Reputation Driven Firewall

• US 20080022384A1
• Filed: 06/06/2006
• Published: 01/24/2008
• Est. Priority Date: 06/06/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Yee, Steven C., Mitchell, Michael, Shubin, Tatiana, Hall, Brian R., Kakumani, Vikram, Gandhi, Mauktik H.
• Granted Patent: US 7,761,912 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

Reputation based firewall policy techniques are described, in which, a computer-implemented method may be employed to collect data from a plurality of clients regarding an application attempting to access a network via the clients. The collected data may be exposed to a community of users to obtain feedback on the application which is used to produce a reputation for the application. The reputation may then be provided to the plurality of clients to determine whether to permit the attempt by the application.

Claims

1. A method comprising:

exposing data to a community of users that is collected from a plurality of clients regarding an application that attempts access to a network;

receiving feedback from the community of users regarding whether to allow network access to the application; and

producing a reputation from the feedback for the application.

2. A method as recited in claim 1, further comprising providing the reputation to one or more clients, wherein the clients are configured to use the reputation to determine whether to permit the application access to the network automatically and without user intervention.

3. A method as recited in claim 1, wherein:

the collected data describes a plurality of applications; and

the exposing includes exposing a user interface through which the community of users may interact with the collected data.

4. A method as recited in claim 3, wherein the user interface when exposed provides functionality to:

examine data collected for the plurality of applications;

search the collected data for particular data that corresponds to a specified application; and

input feedback for one or more of the plurality of applications.

5. A method as recited in claim 1, wherein the community of users examine the collected data via a user interface exposed on a public web site and input the feedback using the user interface.

6. A method as recited in claim 5, wherein the feedback for each user in the community comprises inputting via the user interface a choice between blocking or allowing the application.

7. A method as recited in claim 5, wherein the feedback for each user in the community comprises inputting via the user interface a rating on relative scale which indicates trustworthiness of the application to access the network.

8. A method as recited in claim 1, wherein the application is a stand-alone executable module or a plug-in module configured to modify another executable module.

9. A method as recited in claim 1, further comprising:

incorporating the reputation in a firewall policy which matches a plurality of applications with reputations produced based on corresponding feedback from the community of users; and

providing the firewall policy to one or more clients, such that when an application attempts access the clients are configured to access a corresponding reputation from the firewall policy and use the reputation to determine whether to permit the application access to the network automatically and without user intervention.

10. A method comprising:

maintaining a plurality of reputations for applications produced using feedback provided by a community of users regarding the applications; and

distributing the reputations to clients to control network access attempts by one or more applications of the respective clients.

11. A method as recited in claim 10, wherein the client is configured to access the reputation to determine whether to permit the attempt automatically and without user intervention.

12. A method as recited in claim 10, wherein the plurality of reputations are distributed to clients incorporated with a firewall policy which matches the plurality of reputations to corresponding applications, such that when an application attempts access the clients are configured to access a corresponding reputation from the firewall policy and use the reputation to determine whether to permit the application access to the network automatically and without user intervention.

13. A method as recited in claim 10, wherein the reputations are configured as ratings on a relative scale which indicate trustworthiness of the applications to access the network.

14. A method as recited in claim 10, wherein:

the reputations are configured as ratings on a relative scale which indicate trustworthiness of corresponding applications to access the network; and

an attempt by an application is permitted when the rating corresponding to the application meets a threshold rating set by the client.

15. A method comprising:

detecting, at a client, an attempt by an application to access a network from the client; and

determining, based on a reputation, whether to permit the network access attempt wherein the reputation is based on feedback collected from a community of users.

16. A method as recited in claim 15, wherein the determining occurs at the client automatically and without user intervention.

17. A method as recited in claim 15, wherein the determining includes accessing the reputation via a network from a service configured to:

maintain a plurality of reputations each corresponding to a least one application; and

in response to a request by a client, provide access to a particular reputation sought by the request.

18. A method as recited in claim 15, wherein the determining includes accessing the reputation from a firewall policy which matches a plurality of reputations to corresponding applications.

19. A method as recited in claim 15, wherein the reputation is configured as an overall rating determined from a plurality of individual ratings of the application compiled from the community of users.

20. A method as recited in claim 15, wherein:

the feedback collected from each of the community of users indicates a choice between blocking or allowing the application; and

the reputation is configured as an overall block or allow instruction summarizing the feedback.