Insider attack resistant system and method for cloud services integrity checking

Patent metadata

Field	Value
Publication number	US-11570185-B2
Application number	US-201916658508-A
Country	US
Kind code	B2
Filing date	Oct 21, 2019
Priority date	Aug 13, 2015
Publication date	Jan 31, 2023
Grant date	Jan 31, 2023

Abstract

An insider attack resistant system for providing cloud services integrity checking is disclosed. In particular, the system utilizes an automated integrity checking script and virtual machines to check the integrity of a service. The system may utilize the integrity checking script and virtual machines to execute a set of operations associated with the service so as to check the integrity of the service. When executing the set of operations, the system may only have access to the minimum level of access to peripherals that is required for each operation in the set of operations to be executed. After each operation is executed, the system may log each result for each operation, and analyze each result to determine if a failure exists for any of the operations. If a failure exists, the system may determine that a change in an expected system behavior associated with the service has occurred.

First claim

We claim:

1. A system, comprising:
a memory that stores instructions; and
a processor that executes the instructions to perform operations, the operations comprising:
executing, during a first mode, a group of operations associated with a service of a group of services to check an integrity of the service, wherein the group of operations is executed based on restricting access, by the group of operations, to a sub-group of peripherals of a group of peripherals associated with the group of services, wherein the sub-group of peripherals are a minimum group of peripherals for the group of operations to be executed, and wherein restricting the access is imposed by utilizing a firewall; and
determining, during the first mode, whether a failure of at least one operation of the group of operations has occurred.

2. The system of claim 1 , wherein the operations further comprise executing, when the system is in a second mode, the group of operations associated with the service based on full access, by the group of operations, to the group of peripherals.

3. The system of claim 1 , wherein the operations further comprise logging each result for each operation of the group of operations after the group of operations is executed.

4. The system of claim 1 , wherein the operations further comprise analyzing each result for each operation of the group of operations.

5. The system of claim 1 , wherein the operations further comprise determining whether a change in expected system behavior associated with the service has occurred.

6. The system of claim 5 , wherein the operations further comprise generating an alert in response to determining that the change in the expected system behavior has occurred.

7. The system of claim 1 , wherein the operations further comprise, in response to determining that the failure has occurred, performing an action to correct the failure.

8. The system of claim 1 , wherein the operations further comprise enabling an integrity checker of the system to mimic user input to check the integrity of the service.

9. The system of claim 1 , wherein the operations further comprise, in response to determining that the failure has occurred, preventing malware from affecting the service.

10. The system of claim 1 , wherein the operations further comprise, in response to determining that the failure has occurred, removing malware from the service.

11. The system of claim 1 , wherein the operations further comprise, in response to determining that the failure has occurred, determining data representative of how malware is affecting the service.

12. The system of claim 1 , wherein the operations further comprise utilizing a virtual machine to check the integrity of the service.

13. A method, comprising:
executing, by a system comprising a processor, during a first mode, operations associated with a service of a group of services to check an integrity of the service, wherein the operations are executed based on restricting access, by the operations, to a sub-group of peripherals of a group of peripherals associated with the system, wherein the sub-group of peripherals satisfy a minimum requirement for the operations to be executed, and wherein restricting the access is imposed by utilizing a software-defined networking script; and
determining, by the system, during the first mode, whether a failure of at least one operation of the operations has occurred.

14. The method of claim 13 , further comprising determining, by the system, that a change in a system behavior associated with the service has occurred.

15. The method of claim 14 , further comprising determining, by the system, a cause of the change in the system behavior.

16. The method of claim 13 , wherein executing the operations comprises executing a copy of the service using a virtual machine.

17. The method of claim 13 , further comprising determining, by the system, that the service is operating normally based on the determining indicating that the failure does not exist.

18. The method of claim 13 , further comprising, in response to determining that the failure has occurred, performing, by the system, an action to correct the failure.

19. A non-transitory computer-readable medium comprising executable instructions that, when executed by a processor of a system, facilitate perform of operations, comprising:
executing, during a first mode, a set of operations associated with a service of a group of services to check an integrity of the service, wherein the set of operations is executed based on restricting access, by the set of operations, to a sub-group of peripherals of a group of peripherals associated with the system, wherein the sub-group of peripherals are at a lower limit of peripherals that enable the set of operations to be executed, and wherein restricting the access is imposed by utilizing a hypervisor layer firewall; and
determining, during the first mode, whether a failure of at least one operation of the set of operations has occurred.

20. The non-transitory computer-readable medium of claim 19 , wherein the operations further comprise, in response to determining that the failure has occurred, performing an action corresponding to the failure to correct the failure.

Assignees

• At & T Ip I Lp

Inventors

• Jayawardena Thusitha
• Bickford Jeffrey E
• Istomin Mikhail
• Liefert John
• Singaraju Gokul
• Van Wart Christopher

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F11/0712

  in a virtual computing platform, e.g. logically partitioned systems · CPC title