System, method, and computer program product for tracking the migration of objects to determine whether to perform a network based check

• US 8,566,942 B2
• Filed: 09/23/2009
• Issued: 10/22/2013
• Est. Priority Date: 09/23/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Muttik, Igor G., Roberts, Guy, Barton, Chris, Hinchliffe, Alex
• Primary Examiner(s): ARMOUCHE, HADI S
• Application Number:
  US12/565,541
• Publication Number:
  US 20130246466A1
• Time in Patent Office: 1,490 Days
• Field of Search: 726 22- 30, 713187-188
• US Class Current: 726/24
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences

Abstract

A system, method, and computer program product are provided for tracking the migration of objects to determine whether to perform a network based check. In operation, an object is identified. Furthermore, a first security niche associated with the object is determined. Additionally, it is determined if the object is migrating from the first security niche to a second security niche. Still yet, a network based security check is conditionally performed if it is determined the object is migrating from the first security niche to the second security niche.

Claims

1. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:

identifying an object at a client coupled to a network;

extracting environmental information indicative of a previous location of the object;

determining a first security niche associated with the object;

determining if the object is migrating from the first security niche to a second security niche using the environmental information;

evaluating a white-list associated with a plurality of security niches; and

initiating a network based security check at a network cloud location based on the object migrating from the first security niche to the second security niche, wherein the second security niche is a higher security niche than the first security niche and the second security niche is not provided in the white-list, and wherein the second security niche is associated with a particular program that auto-executes.

2. The computer program product of claim 1, wherein the computer program product determines the first security niche associated with the object includes examining data associated with the object.

3. The computer program product of claim 2, wherein the data includes information indicating at least one of a type of the object, a security status of the object, or parameters assigned to the object by an operating system.

4. The computer program product of claim 1, wherein the environmental information includes information indicating one of a current location of the object or a destination location of the object.

5. The computer program product of claim 1, wherein the environmental information includes information indicating all available migration history of the object.

6. The computer program product of claim 1, wherein the environmental information is utilized, at least in part, for determining if the object is migrating from the first security niche to the second security niche.

7. The computer program product of claim 1, wherein the environmental information is utilized, at least in part, for determining if the object is going to migrate from the first security niche to the second security niche in the future.

8. The computer program product of claim 1, wherein the object includes one of a computer program, a directly, a Uniform Resource Locator (URL), a soft-link, a hard-link, a reference to an object in memory or any other kind of reference.

9. The computer program product of claim 1, wherein the at least one of an on-access scanner or security software is utilized to determine if the object is migrating from the first security niche to the second security niche.

10. The computer program product of claim 1, wherein the network based security check includes an “

information only”

submission where no reply is required.

11. The computer program product of claim 1, wherein identifying the object includes identifying the object from a plurality of objects, each with an associated security niche.

12. The computer program product of claim 11, wherein security niche associated with each of the plurality of objects depends on a type of the plurality of objects.

13. The computer program product of claim 11, wherein the security niche associated with each of the plurality of objects depends on permissions associated with a user of a system corresponding to the plurality of objects.

14. A method, comprising:

identifying an object at a client coupled to a network, wherein the client includes a processor and a memory;

extracting environmental information indicative of a previous location of the object;

determining a first security niche associated with the object;

determining if the object is migrating from the first security niche to a second security niche using the environmental information;

evaluating a white-list associated with a plurality of security niches; and

initiating a network based security check at a network cloud location based on the object migrating from the first security niche to the second security niche, wherein the second security niche is a higher security niche than the first security niche and the second security niche is not provided in the white-list, and wherein the second security niche is associated with a particular program that auto-executes.

15. A wireless device, comprising:

a processor coupled to a memory, wherein the wireless device is configured for;

identifying an object at a wireless device coupled to a network;

extracting environmental information indicative of a previous location of the object;

determining a first security niche associated with the object;

determining if the object is migrating from the first security niche to a second security niche using the environmental information;

evaluating a white-list associated with a plurality of security niches; and

initiating a network based security check at a network cloud location based on the object migrating from the first security niche to the second security niche, wherein the second security niche is a higher security niche than the first security niche and the second security niche is not provided in the white-list, and wherein the second security niche is associated with a particular program that auto-executes.