Tamper-resistant service management for enterprise systems
A system and method for providing stringent tamper resistant protection against changes to key system security features. The tamper protection is configured such that any changes to the policy can only occur from a configuration manager console, thereby preventing local device admin users or other malicious actors from altering the setting. Thus, tamper protection locks the selected service and prevents security settings from being changed through third-party apps and methods. When a system administrator enables the feature for an enterprise's workstations, only administrators will be able to change the service settings across a company's computers. The tamper protection policy is digitally signed in the backend before being deployed to endpoints, and the endpoint verifies the validity and intent of the policy, establishing that it is a signed package that only security operations personnel with the necessary administrator rights can control.
1. A method performed by a client device for modifying a tamper protection policy, comprising:
receiving a configuration command comprising a policy modification for a tamper protection policy and a digital signature certifying integrity and authenticity of the policy modification, the tamper protection policy defining a set of security protection settings of the client device;
modifying the tamper protection policy according to the policy modification;
authenticating the policy modification based on the digital signature; and
in response to authenticating the policy modification, activating a protected state for the modified tamper protection policy, wherein, upon activating the protected state, the client device is controlled to protect the modified tamper protection policy from an unauthenticated policy modification.
2. The method of claim 1 , wherein the tamper protection policy controls operation of a security component executing on the client device.
3. The method of claim 1 , wherein the policy modification is authenticated within a protected environment on the client device.
4. The method of claim 1 , further comprising verifying that a first tenant identifier included in the configuration command matches an assigned tenant identifier of the client device.
5. The method of claim 1 , further comprising verifying that a time-to-live value for the configuration command has not expired.
6. The method of claim 1 , wherein the digital signature is generated using an asymmetric encryption algorithm.
7. The method of claim 1 , further comprising securely storing a configuration signature to ensure that the configuration signature is not tampered with by a user with administrative privileges on the client device,
wherein the authentication of the policy modification is based on the securely stored configuration signature.
8. A client device for modifying a tamper protection policy, comprising:
a processor; and
a computer-readable medium in communication with the processor and storing instructions that, when executed by the processor, cause the processor to control the client device to perform:
receiving a configuration command comprising a policy modification for a tamper protection policy and a digital signature certifying integrity and authenticity of the policy modification, the tamper protection policy defining a set of security protection settings of the client device;
modifying the tamper protection policy according to the policy modification;
authenticating the policy modification based on the digital signature; and
in response to authenticating the policy modification, activating a protected state for the modified tamper protection policy, wherein, upon activating the protected state, the client device is controlled to protect the modified tamper protection policy from an unauthenticated policy modification.
9. The client device of claim 8 , wherein the tamper protection policy controls operation of a security component executing on the client device.
10. The client device of claim 8 , wherein the policy modification is authenticated within a protected environment on the client device.
11. The client device of claim 8 , wherein the instructions, when executed by the processor, further cause the processor to control the client device to perform verifying that a first tenant identifier included in the configuration command matches an assigned tenant identifier of the client device.
12. The client device of claim 8 , wherein the instructions, when executed by the processor, further cause the processor to control the client device to perform verifying that a time-to-live value for the configuration command has not expired.
13. The client device of claim 8 , wherein the digital signature is generated using an asymmetric encryption algorithm.
14. The client device of claim 8 , wherein:
the instructions, when executed by the processor, further cause the processor to control the client device to perform securely storing a configuration signature to ensure that the configuration signature is not tampered with by a user with administrative privileges on the client device, and
the authentication of the policy modification is based on the securely stored configuration signature.
15. A non-transitory computer-readable medium comprising instructions that, when executed by a processor, cause the processor to control a client device to perform:
receiving a configuration command comprising a policy modification for a tamper protection policy and a digital signature certifying integrity and authenticity of the policy modification, the tamper protection policy defining a set of security protection settings of the client device;
modifying the tamper protection policy according to the policy modification;
authenticating the policy modification based on the digital signature; and
in response to authenticating the policy modification, activating a protected state for the modified tamper protection policy, wherein, upon activating the protected state, the client device is controlled to protect the modified tamper protection policy from an unauthenticated policy modification.
16. The non-transitory computer-readable medium of claim 15 , wherein the tamper protection policy controls operation of a security component executing on the client device.
17. The non-transitory computer-readable medium of claim 15 , wherein the policy modification is authenticated within a protected environment on the client device.
18. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the processor, further cause the processor to control the client device to perform verifying that a first tenant identifier included in the configuration command matches an assigned tenant identifier of the client device.
19. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the processor, further cause the processor to control the client device to perform verifying that a time-to-live value for the configuration command has not expired.
20. The non-transitory computer-readable medium of claim 15 , wherein:
the instructions, when executed by the processor, further cause the processor to control the client device to perform securely storing a configuration signature to ensure that the configuration signature is not tampered with by a user with administrative privileges on the client device, and
the authentication of the policy modification is based on the securely stored configuration signature.