Widget security

• US 7,743,336 B2
• Filed: 05/10/2006
• Issued: 06/22/2010
• Est. Priority Date: 10/27/2005
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Forstall, Scott, Louch, John O., Peyton, Eric Steven
• Primary Examiner(s): NGUYEN, CAO H
• Application Number:
  US11/432,295
• Publication Number:
  US 20070101433A1
• Time in Patent Office: 1,504 Days
• Field of Search: 715/766, 715/778, 715/804, 715/841, 715762-765, 715/835
• US Class Current: 715/766
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A widget security system, method and computer-readable medium detects a security event associated with a widget, assesses the risk associated with the security event, and initiates a security action based on the assessed risk.

Claims

1. A widget security method, comprising:

detecting a security event associated with a widget;

generating data indicative of the security event;

processing the data to determine a risk level associated with the detected security event, where the risk level is determined by an action selected from a group of actions consisting of reviewing information associated with the widget, comparing widget information with a user profile, and examining programming code associated with the widget;

initiating a security action based on the risk level,

where the detecting, generating, processing and initiating are performed by one or more processors of a hardware device.

2. The method of claim 1, wherein detecting includes detecting unauthorized access to resources.

3. The method of claim 1, wherein detecting includes detecting unauthorized access to content.

4. The method of claim 1, wherein processing the data to determine a risk level associated with the detected security event includes:

identifying risks based on characteristics of the event and one or more policies associated with the event; and

identifying a risk based on the results of the comparison.

5. The method of claim 1, wherein processing the data to determine a risk level associated with the detected security event includes:

monitoring widget activity; and

identifying a risk based on the activity.

6. The method of claim 5, wherein monitoring widget activity includes logging widget activity.

7. The method of claim 1, wherein processing the data to determine a risk level associated with the detected security event includes:

retrieving a list of widgets;

determining if the widget is on the list; and

assessing risk associated with the widget based on whether the widget is included on the list.

8. The method of claim 1, wherein performing a security action includes:

informing a user about the security risk;

requesting a response from the user;

selecting a security action based on the response; and

initiating the selected security action.

9. The method of claim 1, wherein performing a security action is selected from a group of security actions including at least one of disabling the widget, notifying the user of the security event, or changing resource access rights associated with the widget.

10. A computer-readable medium having instructions stored thereon, which, when executed by a processor in a widget security system, causes the processor to perform the operations of:

detecting a security event associated with a widget;

determining a risk level associated with the detected security event, where the risk level is determined by an action selected from a group of actions consisting of reviewing information associated with the widget, comparing widget information with a user profile, and examining programming code associated with the widget; and

performing a security action based on the risk level.

11. The computer-readable medium of claim 10, wherein detecting includes detecting unauthorized access to resources.

12. The computer-readable medium of claim 10, wherein detecting includes detecting unauthorized access to content.

13. The computer-readable medium of claim 10, wherein processing the data to determine a risk level associated with the detected security event includes:

identifying risks based on characteristics of the event and one or more policies associated with the event; and

identifying a risk based on the results of the comparison.

14. The computer-readable medium of claim 10, wherein processing the data to determine a risk level associated with the detected security event includes:

monitoring widget activity; and

identifying a risk based on the activity.

15. The computer-readable medium of claim 14, wherein monitoring widget activity includes logging widget activity.

16. The computer-readable medium of claim 10, wherein processing the data to determine a risk level associated with the detected security event includes:

retrieving a list of widgets;

determining if the widget is on the list; and

assessing risk associated with the widget based on whether the widget is included on the list.

17. The computer-readable medium of claim 10, wherein performing a security action includes:

informing a user about the security risk;

requesting a response from the user;

selecting a security action based on the response; and

initiating the selected security action.

18. The computer-readable medium of claim 10, wherein performing a security action is selected from a group of security actions including at least one of disabling the widget, notifying the user of the security event, or changing resource access rights associated with the widget.

19. A widget security system, comprising:

a widget security manager configured for detecting a security event associated with a widget;

a security module coupled to the widget security manager and configured for determining a risk level associated with the detected security event, where the risk level is determined by an action selected from a group of actions consisting of reviewing information associated with the widget, comparing widget information with a user profile, and examining programming code associated with the widget; and

a security action manager coupled to the widget security manager and configured for initiating a security action based on the assessed risk.