Temporary process deprivileging

Patent metadata

Field	Value
Publication number	US-9723006-B2
Application number	US-201514752902-A
Country	US
Kind code	B2
Filing date	Jun 27, 2015
Priority date	Jun 27, 2015
Publication date	Aug 1, 2017
Grant date	Aug 1, 2017

Abstract

There is disclosed in an example a computing apparatus, including: a process deprivilging engine operable for: recognizing that a process has an undetermined reputation; intercepting a first access request directed to a first resource; determining that the first resource is not owned by the process; and at least partially blocking access to the first resource. There is further disclosed a method of providing the process deprivileging engine, and one or more computer-readable mediums having stored thereon executable instructions for providing the process deprivileging engine.

First claim

What is claimed is:

1. A computing apparatus, comprising:
a process deprivileging engine operable for:
recognizing that a process has an undetermined reputation;
intercepting a first access request by the process directed to a first resource;
determining that the first resource is not owned by the process; and
based at least in part on the undetermined reputation and the determination that the first resource is not owned by the process, at least partially blocking access to the first resource.

2. The computing apparatus of claim 1 , wherein the process deprivileging engine is further operable for:
intercepting a second access request directed to a second resource;
determining that the second resource is owned by the process; and
permitting access to the second resource.

3. The computing apparatus of claim 1 , wherein the process deprivileging engine is further operable for:
intercepting a third access request directed to a third resource;
determining that the third resource is owned by a user owning the process, and that the resource is not owned by the process; and
permitting read-only access to the third resource.

4. The computing apparatus of claim 1 , wherein the process deprivileging engine is further operable for determining that the first access request is a safe access, and restoring privileges to the process.

5. The computing apparatus of claim 1 , wherein the process deprivileging engine is further operable for determining that the first access request is an auto-blocked access, and terminating the process.

6. The computing apparatus of claim 1 , wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving an affirmative response, and restoring privileges to the process.

7. The computing apparatus of claim 1 , wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving a negative response, and terminating the process.

8. One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions for providing a deprivileging engine operable for:
recognizing that a process has an undetermined reputation;
intercepting a first access request by the process directed to a first resource;
determining that the first resource is not owned by the process; and
based at least in part on the undetermined reputation and the determination that the first resource is not owned by the process, at least partially blocking access to the first resource.

9. The one or more tangible, non-transitory computer-readable storage mediums of claim 8 , wherein the process deprivileging engine is further operable for:
intercepting a second access request directed to a second resource;
determining that the second resource is owned by the process; and
permitting access to the second resource.

10. The one or more tangible, non-transitory computer-readable storage mediums of claim 8 , wherein the process deprivileging engine is further operable for:
intercepting a third access request directed to a third resource;
determining that the third resource is owned by a user owning the process, and that the resource is not owned by the process; and
permitting read-only access to the third resource.

11. The one or more tangible, non-transitory computer-readable storage mediums of claim 8 , wherein the process deprivileging engine is further operable for determining that the first access request is a safe access, and restoring privileges to the process.

12. The one or more tangible, non-transitory computer-readable storage mediums of claim 8 , wherein the process deprivileging engine is further operable for determining that the first access request is an auto-blocked access, and terminating the process.

13. The one or more tangible, non-transitory computer-readable storage mediums of claim 8 , wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving an affirmative response, and restoring privileges to the process.

14. The one or more tangible, non-transitory computer-readable storage mediums of claim 8 , wherein the process deprivileging engine is further operable for prompting a user for a verification input, receiving a negative response, and terminating the process.

15. A computer-implemented method of providing a process deprivileging engine, comprising:
recognizing that a process has an undetermined reputation;
intercepting a first access request by the process directed to a first resource;
determining that the first resource is not owned by the process; and
based at least in part on the undetermined reputation and the determination that the first resource is not owned by the process, at least partially blocking access to the first resource.

16. The computer-implemented method of claim 15 , further comprising:
intercepting a second access request directed to a second resource;
determining that the second resource is owned by the process; and
permitting access to the second resource.

17. The computer-implemented method of claim 15 , further comprising:
intercepting a third access request directed to a third resource;
determining that the third resource is owned by a user owning the process, and that the resource is not owned by the process; and
permitting read-only access to the third resource.

18. The computer-implemented method of claim 15 , further comprising determining that the first access request is a safe access, and restoring privileges to the process.

19. The computer-implemented method of claim 15 , further comprising determining that the first access request is an auto-blocked access, and terminating the process.

20. The computer-implemented method of claim 15 , further comprising prompting a user for a verification input, receiving an affirmative response, and restoring privileges to the process.

21. The computer-implemented method of claim 15 , further comprising prompting a user for a verification input, receiving a negative response, and terminating the process.

Assignees

• Mcafee Inc

Inventors

• Zhang Zheng
• Teddy John D
• Schmugar Craig D
• Aktas Erdem
• Merrill Clint R
• Mehta Kunal

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title