METHOD AND APPARATUS FOR PROTECTION OF ELECTRONIC MEDIA
First Claim
1. A server device that is useable for protecting machine readable media, comprising:
- a transceiver to send and receive data; and
a processor operable to perform actions, including;
receiving a response to a detector from a client device, wherein the detector comprises a sequence of different types of system calls; and
determining if there is unauthorized software behavior on the client device by using a matching rule to compare the response and the detector.
5 Assignments
0 Petitions
Accused Products
Abstract
Described is a system and method for providing protection of media by the detection of unauthorized client behaviors and the communication of the unauthorized client behaviors to augment the invention'"'"'s detection abilities. A variety of detectors are sent to a client process and the responses are evaluated to detect the presence of an unauthorized software behavior on the client. Unauthorized behaviors include alteration of a client process as well as simultaneously running processes that might enable unauthorized copying of protected media. Communication of unauthorized software behaviors includes sharing of memory detectors among servers on a network, and the sending of memory detectors to other clients to detect previously unseen unauthorized behaviors on the other clients.
102 Citations
20 Claims
-
1. A server device that is useable for protecting machine readable media, comprising:
-
a transceiver to send and receive data; and
a processor operable to perform actions, including;
receiving a response to a detector from a client device, wherein the detector comprises a sequence of different types of system calls; and
determining if there is unauthorized software behavior on the client device by using a matching rule to compare the response and the detector. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A method of detecting an unauthorized usage of machine readable media, the method comprising:
-
receiving a detector that comprises a sequence of different types of computer system calls;
determining a response to the detector based on at least one action of a client process; and
sending the response to a server, wherein a presence of an unauthorized client process behavior is determined based on a comparison between the response and the detector according to a matching rule associated with the sent detector. - View Dependent Claims (9, 10, 11)
-
-
12. A device that is configured to protect media from unauthorized client behavior, the device comprising:
-
a transceiver to send and receive data over the network; and
a program to perform actions when executed that include;
sending at least one detector to a client device, wherein the at least one detector comprises a sequence of different types of system calls; and
if unauthorized client behavior is detected on the client device based on at least one response from the client device to the at least one detector and at least one matching rule associated with the at least one detector, providing a detection notification. - View Dependent Claims (13, 14, 15, 16, 17, 18)
-
-
19. A client device configured to protect media from unauthorized usage, the client device comprising:
-
a network interface unit configured to send and receive information; and
a program operative to perform actions, including;
generating a plurality of detectors, wherein each detector in the plurality comprises a sequence of different types of system calls;
employing the plurality of detectors to determine at least one response associated with a client process; and
sending the at least one response to a server device, wherein the server device is configured to detect a presence of unauthorized process usage based on the at least one response and a matching rule associated with each detector. - View Dependent Claims (20)
-
Specification