Abstract: A method is provided for protecting a computer system, comprising creating an isolated process, then assigning a first process group to the process; creating an additional group process within the first process group; performing a first determination by an application programming interface (API) that the additional group process is within the first process group, and as a result of the first determination, causing the additional group process to inherit and duplicate a handle of the process. Process communications and control within isolated groups is permitted freely, whereas process control by an isolated process for non-isolated processes or isolated processes in different groups is constrained or prohibited.
Type:
Grant
Filed:
June 27, 2017
Date of Patent:
March 26, 2019
Assignee:
SECURE VECTOR, LLC
Inventors:
James B. Kargman, Peter Scott, Jeffrey Bromberger
Abstract: A method is provided for protecting a computer system, comprising creating an isolated process, then assigning a first process group to the process; creating an additional group process within the first process group; performing a first determination by an application programming interface (API) that the additional group process is within the first process group, and as a result of the first determination, causing the additional group process to inherit and duplicate a handle of the process. Process communications and control within isolated groups is permitted freely, whereas process control by an isolated process for non-isolated processes or isolated processes in different groups is constrained or prohibited.
Type:
Grant
Filed:
July 7, 2014
Date of Patent:
September 27, 2016
Assignee:
Secure Vector, LLC
Inventors:
James B. Kargman, Peter Scott, Jeffrey Bromberger