SECURITY METHODS AND SYSTEMS

• US 20120054864A1
• Filed: 11/03/2011
• Published: 03/01/2012
• Est. Priority Date: 04/22/2005
• Status: Abandoned Application

• Current Assignee: Christopher Blumenberg, Christopher Scott Linn, Darin Benjamin Adler, Donald Dale Melton
• Original Assignee: Christopher Blumenberg, Christopher Scott Linn, Darin Benjamin Adler, Donald Dale Melton
• Inventors: Linn, Christopher Scott, Adler, Darin Benjamin, Melton, Donald Dale, Blumenberg, Christopher
• Application Number:
  US13/288,574
• Publication Number:
  US 20120054864A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

The present invention describes methods for improving security when accessing applications and other executable programs. In one exemplary method, a user is warned if an application that has never been previously run is being launched by the user. Other methods, as well as data processing systems and machine readable media, are also described.

Claims

1. A machine-implemented method comprising:

downloading a file;

determining if the file contains executable code; and

issuing a warning to the user before allowing the file to be downloaded.

2. A method as in claim 1 wherein determining if the file contains executable code is accomplished by looking at the raw data bits in the file.

3. A machine-implemented method comprising:

receiving an input to download an application from the Internet to a user'"'"'s system;

issuing a warning to the user before allowing the application to be downloaded.

4. A machine-implemented method comprising:

detecting an attempt to automatically download from the Internet an application to a user'"'"'s system;

issuing a warning to the user before allowing the application to be downloaded.

5. A method as in claim 4 wherein the attempt to download the application may occur without the user'"'"'s knowledge.

6. A method as in claim 4 wherein the application can be any executable code such as a script, dynamically loadable library, applet, or plug-in.

7. A method as in claim 4 wherein the user has the option of restricting the scope of the warning.

8. A machine-implemented method comprising:

downloading an executable program from the Internet;

detecting an attempt to launch the program without a user request to launch the application; and

issuing a warning to the user before allowing the program to be launched.

9. A method as in claim 8 wherein downloading the program occurs in response to a request by the user.

10. A method as in claim 8 wherein downloading the program does not occur in response to a request by the user.

11. A method as in claim 8 wherein the attempt to launch the program originates from an electronic document with a URL scheme wherein the URL scheme is processed only by the program.

12. A method as in claim 8 wherein the attempt to launch the program originates from an electronic document with a URL scheme, wherein the URL scheme is processed automatically by a scripted web page and wherein the user does not request the processing of the URL scheme.

13. A machine-implemented method comprising:

receiving an input to download one or more files contained in an archived file;

determining if any of the files contain executable code; and

issuing a warning to a user that one or more of the files contain executable code.

14. A method as in claim 13 wherein determining if the archived file contains executable code is done by expanding the archive file into its constituent files and looking at at least some of the raw data bits of each constituent file.

15. A method as in claim 14 wherein the constituent files are expanded in a protected storage space where they are inaccessible to the user or other operating system programs.

16. A method as in claim 13 wherein the archived file can be a file encoded with any method, such as a disk image, tar file, zip file, stuffed file, or with any other file compression format.

17. A machine-implemented method comprising:

downloading an application; and

storing the origin of the application as part of metadata compiled about the application in a metadata database.

18. A method as in claim 17 further comprising displaying the metadata, including the origin of the application, in response to a user command.

19. A method as in claim 17 wherein the application informs the operating system of the origin of the application.

20. A machine readable medium providing instructions which when executed by a system cause the system to perform a method comprising:

downloading a file;

determining if the file contains executable code; and

issuing a warning to the user before allowing the file to be downloaded.

21. A medium as in claim 20 wherein determining if the file contains executable code is accomplished by looking at the raw data bits in the file.

22. A machine readable medium providing instructions which when executed by a system cause the system to perform a method comprising:

receiving an input to download an application from the Internet to a user'"'"'s system;

issuing a warning to the user before allowing the application to be downloaded.

23. A machine readable medium providing instructions which when executed by a system cause the system to perform a method comprising:

detecting an attempt to automatically download from the Internet an application to a user'"'"'s system;

issuing a warning to the user before allowing the application to be downloaded.

24. A medium as in claim 23 wherein the attempt to download the application may occur without the user'"'"'s knowledge.

25. A medium as in claim 23 wherein the application can be any executable code such as a script, dynamically loadable library, applet, or plug-in.

26. A medium as in claim 23 wherein the user has the option of restricting the scope of the warning.

27. A machine readable medium providing instructions which when executed by a system cause the system to perform a method comprising:

downloading an executable program from the Internet;

detecting an attempt to launch the program without a user request to launch the application; and

issuing a warning to the user before allowing the program to be launched.

28. A medium as in claim 27 wherein downloading the program occurs in response to a request by the user.

29. A medium as in claim 27 wherein downloading the program does not occur in response to a request by the user.

30. A medium as in claim 27 wherein the attempt to launch the program originates from an electronic document with a URL scheme wherein the URL scheme is processed only by the program.

31. A medium as in claim 27 wherein the attempt to launch the program originates from an electronic document with a URL scheme, wherein the URL scheme is processed automatically by a scripted web page and wherein the user does not request the processing of the URL scheme.

32. A medium as in claim 27 wherein the user has the option of restricting the scope of the warning.

33. A machine readable medium providing instructions which when executed by a system cause the system to perform a method comprising:

receiving an input to download one or more files contained in an archived file;

determining if any of the files contain executable code; and

issuing a warning to a user that one or more of the files contain executable code.

34. A medium as in claim 33 wherein determining if the archived file contains executable code is done by expanding the archive file into its constituent files and looking at at least some of the raw data bits of each constituent file.

35. A medium as in claim 34 wherein the constituent files are expanded in a protected storage space where they are inaccessible to the user or other operating system programs.

36. A medium as in claim 34 wherein the archived file can be a file encoded with any method, such as a disk image, tar file, zip file, stuffed file, or with any other file compression format.

37. A medium as in claim 34 wherein the archived file originates from the Internet.

38. A medium as in claim 34 wherein the user has the option of restricting the scope of the warning.

39. A machine readable medium providing instructions which when executed by a system cause the system to perform a method comprising:

downloading an application; and

storing the origin of the application as part of metadata compiled about the application in a metadata database.

40. A method as in claim 39 further comprising displaying the metadata, including the origin of the application, in response to a user command.

41. A medium as in claim 39 wherein the origin of the application is a web page or another electronic document coming from the Internet.

42. A medium as in claim 39 wherein the application informs the operating system of the origin of the application.

43. A medium as in claim 39 wherein the operating system determines the origin of the application.

44. A data processing system comprising:

means for downloading a file;

means for determining if the file contains executable code; and

means for issuing a warning to the user before allowing the file to be downloaded.

45. A data processing system comprising:

means for receiving an input to download an application from the Internet to a user'"'"'s system;

means for issuing a warning to the user before allowing the application to be downloaded.

46. A data processing system comprising:

means for detecting an attempt to automatically download from the Internet an application to a user'"'"'s system;

means for issuing a warning to the user before allowing the application to be downloaded.

47. A data processing system comprising:

means for downloading an executable program from the Internet;

means for detecting an attempt to launch the program without a user request to launch the application; and

means for issuing a warning to the user before allowing the program to be launched.

48. A data processing system comprising:

means for receiving an input to download one or more files contained in an archived file;

means for determining if any of the files contain executable code; and

means for issuing a warning to a user that one or more of the files contain executable code.

49. A data processing system comprising:

means for receiving an input to display the contents of part or all of a user'"'"'s file system; and

means for marking the appearance of a file that is an executable program that has never been launched before by the user.

50. A data processing system comprising:

means for marking the appearance of a file in a user'"'"'s system that, when opened, launches an executable program that has never been launched before by the user.

51. A data processing system comprising:

means for marking the appearance of a URL if activating the URL launches an executable program that has never been launched before by a user.

52. A data processing system comprising:

means for downloading an application; and

means for storing the origin of the application as part of metadata compiled about the application in a metadata database.