Patent Application
20250133097
The present description relates to a method for monitoring and enforcing security policies in a device.
The method of the present description can be enforced against known or unknown cyber security attacks on a device with an operating system installed therein. In particular, the present invention relates to an embedded security solution for protecting devices, and specifically for IoT embedded devices.
Embedded IoT devices are widely used to control other devices or surrounding the environment due to their ability to collect data and communicate with users. Embedded devices are constantly becoming a significant and essential part of everyday life, and their velocity and reliability are improving day by day.
Embedded systems and devices have a significant number of advantages as they can be used in all types of industries, such as automotive, healthcare, aerospace, and defence. In addition, embedded systems are cost effective, energy efficient, and offer a lot of opportunities for improvement and upgrade.
However, embedded systems and devices are potentially exposed to cyber-attacks and malicious activities that may disrupt the security of the system.
Existing solutions provide limited methods for ensuring device security. In particular, known methods and software operate at network, or cloud, level through external programs.
As the known methods are implemented in software external to the device, they are only relevant against network intrusions and network attacks. Moreover, the known methods and software require an active and constant communication with external entities and with the device. Indeed, the security mechanism operates remotely, and the countermeasures identified against the cyber-attacks need to be communicated to the device or to cloud services. As a result, current prior art methods and software may introduce delays in the protection process and may be not fast enough to block a potential threat.
The object of the invention in question is to provide a method for monitoring and enforcing secure policies in a device able to overcome the drawback of the prior art.
A further object of the present invention is to obtain a method for monitoring and enforcing secure policies in a device, which make it possible to reduce the risks of cyber-attacks and the effort of manual human interventions.
The method for monitoring and enforcing secure policies in a device is an embedded method that allows the observability of the device by evaluating internal processes in the device through direct collection of kernel data, such as processes, system calls, file systems and networking data. In this way, it is possible to achieve a deeper level of protection by embedding the security in the device.
The method of the present invention can also guarantee faster countermeasures against threat events as they are generated directly from the collected kernel data and, unlike prior art methods, the present method does not depend on external sources, such as cloud services.
In particular, by virtue of an embodiment, the method implements enhanced Berkeley Packets Filter probes to communicate directly with the kernel of the operating system. This method is in fact particularly useful for Linux systems.
The features and advantages of the present invention will become apparent from the following detailed description of a possible practical embodiment thereof, illustrated by way of non-limiting example in the accompanying drawings, in which:
The present invention relates to a method for monitoring and enforcing secure policies in a device 1. In particular, the object of the present invention is a method that allows the observability of the device 1, i.e., the measurement of the device's state based on the data it generates, and the protection of the same against cyber-attacks. In more detail, the present invention allows to monitor and identify the vulnerability of a firmware by means of a method for monitoring and enforcing secure policies embedded in the device 1.
In the attached figures, the number 1 refers to a device 1 that comprises a data storage, for example a hard disk (not shown in the attached figures), in which an operating system OS resides and is installed therein.
Within the scope of the present invention, the operating system OS, schematically illustrated in
Preferably, the operating system OS comprises one of the known operating systems such as Microsoft Windows or one of the Unix-like operating systems based on the Linux kernel.
The method comprises the step of a) providing at least one packet filtering module 2 residing in the user space US of the operating system OS.
The packet filtering module 2 is configured to read and collect kernel data directly from the kernel space KS of the operating system OS and to convert the collected kernel data into one or more corresponding events. More specifically, the packet filtering module 2 is configured to collect granular data with low overhead and to marshalled them into formatted events, which are made available in the user space US.
In the context of the present invention, an event is a message comprising general information or details about the collected data. Each event comprises a header and/or a payload relating to predetermined information, generic or detailed, of the collected kernel data.
Advantageously, the packet filtering module 2 of the present invention allows for an evaluation of internal processes in the device 1 by directly collecting kernel data, thus ensuring security and execution efficiency.
According to the preferred embodiment, the packet filtering module 2 comprises enhanced Berkeley Packet Filter (eBPF). The eBPF is a technology that allows sandboxed programs to run within the operating system kernel and safely extend the kernel capabilities without the need to modify kernel source code or load kernel modules that could cause kernel panic.
The method comprises the step of b) providing a data bus 3 that resides in the user space US of the operating system OS and is in signal communication with the at least one packet filtering module 2 to receive events from the packet filtering module 2. The data bus 3 is hence configured to store the received events.
It should be noted that the data bus 3 is a virtual communication system that allows data to be transferred between components or virtual modules of the device. In other words, the data bus 3 is configured to receive and/or transmit data and to store the received data, which can be accessed by any modules in communication with the data bus.
The method also comprises the step of c) providing a plurality of secure policies residing in the user space US of the operating system OS, each of which comprises a set of executable actions or commands. Preferably, the set of executable actions or commands comprises one or more of: executing operating system functionalities, restricting connection to/from specific IP addresses, and killing undesired running processes. Still preferably, the set of executable actions or commands comprises a list of any action or command that the device can perform to block or counterattack a cyber security attack.
The method comprises the step of d) providing at least one policy enforcement module 4 that resides in the user space US of the operating system OS and is in signal communication with the data bus 3 to receive events from the data bus 3. The policy enforcement module 4 is configured to execute one or more secure policies in the device.
The method then comprises the step of e) collecting kernel data from the kernel space KS by the packet filtering module 2.
The method further comprises the step of f) processing and converting collected kernel data by the packet filtering module 2 into one or more corresponding events.
The method comprises the steps of g) transmitting one or more events by the packet filtering module 2 to the data bus 3, g′) storing the one or more events in the data bus 3 and g″) transmitting the one or more events by the data bus 3 to the policy enforcement module 4.
It should be noted that the steps g), g′) and g″) should be carried out in this specific order only in the first application of the method. In fact, since more events could be transmitted from the packet filtering module 2 to the data bus 3 and stored in the data bus 3, there could be a temporal overlapping of these steps which can depend on the functioning of the device.
The method comprises the step of h) monitoring the device 1 by evaluating the events and identifying one or more threat events by the policy enforcement module 4.
The policy enforcement module 4 comprises an evaluating algorithm configured to receive events and the plurality of secure policies as inputs, to evaluate the received events, to identify threat events and one or more corresponding secure policies based on the identified threat events. Therefore, the output of the algorithm is the identified secure policies and the identified threat events.
The method then comprises the step of i) identifying one or more secure policies from the plurality of secure policies by the policy enforcement module 4 if a threat event is identified by the evaluating algorithm.
Finally, the method comprises the step of j) enforcing the identified secure policies by the policy enforcement module 4 in order to block or counterattack the cyber-attack.
It should be noted that thanks to the direct collection of kernel data, the method of the present invention allows real-time data monitoring, with minimal latency and minimal system overhead. Specifically, the present method allows for a prompt response as it does not require communication with external entities.
According to the preferred embodiment of the present invention, the at least one packet filtering module 2 comprises at least one virtual probe 5, preferably an eBPF probe, which is configured to read and collect kernel data.
It should be noted that the virtual probe 5 is configured to connect the kernel space KS to the user space US in order to extract data from the kernel space SP and make it available in the user space US.
Preferably, the virtual probe 5 is associated with a corresponding activity of the operating system OS. The activity of the operating system OS preferably relates to one of the following: networking, traffic patterns, filesystem, processes, device activities and system calls.
Optionally, the step of a) providing at least one packet filtering module 2 comprises the sub-step of a′) providing a plurality of packet filtering modules 2, each one comprising a respective virtual probe 5 associated with a corresponding activity to be monitored. Alternatively, the at least one packet filtering module 2 comprises a plurality of virtual probes 5, wherein each virtual probe 5 is associated with a corresponding activity to be monitored.
It should be noted that, in this way, each virtual probe 5 of the packet filtering module 2, or the respective virtual probe 5 of each packet filtering module 2, is configured to collect and transform kernel data independently from the other virtual probes 5.
According to the preferred embodiment of the present invention, the step of e) processing and converting collected kernel data into one or more events comprises the sub-step of e′) generating, for each event, a header and/or a payload as a function of the corresponding collected kernel data. Specifically, the header of the event comprises one or more of timestamp, event type, source module, string or image relating to the event, threat flag. Moreover, the event payload comprises one or more of the following: path of the file, path of the directory, permission set, IP address, filename that has been deleted, port of the source or destination, TPC connection, length of the packet, DNS questions, DNS answers, number or list of arguments passed to the executable.
According to a first embodiment, the evaluating algorithm of the policy enforcement module 4 comprises an algorithm based on Domain Specific Language Rules.
Within the scope of the present invention, a DSL rule is a logical construct defined using a domain specific language shared between the present method and a user who wrote the rule.
Preferably, each DSL rule comprises at least one logical construct defined by a corresponding condition to be verified. More preferably, each DSL rule comprises two logical constructs, i.e., the condition to be verified and at least one corresponding secure policy.
Still according to the first embodiment, the step of h) monitoring the device 1 preferably comprises the sub-step of h-1) comparing the events with one or more conditions of the DLS Rules.
Preferably, the step of h) monitoring the device 1 also comprises the sub-step of h_2) generating a condition output as a function of the comparison, wherein the condition output comprises positive and/or negative condition output.
Still preferably, the step of h) monitoring the device 1 also comprises the sub-step of h-3) generating a threat flag for the corresponding event and marking the event as threat event for a positive condition output.
Still preferably, the step of h) monitoring the device 1 also comprises the sub-step of h_4) identifying at least one corresponding secure policy for the threat event. Still according to the first embodiment of the present invention, the step of j) enforcing the identified secure policy comprises the sub-steps of j-1) evaluating the condition output and enforcing the identified secure policy for positive condition outputs.
According to a second embodiment of the present invention, alternative to the first embodiment, the evaluating algorithm comprises a supervised or semi-supervised machine learning algorithm. In particular, the machine learning algorithm comprises one of the following: neural network algorithm, random forest algorithm, ensemble algorithm.
It should be noted that a supervised algorithm allows a binary classification of each event, whereas a semi-supervised algorithm is preliminarily trained with only with non-threat events, and it then allows each event to be compared with the distribution of observed events.
Preferably, the step of h) monitoring the device 1 comprises the sub-step of h_1′) generating a score output for each event. In more detail, in the case of a supervised machine learning algorithm, the sub-step of h_1′) generating a score output for each event envisages the generation of a scalar binary output.
Still preferably, the step of h) monitoring the device 1 comprises the sub-step of h_2′) generating a threat flag for the corresponding event and marking the event as threat event for scores above a predetermined threshold. In more detail, in the case of a supervised machine learning algorithm, the threat flag is generated on the basis of the comparison of the scalar binary output with a predetermined value, whereas in the case of a semi-supervised algorithm the threat flag is generated when the event is to be considered as deriving from a different distribution with respect to that of the observed events.
Still preferably, the step of h) monitoring the device 1 comprises the sub-step of h_3′) identify at least one corresponding secure policy for the threat event.
Still according to the second embodiment of the present invention, the step of j) enforcing the identified secure policy comprising the sub-steps of j-1′) evaluating the score output and enforcing the identified secure policy for score outputs above the predetermined threshold.
Advantageously, the method of the present invention allows to reduce the risks of cyber-attacks and to reduce the effort of manual human interventions. In fact, the method is embedded in the device, allowing a deeper level of protection.
Since the method of the present invention is embedded in the device 1 and does not depend on external sources, it can also guarantee faster countermeasures against threat events, since they are generated directly from the collected kernel data.
Furthermore, the method of the present invention thus allows for protection and security enforcement in the device 1 in an autonomous manner.
Another object of the present invention is a computer program residing in the data storage of the device 1, e.g., software, that comprises instructions which, when the program is executed by the device 1, cause the device to carry out the steps of the method of the present description.
An exemplary application of the method of the present invention is described below, for a device IoT Linux configured with industrial gateway functionality and therefore dedicated to routing and packet routing activities.
In the described example, the device 1 comprises a computer program according to the present description that can be run in background then the device is started.
Specifically, the sub-step of a′) providing a plurality of packet filtering modules 2 of the method according to the present description, envisages providing at least four eBPF modules, each comprising a virtual eBPF probe 5 for a corresponding system activity. In this example, the system activities relate to networking, file-system, process execution and system calls, each of which is thus monitored independently from the others by a respective eBPF probe.
For each virtual probe 5, the method envisages the sub-step of e′) generating for each event a header and a payload for the corresponding system activity. It should be noted that, in the described example, most of the events are likely to be generated by the networking packet filtering module 2, relating to the opening or closing of connections between the gateway and other devices.
In the example described, according to the first embodiment of the present invention, the DLS Rules on which the algorithm of the policy enforcement module 4 is based comprise an IP blacklist, while a corresponding security policy comprises a list of actions relating to the termination of the connection with a specific device. In this way, the method of the present description allows to block or terminate the connection with devices having a corresponding IP reported in the blacklist.
Alternatively, according to the second embodiment, an AI model on which the algorithm of the policy enforcement module 4 is based tracks and flags a sequence of packets as threat events, while a corresponding security policy comprises a list of actions relating to the immediate termination of the connection and the blocking of further accesses. In this way, the method of the present description allows to recognise the flagged packets as an anomalous behaviour of the device 1 or as a malware attack (e.g., a DDOS attack) and to terminate or block the access to the device 1.
| Number | Date | Country | Kind |
|---|---|---|---|
| 102023000021819 | Oct 2023 | IT | national |
