Method and system for ensuring that computer programs are trustworthy

• US 20060090192A1
• Filed: 10/21/2004
• Published: 04/27/2006
• Est. Priority Date: 10/21/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hawkins, John M., Goldfeder, Aaron, Corby, Karen E.
• Granted Patent: US 7,516,477 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability

Abstract

Described is a system and method by which an application program is evaluated for trustworthiness based on the permissions and/or privileges it requests relative to a program category. The program describes the permissions needed to operate, and identifies itself as belonging to a particular category. Security components compare the requested permission set against the permissions that programs of that category actually need in order to operate properly. Programs requesting more permissions than needed are deemed untrustworthy. For example, screen saver application programs need only a limited permission set to operate properly, including full screen access and the ability to read files, but do not need network access permissions or write access to files. Any screensaver application that requests only the needed permission set is deemed trustworthy, while others that request permissions beyond what is actually needed are not deemed trustworthy, and a user or automated policy process may then intervene.

Claims

1. In a computing environment, a method comprising:

receiving security-related information and category-related information corresponding to an application program;

accessing established security-related data based on the category-related information;

evaluating whether the received security-related information corresponds to the established security-related data, and if so, considering the application program as trustworthy.

2. The method of claim 1 wherein the application is trustworthy, and further comprising, applying a first policy with respect to installing the application program.

3. The method of claim 2 wherein applying the first policy comprises determining whether information is needed from a user of the computer, and if not, installing the application program.

4. The method of claim 3 wherein information is needed from the user of the computer, and further comprising, prompting the user for the information before installing the application program.

5. The method of claim 1 wherein the application is not trustworthy, and further comprising, applying a policy to determine whether to allow the application program to be installed.

6. The method of claim 5 wherein applying the policy comprises warning a user that the application program is not a trusted application program, and waiting for user input that determines whether to allow the application program to be installed.

7. The method of claim 1 wherein accessing the established security-related data comprises reading a first data set of at least one permission or privilege that application programs that correspond to the category-related information are allowed to have, and wherein evaluating whether the received security-related information corresponds to the established security-related data comprises comparing the first data set to a second data set of at least one permission or privilege that the application program is requesting via the security-related information, such that the application program is considered as trustworthy when the second data set does not request any permission or privilege that is not contained in the first data set.

8. The method of claim 1 wherein the category-related information identifies the application program as a screen saver, wherein accessing the established security-related data comprises reading a first data set of at least one permission or privilege that screen saver applications are allowed to have, and wherein evaluating whether the received security-related information corresponds to the established security-related data comprises comparing the first data set to a second data set of at least one permission or privilege that screen saver application program is requesting, such that the application program is considered as being trustworthy when the second data set does not request any permission or privilege that is not contained in the first data set.

9. The method of claim 8 wherein the first data set includes an entry corresponding to a full screen permission.

10. The method of claim 1 wherein receiving the security-related information and the category-related information comprises receiving at least one manifest associated with an application program.

11. One or more computer-readable media having computer-executable instructions which when executed perform the method of claim 1.

12. At least one computer-readable medium having computer-executable instructions which when executed perform a method, comprising:

receiving category-related information corresponding to an application program; and

controlling installation of the application program based on the category-related information.

13. The computer-readable medium of claim 12 further comprising, receiving security-related information corresponding to the application program, and wherein controlling installation of the application program comprises accessing established security-related data based on the category-related information and applying a policy to control installation based on whether the received security-related information corresponds to the established security-related data.

14. The computer-readable medium of claim 13 wherein the received security-related information corresponds to the established security-related data, and wherein applying the policy to control installation comprises installing the application program without providing a security warning.

15. The computer-readable medium of claim 14 further comprising receiving configuration information from the user prior to installing the application program.

16. The computer-readable medium of claim 13 wherein the received security-related information does not correspond to the established security-related data, and wherein applying the policy to control installation comprises preventing installation of the application program without requiring further user input.

17. The computer-readable medium of claim 13 wherein the received security-related information does not correspond to the established security-related data, and wherein applying the policy to control installation comprises preventing installation of the application program.

18. The computer-readable medium of claim 13 wherein the received security-related information does not correspond to the established security-related data, and wherein applying the policy to control installation comprises requiring user input to determine whether to allow or prevent installation of the application program.

19. The computer-readable medium of claim 13 wherein accessing the established security-related data comprises reading a first data set of at least one permission or privilege that application programs that correspond to the category-related information are allowed to have.

20. The computer-readable medium of claim 12 wherein controlling installation of the application program comprises associating security-related information with the application program based on the category-related information.

21. The computer-readable medium of claim 12 wherein receiving category-related information corresponding to the application program comprises, receiving security-related information associated with the application program, and providing the category-related information based on a review of the security-related information.

22. The computer-readable medium of claim 12 wherein the category-related information identifies the application program as a screen saver, and wherein controlling installation of the application program based on the category-related information comprises applying an installation policy based on security-related information associated with screen saver application programs.

23. In a computing environment, a system comprising:

a category data store that contains established security-related information; and

a trust manager that receives category-related information corresponding to an application program, the trust manager coupled to the category data store to control installation of the application program based on a set of established security-related information that corresponds to the category-related information that was received.

24. The system of claim 23 wherein the application program comprises a screensaver application program.

25. The system of claim 23 wherein the trust manager assigns a permission set to the application program based on the received category-related information.

26. The system of claim 23 wherein the application program provides a requested permission set, and wherein the trust manager controls installation based on an evaluation of the requested permission set against the established security-related information that corresponds to the received category-related information.

27. The system of claim 26 wherein the trust manager controls installation by applying a policy that corresponds to a result of the evaluation.

28. The system of claim 27 wherein the trust manager controls installation by preventing installation according to policy when the evaluation of the requested permission set against the established security-related information indicates that there is not a sufficient level of correspondence.

29. The system of claim 27 wherein the trust manager controls installation by applying policy that prompts a user to warn of installation consequences and allowing the user to decide whether to continue installation when the evaluation of the requested permission set against the established security-related information indicates that there is not a sufficient level of correspondence.

30. The system of claim 27 wherein the trust manager controls installation by obtaining configuration information and installing the application program based on the configuration information when the evaluation of the requested permission set against the established security-related information indicates that there is a sufficient level of correspondence.

31. The system of claim 23 wherein the trust manager receives the category-related information and a requested permission set in a set of at least one manifest associated with the application program.

32. In a computing environment, a method comprising:

receiving a request to install a screensaver program, the screensaver program including code associated with a requested permission set and category-related information that identifies the program as belonging to a screensaver category;

evaluating whether the requested permission set corresponds to an safe permission set established for programs of a screensaver category; and

a) when the requested permission set corresponds to the safe permission set, applying a first installation policy; and

b) when the requested permission set does not correspond to the safe permission set, applying a second installation policy.

33. The method of claim 32 wherein the requested permission set corresponds to the safe permission set, and wherein applying the first installation policy comprises automatically installing the screensaver program.

34. The method of claim 32 wherein the requested permission set corresponds to the safe permission set, and wherein applying the first installation policy comprises obtaining configuration information and installing the screensaver program based on the configuration information.

35. The method of claim 32 wherein the requested permission set does not correspond to the safe permission set, and wherein applying the second installation policy comprises preventing installation.

36. The method of claim 32 wherein the requested permission set does not correspond to the safe permission set, and wherein applying the second installation policy comprises warning the user and requiring user input to determine whether to allow or prevent installation of the application program.

37. One or more computer-readable media having computer-executable instructions which when executed perform the method of claim 32.