Insider attack resistant system and method for cloud services integrity checking

Patent metadata

Field	Value
Publication number	US-9606854-B2
Application number	US-201514825419-A
Country	US
Kind code	B2
Filing date	Aug 13, 2015
Priority date	Aug 13, 2015
Publication date	Mar 28, 2017
Grant date	Mar 28, 2017

Abstract

An insider attack resistant system for providing cloud services integrity checking is disclosed. In particular, the system utilizes an automated integrity checking script and virtual machines to check the integrity of a service. The system may utilize the integrity checking script and virtual machines to execute a set of operations associated with the service so as to check the integrity of the service. When executing the set of operations, the system may only have access to the minimum level of access to peripherals that is required for each operation in the set of operations to be executed. After each operation is executed, the system may log each result for each operation, and analyze each result to determine if a failure exists for any of the operations. If a failure exists, the system may determine that a change in an expected system behavior associated with the service has occurred.

First claim

We claim:

1. A system, comprising:
a memory that stores instructions; and
a processor that executes the instructions to perform operations, the operations comprising:
activating, at a virtual machine executing a copy of a service, an integrity checking script for checking an integrity of the service, wherein the integrity checking script is activated at selected periodic intervals;
executing, by utilizing the integrity checking script and the virtual machine, a set of operations associated with the service to check the integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for each operation in the set of operations to be executed, wherein the minimum level of access to the peripheral comprises suspending access to network ports, wherein the set of operations are executed based on the minimum level of access to the peripheral when the system is in an integrity check mode;
logging each result for each operation in the set of operations after each operation is executed;
analyzing, by utilizing the virtual machine, each result to determine if a failure for an operation in the set of operations exists; and
determining, if the failure exists, that a change in an expected system behavior associated with the service has occurred.

2. The system of claim 1 , wherein the operations further comprise enforcing, by utilizing a software-defined network, the minimum level of access to the peripheral that is required for each step of each operation in the set of operations to be executed.

3. The system of claim 2 , wherein the operations further comprise enforcing, by utilizing a hypervisor layer firewall in combination with the software-defined network, the minimum level of access to the peripheral that is required for each step of each operation in the set of operations to be executed.

4. The system of claim 1 , wherein the operations further comprise executing, when the system is in a normal operation mode, the set of operations associated with service based on a full level of access to all peripherals and the network ports associated with the service.

5. The system of claim 1 , wherein the operations further comprise logging a number of times the peripheral is accessed when executing the set of operations.

6. The system of claim 1 , wherein the operations further comprise logging each result with a corresponding timestamp.

7. The system of claim 1 , wherein the operations further comprise synchronizing a software-defined network script with the integrity checking script to enforce the minimum level of access to the peripheral that is required for each step of each operation in the set of operations to be executed.

8. The system of claim 1 , wherein the operations further comprise generating an alert when the change in the expected system behavior associated with the service has been determined to have occurred.

9. The system of claim 1 , wherein the operations further comprise deactivating the virtual machine after determining that the change in the expected system behavior associated with the service has occurred.

10. A method, comprising:
initializing, at a virtual machine executing a copy of a service, an integrity checking script for checking an integrity of the service, wherein the integrity checking script is activated at selected periodic intervals;
executing, by utilizing the integrity checking script and the virtual machine, a set of operations associated with the service to check the integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for each operation in the set of operations to be executed, wherein the minimum level of access to the peripheral comprises suspending access to network ports, wherein the set of operations are executed based on the minimum level of access to the peripheral when the system is in an integrity check mode;
storing each result for each operation in the set of operations after each operation is executed;
analyzing, by utilizing the virtual machine, each result to determine if a failure for an operation in the set of operations exists, wherein the analyzing is performed by utilizing instructions from a memory that are executed by a processor; and
determining, if the failure exists, that a change in an expected system behavior associated with the service has occurred.

11. The method of claim 10 , further comprising enforcing, by utilizing a software-defined network, the minimum level of access to the peripheral that is required for each step of each operation in the set of operations to be executed.

12. The method of claim 11 , further comprising enforcing, by utilizing a hypervisor layer firewall in combination with the software-defined network, the minimum level of access to the peripheral that is required for each step of each operation in the set of operations to be executed.

13. The method of claim 10 , further comprising suspending any access to all peripherals beyond the minimum level of access to the peripheral.

14. The method of claim 10 , further comprising executing the set of operations associated with the service to check the integrity of the service independent from system maintenance operations.

15. The method of claim 10 , further comprising compiling statistics based on an analysis of each result and based on a number of times the peripheral is accessed when executing the set of operations.

16. The method of claim 10 , further comprising synchronizing a software-defined network script with the integrity checking script to enforce the minimum level of access to the peripheral that is required for each step of each operation in the set of operations to be executed.

17. The method of claim 10 , further comprising generating an alert when the change in the expected system behavior associated with the service has been determined to have occurred.

18. A computer-readable device comprising instructions, which when executed by a processor, cause the processor to perform operations comprising:
launching, at a virtual machine executing a copy of a service, an integrity checking script for checking an integrity of the service, wherein the integrity checking script is activated at selected periodic intervals;
executing, by utilizing the integrity checking script and the virtual machine, a set of operations associated with the service to check the integrity of the service, wherein the set of operations are executed based on a minimum level of access to a peripheral that is required for each operation in the set of operations to be executed, wherein the minimum level of access to the peripheral comprises suspending access to network ports, wherein the set of operations are executed based on the minimum level of access to the peripheral when the system is in an integrity check mode;
determining each result for each operation in the set of operations after each operation is executed;
analyzing, by utilizing the virtual machine, each result to determine if a failure for an operation in the set of operations exists; and
determining, if the failure exists, that a change in an expected system behavior associated with the service has occurred.

19. The computer-readable device of claim 18 , wherein the operations further comprise synchronizing a software-defined network script with the integrity checking script to enforce the minimum level of access to the peripheral that is required for each step of each operation in the set of operations to be ex

Assignees

• At & T Ip I Lp

Inventors

• Jayawardena Thusitha
• Bickford Jeffrey E
• Istomin Mikhail
• Liefert John
• Singaraju Gokul
• Van Wart Christopher

Classifications

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F9/45512

  Command shells · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/0712

  in a virtual computing platform, e.g. logically partitioned systems · CPC title