Integrity Assurance and Rebootless Updating During Runtime

Patent metadata

Field	Value
Publication number	US-2016170740-A1
Application number	US-201615051461-A
Country	US
Kind code	A1
Filing date	Feb 23, 2016
Priority date	Mar 20, 2014
Publication date	Jun 16, 2016
Grant date	—

Abstract

Techniques are described herein for, without rebooting a computing device, unloading at least a component of a kernel-mode component of the computing device and loading an updated version of the component of the kernel-mode component. The techniques may be performed by an integrity manager associated with the kernel-mode component. The integrity manager may also determine integrity of the kernel-mode component by causing the kernel-mode component to perform an action associated with a known reaction, determining whether the known reaction occurred, and in response, performing a remediation action or notifying a remote security service. Further, the integrity manager may determine whether any computing device lists include representations of components or connections associated with the kernel-mode component. The integrity manager may then remove the representations from the lists or remove the representations from responses to requests for contents of the computing device lists.

First claim

1 .- 20 . (canceled)

21 . One or more computer storage media having stored thereon a plurality of executable instructions configured to program a computing device to perform operations comprising:
determining whether a computing device list includes a representation of a component or a connection associated with a kernel-mode component of the computing device; and in response to the determining, performing one of:
removing the representation of the component or the connection from the computing device list, or
removing the representation of the component or the connection from a response to a request for contents of the computing device list.

22 . The one or more computer storage media of claim 21 , wherein the computing device list is a list of drivers, a list of network connections, a list of operating system hooks, a list of directories, or a list of registry keys.

23 . The one or more computer storage media of claim 21 , wherein the component is a driver, an operating system hook, a directory, or a registry key.

24 . The one or more computer storage media of claim 21 , wherein the operations further comprise intercepting the response to the request for contents of the computing device list.

25 . The one or more computer storage media of claim 21 , wherein the operations further comprise intercepting a request to open a directory associated with the kernel-mode component and responding that the directory does not exist or is not available.

26 . The one or more computer storage media of claim 21 , wherein the component is a component of the kernel-mode component, and the executable instructions configured to program the computing device to perform the determining, the removing the representation from the computing device list, or the removing the representation from the response are instructions of the kernel-mode component.

27 . The one or more computer storage media of claim 26 , wherein the executable instructions configured to program the computing device to perform the determining, the removing the representation from the computing device list, or the removing the representation from the response are instructions of an integrity manager of the kernel-mode component.

28 . A method implemented by a computing device, the method comprising:
determining whether a computing device list includes a representation of a component or a connection associated with a kernel-mode component of the computing device; and in response to the determining, performing one of:
removing the representation of the component or the connection from the computing device list, or
removing the representation of the component or the connection from a response to a request for contents of the computing device list.

29 . The method of claim 28 , wherein the computing device list is a list of drivers, a list of network connections, a list of operating system hooks, a list of directories, or a list of registry keys.

30 . The method of claim 28 , wherein the component is a driver, an operating system hook, a directory, or a registry key.

31 . The method of claim 28 , further comprising intercepting the response to the request for contents of the computing device list.

32 . The method of claim 28 , further comprising intercepting a request to open a directory associated with the kernel-mode component and responding that the directory does not exist or is not available.

33 . The method of claim 28 , wherein the component is a component of the kernel-mode component, and the determining, the removing the representation from the computing device list, or the removing the representation from the response are performed by the kernel-mode component.

34 . The method of claim 33 , wherein the determining, the removing the representation from the computing device list, or the removing the representation from the response are performed by an integrity manager of the kernel-mode component.

35 . A computing device comprising:
a processor; a kernel-mode component configured to be operated by the processor to perform operations including:
determining whether a computing device list includes a representation of a component or a connection associated with the kernel-mode component of the computing device; and
in response to the determining, performing one of:
removing the representation of the component or the connection from the computing device list, or
removing the representation of the component or the connection from a response to a request for contents of the computing device list.

36 . The computing device of claim 35 , wherein the computing device list is a list of drivers, a list of network connections, a list of operating system hooks, a list of directories, or a list of registry keys.

37 . The computing device of claim 35 , wherein the component is a driver, an operating system hook, a directory, or a registry key.

38 . The computing device of claim 35 , wherein the operations further include intercepting the response to the request for contents of the computing device list.

39 . The computing device of claim 35 , wherein the operations further include intercepting a request to open a directory associated with the kernel-mode component and responding that the directory does not exist or is not available.

40 . The computing device of claim 35 , wherein the kernel-mode component includes an integrity manager configured to perform the determining, the removing the representation from the computing device list, or the removing the representation from the response.

Assignees

• Crowdstrike Inc

Inventors

• Ionescu Ion-Alexandru

Classifications

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F8/656 Primary

  while running · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title