Granted Patent B2

US 12,468,802 · App. 18/522,402 · Granted Nov 11, 2025

Inventors: Yoav Orot (Somerville, MA); Gal Kaplan (Tel Aviv, IL); Roi Leibovich (Tel Aviv, IL); Dan Amiga (Ramat Hasharon, IL)

Assignee: ISLAND TECHNOLOGY, INC.

G06F21/54G06F2221/032

Abstract

Claims (56)

1 . A computer security method comprising:

protecting a process of a first computer software application executed by a computer, where the protecting is performed in accordance with a protection policy;

receiving an instruction from the process to modify the protection policy;

modifying the protection policy in accordance with the instruction; and

protecting the process in accordance with the protection policy after it has been modified in accordance with the instruction,

wherein the protecting, receiving, and modifying are performed by a kernel driver executed by the computer.

2 . The computer security method according to claim 1 wherein the first computer software application is a web browser.

3 . The computer security method according to claim 1 wherein any of the protecting, receiving, and modifying are performed after determining that a digital signature is valid, wherein the digital signature is of an executable file of the first computer software application, and wherein the determining is performed by the kernel driver executed by the computer.

4 . The computer security method according to claim 1 wherein the protecting comprises:

detecting an attempt, by a process of a second computer software application executed by the computer, to access an object associated with the first computer software application;

determining whether a digital signature is valid, wherein the digital signature is of an executable file of the second computer software application; and

allowing or preventing access to the object by the second computer software application in accordance with the protection policy, wherein the protection policy is at least partly based on whether the digital signature is valid,

wherein the detecting, determining, allowing, and preventing are performed by the kernel driver executed by the computer.

5 . The computer security method according to claim 4 wherein the object is a process or a thread of a process.

6 . The computer security method according to claim 1 wherein the protecting comprises:

receiving a decryption key from the process of the first computer software application;

receiving a request from the process of the first computer software application to receive the decryption key;

determining whether a digital signature is valid, wherein the digital signature is of the first computer software application; and

providing or not providing the decryption key to the process in accordance with the protection policy, wherein the protection policy is at least partly based on whether the digital signature is valid,

wherein the receiving, determining, allowing, providing, and not providing are performed by the kernel driver executed by the computer.

7 . The computer security method according to claim 6 wherein the decryption key is encrypted after receiving the decryption key from the process of the first computer software application, and further comprising decrypting the encrypted decryption key, if the digital signature is valid, prior to providing the decryption key to the process of the first computer software application.

8 . The computer security method according to claim 1 wherein the protecting comprises:

receiving an encrypted message from the process of the first computer software application, where the message is encrypted using a public key of a key pair;

determining whether a digital signature is valid, wherein the digital signature is of an executable file of the first computer software application; and

if the digital signature is valid,

decrypting the encrypted message using a private key of the key pair,

encrypting a response to the message using the private key, and

providing the encrypted response to the process of the first computer software application,

wherein the receiving, determining, decrypting, encrypting, and providing are performed by the kernel driver executed by the computer.

9 . Computer security apparatus comprising:

a kernel driver configured to be executed by a computer in a kernel mode and thereupon to perform

protecting a process of a first computer software application executed by the computer, where the protecting is performed in accordance with a protection policy,

receiving an instruction from the process to modify the protection policy,

modifying the protection policy in accordance with the instruction, and

protecting the process in accordance with the protection policy after it has been modified in accordance with the instruction.

10 . The computer security apparatus according to claim 9 wherein the first computer software application is a web browser.

11 . The computer security apparatus according to claim 9 wherein the kernel driver is configured to perform any of the protecting, receiving, and modifying after the kernel driver determines that a digital signature is valid, wherein the digital signature is of an executable file of the first computer software application.

12 . The computer security apparatus according to claim 9 wherein the kernel driver is configured to perform the protecting by

detecting an attempt, by a process of a second computer software application executed by the computer, to access an object associated with the first computer software application,

determining whether a digital signature is valid, wherein the digital signature is of an executable file of the second computer software application, and

allowing or preventing access to the object by the second computer software application in accordance with the protection policy, wherein the protection policy is at least partly based on whether the digital signature is valid.

13 . The computer security apparatus according to claim 12 wherein the object is a process or a thread of a process.

14 . The computer security apparatus according to claim 9 wherein the kernel driver is configured to perform the protecting by

receiving a decryption key from the process of the first computer software application;

receiving a request from the process of the first computer software application to receive the decryption key;

determining whether a digital signature is valid, wherein the digital signature is of the first computer software application; and

providing or not providing the decryption key to the process in accordance with the protection policy, wherein the protection policy is at least partly based on whether the digital signature is valid,

wherein the receiving, determining, allowing, providing, and not providing are performed by the kernel driver executed by the computer.

15 . The computer security apparatus according to claim 14 wherein the kernel driver is configured to encrypt the decryption key after receiving the decryption key from the process of the first computer software application, and decrypt the encrypted decryption key, if the digital signature is valid, prior to providing the decryption key to the process of the first computer software application.

16 . The computer security apparatus according to claim 9 wherein the kernel driver is configured to perform the protecting by

receiving an encrypted message from the process of the first computer software application, where the message is encrypted using a public key of a key pair,

determining whether a digital signature is valid, wherein the digital signature is of an executable file of the first computer software application, and

if the digital signature is valid,

decrypting the encrypted message using a private key of the key pair,

encrypting a response to the message using the private key, and

providing the encrypted response to the process of the first computer software application.

Assignments (1)

Continuity (2)

References Cited (24)