DEVICE-TAILORED WHITELISTS

• US 20130074186A1
• Filed: 09/16/2011
• Published: 03/21/2013
• Est. Priority Date: 09/16/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Muttik, Igor
• Granted Patent: US 9,262,624 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A particular set of attributes of a particular computing device is identified. A first plurality of whitelisted objects is identified in a global whitelist corresponding to the particular set of attributes. A particular whitelist is generated to include the identified set of whitelisted objects, the particular whitelist tailored to the particular computing device. In some aspects, device-tailored updates to the particular whitelist are also generated.

Claims

1. A method comprising:

identifying, using at least one processor device, a particular set of attributes of a particular computing device;

identifying a first plurality of whitelisted objects, in a global whitelist, corresponding to the particular set of attributes; and

generating a particular whitelist including the identified set of whitelisted objects, the particular whitelist tailored to the particular computing device.

2. The method of claim 1, wherein the first plurality of whitelisted items is a subset of whitelisted objects included in the global whitelist and the subset is less than all of the whitelisted objects included in the global whitelist.

3. The method of claim 1, wherein the particular set of attributes correspond to a set of software programs identified as potentially used by the particular computing device.

4. The method of claim 3, wherein identifying the first plurality of whitelisted objects includes identifying a subset of whitelisted objects in the global whitelist as usable by programs in the set of software programs.

5. The method of claim 3, wherein the set of software programs includes at least one of an operating system, application, software agent, driver, library or plugin.

6. The method of claim 3, wherein the set of software programs are installed on the particular computing device.

7. The method of claim 1, further comprising:

identifying a second set of attributes of a second computing device, the second set of attributes different from the particular set of attributes;

identifying a second plurality of whitelisted objects, in a global whitelist, corresponding to the second set of attributes, the second plurality of whitelisted objects different from the first plurality of whitelisted objects; and

generating a second whitelist including the second plurality of whitelisted objects.

8. The method of claim 1, wherein the particular whitelist is used to perform at least one computer security task relating to the particular computing device.

9. The method of claim 8, further comprising serving the particular whitelist to a particular client configured to perform the security task.

10. The method of claim 9, wherein the particular client includes the particular computing device.

11. The method of claim 10, wherein the particular computing device comprises a mobile communications device.

12. The method of claim 1, further comprising:

identifying an update to the global whitelist;

identifying at least one update for the particular whitelist corresponding to the update to the global whitelist; and

causing an updated version of the particular whitelist to be generated corresponding to the at least one update.

13. The method of claim 12, further comprising sending at least a portion of the updated version of the particular whitelist to a computing device tasked with performing computer security tasks on the particular computing device.

14. The method of claim 12, wherein the update to the global whitelist includes the addition of at least one new whitelist object, the method further comprising mapping associations between the at least one new whitelist object and at least one device attribute.

15. The method of claim 1, further comprising:

identifying a change on the particular computing device;

determining at least one update to the particular whitelist corresponding to the identified change on the particular computing device; and

causing an updated version of the particular whitelist to be generated corresponding to the at least one update.

16. The method of claim 15, wherein the change is a predicted change and the at least one update to the particular whitelist is determined prior to the change being implemented on the particular computing device.

17. The method of claim 16, wherein at least a portion of the updated version of the particular whitelist is sent to a computing device tasked with performing computer security tasks on the particular computing device prior to the change being implemented on the particular computing device.

18. The method of claim 1, wherein the particular set of attributes includes at least one user attribute corresponding to a user of the particular computing device.

19. The method of claim 18, wherein identifying the first plurality of whitelisted objects includes predicting that the particular computing device will access at least a subset of the first plurality of whitelist objects based on the user attribute.

20. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying a particular set of attributes of a particular computing device;

identifying a first plurality of whitelisted objects, in a global whitelist, corresponding to the particular set of attributes; and

generating a particular whitelist including the identified set of whitelisted objects, the particular whitelist tailored to the particular computing device.

21. A system comprising:

at least one processor device;

at least one memory element; and

a tailored whitelist manager, adapted when executed by the at least one processor device to;

identify a particular set of attributes of a particular computing device;

identify a first plurality of whitelisted objects, in a global whitelist, corresponding to the particular set of attributes; and

generate a particular whitelist including the identified set of whitelisted objects, the particular whitelist tailored to the particular computing device.