE TECHNOLOGY CORPORATION

G06F21/123G06F21/604H04L63/101H04W12/08

Abstract

Claims (96)

1. A method for managing privilege access in a computer system by applications executing on the computer system, comprising:

receiving a system call request from an application, the system call request requesting access to resources of the computer system;

determining, by a processor, a status of the system call request as one of permanently allowed and not permanently allowed by consulting a privilege profile for the application;

for a not permanently allowed system call request;

generating, by the processor, a volatile access control list for the non-permanently-allowed system call request,

providing a user with a system call request prompt comprising a plurality of actions,

receiving, by the processor, an action selection from the user,

performing a privilege operation for the system call request based on the received action, and

storing the privilege operation for the system call request in the privilege profile for the application; and

for a permanently allowed system call request:

invoking a persistent access control list,

granting access to the resources, and

storing the access grant privilege operation in the privilege profile for the application.

2. The method of claim 1 , wherein

the processor generates the volatile access control list for the system call request when the system call request status is one of temporarily allowed, denied, and not in the privilege profile.

3. The method of claim 1 , wherein the action selections include allow and deny.

4. The method of claim 1 , wherein the privilege profile comprises a summary of current privilege operations comprising privilege operations for each system call applicable to the application.

5. The method of claim 1 , further comprising:

the processor identifying common system calls applicable to the application;

generating a group system call comprising the common, applicable system calls; and

storing the group system call in the privilege profile for the application as permanently allowed.

6. The method of claim 1 , further comprising:

attempting to match the received system call request to an entry in a behavior profile for the application;

determining by the processor a no match condition;

sending a no match alert to the user;

applying a classifier algorithm to the application;

identifying one or more fault-revealing properties of the application indicative of a malware attack; and

sending a prompt to the user to stop the application.

7. The method of claim 1 , further comprising generating persistent access control lists, comprising:

generating a rule for a persistent access control list;

generating applicable actions for the persistent access control list based on the rule;

adding one or more parameters to the persistent access control list to limit application of the persistent access control list; and

saving the persistent access control list.

8. A processor-implemented permission request method for controlling resources, comprising in a computer system:

a processor generating and maintaining a privilege profile for an application executing on the computer system, the privilege profile comprising actions taken for previous resource access requests from the application;

receiving a resource access request from the application;

determining a status of the received resource access request as one of permanently allowed and not permanently allowed by consulting previous resource access requests corresponding to the received resource access request;

allowing the resource access request when the status is permanently, comprising:

invoking a persistent access control list,

granting access to the resource, and′

storing the access grant in the privilege profile;

when the status is not permanently allowed;

generating a volatile access control list for the not permanently allowed resource access request,

providing a visual display with two or more actions selectable by the user,

receiving an action selection from the user,

executing the action selection, and

storing the action selection in the privilege profile.

9. The method of claim 8 , further comprising:

attempting to match the received resource access request with an entry in a behavior profile for the application;

determining a no match condition;

sending a no match alert to the user;

applying a classifier algorithm to the application;

identifying one or more fault-revealing properties of the application indicative of a malware attack; and

sending a prompt to the user to stop the application.

10. The method of claim 8 , further comprising generating persistent access control lists, comprising:

generating a rule for a persistent resource access control list;

generating applicable actions for the persistent resource access control list based on the rule;

adding one or more parameters to the persistent resource access control list to limit application of the persistent resource access control list; and

saving the persistent resource access control list.

11. The method of claim 8 , further comprising:

identifying common resource access requests applicable to the application;

generating a group resource access request consisting of applicable common resource access requests; and

storing the group resource access request as permanently allowed in the privilege profile.

12. A system for managing privilege access by applications in a computer system comprising a non-transitory, computer-readable storage medium storing a program of instructions that when executed, cause a processor to:

receive a system call request from an application, the system call request requesting access to resources of the computer system;

determine a status of the system call request as one of permanently allowed and not permanently allowed by consulting a privilege profile for the application; and

for a not permanently allowed system call request;

generate a volatile access control list for the not permanently allowed system call request,

provide a user with a system call request prompt comprising a plurality of actions,

receive an action selection from the user,

perform a privilege operation for the system call request based on the received action, and

store the privilege operation for the system call request in a privilege profile for the application; and

for a permanently allowed system call request:

invoke a persistent access control list,

grant access to the resources; and

store the access grant privilege operation in the privilege profile for the application.

13. The system of claim 12 ,

wherein the processor generates the volatile access control list for the system call request when the system call request status is one of temporarily allowed, denied, and not in the privilege profile.

14. The system of claim 12 , wherein the action selections include allow and deny.

15. The system of claim 12 , wherein the privilege profile comprises a summary of current privilege operations comprising privilege operations for each system call applicable to the application.

16. The system of claim 12 , further comprising the processor:

identifies common system call applicable to the application;

generates a group system call consisting of common, applicable system calls; and

stores the group system call in the privilege profile for the application as permanently allowed.

17. The system of claim 12 , further comprising the processor:

attempts to match the received system call request to an entry in a behavior profile for the application;

determines by the processor a no match condition;

sends a no match alert to the user;

applies a classifier algorithm to the application;

identifies one or more fault-revealing properties of the application indicative of a malware attack; and

sends a prompt to the user to stop the application.

18. The system of claim 12 , wherein the processor generates persistent access control lists, wherein the processor:

generates a rule for a persistent access control list;

generates applicable actions for the persistent access control list based on the rule;

adds one or more parameters to the persistent access control list to limit application of the persistent access control list; and

saves the persistent access control list.

Assignments (1)

Cited By (8)

US 12,373,603 US 12,379,951 US 12,386,648 US 12,388,876 US 12,452,189 US 12,498,995 US 12,652,296 US 12,719,893