Tagging obtained content for white and black listing

• US 20060230452A1
• Filed: 06/09/2006
• Published: 10/12/2006
• Est. Priority Date: 10/29/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Field, Scott A.
• Granted Patent: US 8,544,086 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection

Abstract

A system and method for providing enhanced security with regard to obtained files is presented. Upon obtaining a file from an external location, the obtained file is tagged with tagging information regarding the origin of the obtained file. Additionally, an operating system suitable for execution on a computing device is also presented. The operating system includes at least one application-callable function (API) for obtaining content from an external location. Each application-callable function for obtaining content from an external location is configured to associate tagging information with each obtained file, the tagging information comprising the origin of the obtained file. The origin of the obtained file can be used for subsequent security policy decisions, such as whether to allow or block execution or rendering of the content, as well as whether the content will be accessed in a constrained environment such as a “sandbox” or virtual machine.

Claims

1. A computer system for providing enhanced security with regard to obtained files, the computer system comprising:

a processor;

a memory; and

a file system;

wherein, upon obtaining a file from an external location, the computer system is configured to tag the obtained file with tagging information regarding the origin of the obtained file.

2. The computer system of claim 1 further comprising a rules data store describing rules for acting upon obtained files according to the obtained file'"'"'s trustworthiness;

and

wherein the computer system, when acting upon the obtained file, is configured to determine the obtained file'"'"'s trustworthiness and act upon the obtained file according to a corresponding rule in the rules data store.

3. The computer system of claim 2 further comprising a black-list data store comprising information regarding untrustworthy sources, and wherein the computer system determines the obtained file'"'"'s trustworthiness by determining whether the origin of the obtained file, as described in the obtained file'"'"'s tagging information, is found in the black-list data store.

4. The computer system of claim 2 further comprising a white-list data store comprising information regarding trustworthy sources, and wherein the computer system determines the obtained file'"'"'s trustworthiness by determining whether the origin of the obtained file, as described in the obtained file'"'"'s tagging information, is found in the white-list data store.

5. The computer system of claim 1, wherein a file in the file system is stored as one or more separate data streams in the file system, and wherein the computer system tags the obtained file with tagging information by storing information regarding the origin of the obtained file as one of the obtained file'"'"'s data streams.

6. The computer system of claim 1, wherein a file in the file system is stored as one or more records in a file system database, and wherein the computer system tags the obtained file with tagging information by storing information regarding the origin of the obtained file as one of the obtained file'"'"'s records file system database.

7. The computer system of claim 1 further comprising an obtained files tag store for storing tagging information corresponding to each obtained file on the computer system, and wherein the computer system tags the obtained file with tagging information by storing information regarding the origin of the obtained file in the obtained files tag store.

8. The computer system of claim 1 further comprising an anti-malware component, and wherein the computer system tags the obtained file with tagging information regarding the origin of the obtained file via the anti-malware component which stores the tagging information in a data store accessible only to the anti-malware component.

9. The computer system of claim 1, wherein the computer system'"'"'s operating system is configured to automatically store tagging information for the obtained file as part of a function of obtaining the obtained file.

10. The computer system of claim 1, wherein an user application that obtains the obtained file is configured to store tagging information for the obtained file as part of a function of obtaining the obtained file.

11. A method for enhancing the security of a computing device with regard to a file obtained from an external source, the method comprising:

obtaining a file from an external source; and

tagging the obtained file with tagging information identifying the origin of the obtained file.

12. The method of claim 11 further comprising:

determining the trustworthiness of the obtained file according to the tagging information; and

processing the file according to predetermined rules corresponding to the obtained file'"'"'s trustworthiness.

13. The method of claim 12, wherein determining the trustworthiness of the obtained file according to the tagging information comprises comparing the tagging information of the obtained file to a white-list of trustworthy sources.

14. The method of claim 13, wherein determining the trustworthiness of the obtained file according to the tagging information further comprises comparing the tagging information of the obtained file to a black-list of trustworthy sources.

15. The method of claim 11, wherein tagging the obtained file with tagging information identifying the origin of the obtained file comprises storing the origin of the obtained file in an alternate data stream of the obtained file.

16. The method of claim 11, wherein tagging the obtained file with tagging information identifying the origin of the obtained file comprises storing the origin of the obtained file with an anti-malware application operating on the computing device.

17. The method of claim 11, wherein the tagging information identifying the origin of the obtained file comprises a Uniform Resource Identifier of the obtained file.

18. An operating system suitable for execution on a computing device having a processor and memory, the operating system comprising at least one application-callable function for obtaining content from an external location, wherein each application-callable function for obtaining content from an external location is configured to associate tagging information with each obtained file, the tagging information comprising the origin of the obtained file.

19. The operating system of claim 18, wherein the operating system associates tagging information with each obtained file by storing the tagging information in an alternate data stream associated with the obtained file.

20. The operating system of claim 18 being further configured to process the obtained file according to predetermined rules based on the obtained file'"'"'s trustworthiness, and wherein the obtained file'"'"'s trustworthiness is determined according to the obtained file'"'"'s tagging information and at least one list identifying an origin with its corresponding trustworthiness.