US 11,714,884 B1
Systems and methods for establishing and managing computer network access privileges
Joseph Sirianni, Ithaca, NY (US); and Matthew Donovan, Ithaca, NY (US)
Assigned to Architecture Technology Corporation, Minneapolis, MN (US)
Filed by Architecture Technology Corporation, Minneapolis, MN (US)
Filed on Jun. 6, 2022, as Appl. No. 17/833,159.
Application 17/833,159 is a continuation of application No. 16/839,728, filed on Apr. 3, 2020, granted, now 11,354,386.
Application 16/839,728 is a continuation of application No. 15/701,128, filed on Sep. 11, 2017, granted, now 10,628,560, issued on Apr. 21, 2020.
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/12 (2013.01); H04L 9/40 (2022.01); G06F 21/60 (2013.01); H04W 12/08 (2021.01)
CPC G06F 21/123 (2013.01) [G06F 21/604 (2013.01); H04L 63/101 (2013.01); H04W 12/08 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A non-transitory, computer-readable storage medium having encoded thereon, machine instructions for establishing and managing computer network access privileges, wherein a processor executes the machine instructions to:
access information related to applications instantiated on a computer system, wherein the information comprises information contained in a privilege profile and in a behavior profile;
identify applications for which neither privilege profiles nor behavior profiles exist;
monitor application instantiations to determine that sufficient information is available to generate a privilege profile and a behavior profile for the application;
create one or more persistent access control lists (ACLs) for the application, and store the persistent ACLs;
receive a system call request from an application;
determine, from a persistent ACL, that the received system call request exists as one of a permanently-allowed system call request and a non-permanently-allowed system call request;
for permanently-allowed system call requests:
determine the system call request pertains to one of a behavior contained in the behavior profile for the application and one of a new behavior for the application,
for a behavior contained in the behavior profile for the application, grant access by the application to an operating system kernel of the computer system, and
for a new behavior, provide a first prompt to a human user to allow or deny the application access to the operating system kernel by way of the system call request; and
for a non-permanently-allowed system call request:
generate a volatile ACL,
provide a second prompt to a human user to allow or deny the application access to the operating system kernel by way of the non-permanently allowed system call request,
add the non-permanently-allowed system call request to the volatile ACL, and
following execution of the application, delete the volatile ACL.