System and method for securing access to system calls

摘要

In one embodiment, a system for securing access to system calls includes a memory, an operating system configured to execute on an electronic device, and a below-operating-system security agent. The below-operating-system security agent is configured to identify one or more resources associated with a system call for which attempted accesses will be trapped, trap an attempted access of the one or more resources that originates from the operational level of the operating system, access one or more security rules to determine whether the attempted access is authorized, and operate at a level below all of the operating systems of the electronic device accessing the one or more resources associated with a system call.

主权项

1. A system for securing access to system calls, comprising:
a memory; a first operating system configured to execute on an electronic device, the first operating system included in one or more operating systems on the electronic device; a below-operating-system security agent configured to:
identify one or more resources associated with a system call for which attempted accesses will be trapped;trap, at a level below all operating systems of the electronic device, an attempted access of the one or more resources that originates from an operational level of the first operating system;access one or more security rules to determine, at a level below all operating systems of the electronic device, whether the attempted access is authorized; andoperate at a level below all operating systems of the electronic device; wherein:
the trapped attempt is an attempted execution of a system call function of the first operating system, the system call function indexed by a system call table;the below-operating system security agent is further configured to:
determine that the attempted execution of the system call function was made without accessing the indexing of the system call table; andbased upon a determination that the attempted execution of the system call function was made without accessing the indexing of the system call table, deny the attempted execution.