Device protection using pre-execution command interception and user authentication

Patent metadata

Field	Value
Publication number	US-12462002-B2
Application number	US-202218081765-A
Country	US
Kind code	B2
Filing date	Dec 15, 2022
Priority date	Dec 15, 2022
Publication date	Nov 4, 2025
Grant date	Nov 4, 2025

Abstract

Techniques are provided for device protection using pre-execution command interception and user authentication. One method comprises obtaining, by a software entity associated with an operating system kernel of a device, a request from a user to execute a command; determining, by the software entity associated with the operating system kernel, prior to an execution of the command, whether the command is a command of a designated command type; initiating a multi-factor authentication of the user in response to determining that the command is a command of the designated command type; and initiating an execution of the at least one command based on a result of the multi-factor authentication of the user. The determination of whether the command comprises the command of the designated command type evaluates command properties and/or command criteria. The command may be compared to a protected list of commands of the designated command type.

First claim

What is claimed is:

1 . A method, comprising:
obtaining, by at least one software entity associated with an operating system kernel of at least one processing device comprising a processor coupled to a memory, a request from a user to execute at least one command; determining, by the at least one software entity associated with the operating system kernel, subsequent to the obtaining and prior to an execution of the at least one obtained command, whether the at least one obtained command is a command of at least one designated command type requiring a multi-factor authentication, wherein the determining further comprises one or more designated command properties and one or more designated command criteria, of the at least one obtained command, that identify commands of the designated command type, wherein commands of the at least one designated command type require a multi-factor authentication of a user that submitted the respective command prior to an execution of the respective command; initiating a multi-factor authentication of the user, following the obtaining the request from the user and prior to the execution of the at least one command, in response to determining that the at least one obtained command is a command of the at least one designated command type requiring the multi-factor authentication; and initiating an execution of the at least one command based at least in part on a result of the multi-factor authentication of the user.

2 . The method of claim 1 , wherein the initiating the execution of the at least one command further comprises providing the at least one command to an operating system for execution.

3 . The method of claim 1 , wherein the initiating the multi-factor authentication of the user further comprises providing an authentication request to a multi-factor authentication system associated with the at least one processing device.

4 . The method of claim 1 , wherein the request from the user to execute the at least one command comprises a request to execute a software script comprising one or more commands of the at least one designated command type.

5 . The method of claim 1 , wherein the request is received during an authenticated session of a given user on the at least one processing device and wherein the multi-factor authentication of the user comprises a multi-factor authentication of the given user.

6 . The method of claim 1 , wherein the obtaining the request from the user comprises intercepting the request.

7 . The method of claim 1 , wherein the at least one command comprises one or more of a user add command to create one or more users; a command to change a password for one or more user accounts; a change mode command that changes an access mode of one or more files; a super user command that allows a first user to execute a command on behalf of a second user; a super user command to run a function as a different user; a yum command to one or more of install, update, remove and search software packages on a system; an apt command for one or more of installing, updating, removing and managing at least one packages; a zipper command to specify a compression level; a user modification command to modify one or more existing user account details; a system control command to one or more of examine and control a service manager; and a system command to pass commands to an operating system.

8 . An apparatus comprising:
at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured to implement the following steps: obtaining, by at least one software entity associated with an operating system kernel of at least one processing device comprising a processor coupled to a memory, a request from a user to execute at least one command; determining, by the at least one software entity associated with the operating system kernel, subsequent to the obtaining and prior to an execution of the at least one obtained command, whether the at least one obtained command is a command of at least one designated command type requiring a multi-factor authentication, wherein the determining further comprises evaluating one or more designated command properties and one or more designated command criteria, of the at least one obtained command, that identify commands of the designated command type, wherein commands of the at least one designated command type require a multi-factor authentication of a user that submitted the respective command prior to an execution of the respective command; initiating a multi-factor authentication of the user, following the obtaining the request from the user and prior to the execution of the at least one command, in response to determining that the at least one obtained command is a command of the at least one designated command type requiring the multi-factor authentication; and initiating an execution of the at least one command based at least in part on a result of the multi-factor authentication of the user.

9 . The apparatus of claim 8 , wherein the initiating the execution of the at least one command further comprises providing the at least one command to an operating system for execution.

10 . The apparatus of claim 8 , wherein the initiating the multi-factor authentication of the user further comprises providing an authentication request to a multi-factor authentication system associated with the at least one processing device.

11 . The apparatus of claim 8 , wherein the request from the user to execute the at least one command comprises a request to execute a software script comprising one or more commands of the at least one designated command type.

12 . The apparatus of claim 8 , wherein the request is received during an authenticated session of a given user on the at least one processing device and wherein the multi-factor authentication of the user comprises a multi-factor authentication of the given user.

13 . The apparatus of claim 8 , wherein the obtaining the request from the user comprises intercepting the request.

14 . The apparatus of claim 8 , wherein the at least one command comprises one or more of a user add command to create one or more users; a command to change a password for one or more user accounts; a change mode command that changes an access mode of one or more files; a super user command that allows a first user to execute a command on behalf of a second user; a super user command to run a function as a different user; a yum command to one or more of install, update, remove and search software packages on a system; an apt command for one or more of installing, updating, removing and managing at least one packages; a zipper command to specify a compression level; a user modification command to modify one or more existing user account details; a system control command to one or more of examine and control a service manager; and a system command to pass commands to an operating system.

15 . A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
obtaining, by at least one software entity associated with an operating system kernel of at least one processing device comprising a processor coupled to a memory, a request from a user to execute at least one command; determining, by the at least one software entity associated with the operating system kernel, subsequent to the obtaining and prior to an execution of the at least one obtained command, whet

Assignees

• Dell Products Lp

Inventors

• Gehtman Yevgeni
• Shachar Tomer
• Balin Maxim

Classifications

• G06F21/31 Primary

  User authentication · CPC title