Challenge protected user queries

• US 8,572,381 B1
• Filed: 02/06/2006
• Issued: 10/29/2013
• Est. Priority Date: 02/06/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kraemer, Jeffrey A., Gladstone, Philip J. S.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): CHANG, KENNETH W
• Application Number:
  US11/348,069
• Time in Patent Office: 2,822 Days
• Field of Search: 713/170, 726/23, 726/24, 726/25
• US Class Current: 713/170
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

A method, apparatus and computer program product for providing challenge protected user queries on a local system is presented. A query is presented to a user. A response to the query is received and a determination is made whether the response is administratively less desirable than a threshold. When the response is administratively less desirable than said threshold, then a challenge is provided to the user. The response is accepted when the user responds correctly to the challenge and the response is not accepted when the user fails to correctly respond to the challenge.

Claims

1. A method of providing challenge protected user queries, the method comprising:

in response to detecting that an executable process is attempting a modification to a computer system, presenting a query related to the attempted modification and a set of acceptable responses to a user;

receiving a particular response of the set of acceptable responses to the query; and

upon determining that the particular response requires further validation of the user;

providing a challenge to the user; and

performing one of the group consisting of, accepting the response when the user correctly responds to the challenge, and not accepting the response when the user fails to respond correctly to the challenge;

wherein the challenge is not provided to the user upon determining that the particular response does not require further validation of the user;

wherein determining whether the particular response requires further validation of the user comprises at least one of determining whether the particular response is less secure than a threshold, determining whether the particular response is less secure than a default response for the query, and determining whether the particular response indicates that the user accepts a modification that presents a security risk to the computer system;

wherein the particular response does not require further validation of the user when the particular response denies the modification to the computer system; and

wherein the method is performed by one or more computing devices.

2. The method of claim 1, where one of the set of acceptable responses includes a default response.

3. The method of claim 2, where the query is presented to the user as a result of the user executable process attempting to install software on the computer system and where the challenge comprises presenting a nonce to the user and requiring the user to enter the nonce.

4. The method of claim 2, where the query is presented to the user as a result of the executable process attempting to disable security software on the user computer and where the challenge comprises presenting a nonce to the user and requiring the user to enter the nonce.

5. A non-transitory computer readable medium having computer readable code thereon for providing challenge protected user queries on a local system, the medium comprising:

instructions for, in response to detecting that an executable process is attempting a modification to the local system, presenting a query related to the attempted modification and a set of acceptable responses to a user;

instructions for receiving a particular response of the set of acceptable responses to said query;

instructions for determining whether said particular response requires further validation of the user; and

instructions for upon determining that said particular response requires further validation of the user, then;

providing a challenge to said user; and

performing one of the group consisting of accepting said response when said user correctly responds to said challenge, and not accepting said response when said user fails to respond correctly to said challenge;

wherein said instructions for determining whether said particular response requires further validation of the user comprises at least one of instructions for determining whether said particular response is less secure than a threshold, instructions for determining whether said particular response is less secure than a default response for said query, and instructions for requiring further validation of the user when the particular response indicates that the user accepts a modification that presents a security risk to the local system;

instructions for not requiring further validation when the particular response denies the modification to the local system; and

wherein the challenge is not provided to the user upon determining that the particular response does not require further validation of the user.

6. The non-transitory computer readable medium of claim 5 wherein said instructions for presenting a set of acceptable responses to said user includes instructions wherein one of said set of acceptable responses includes a default response.

7. The non-transitory computer readable medium of claim 6 wherein said query is presented to said user as a result of said executable process attempting to install software on said local system and wherein said challenge comprises presenting a nonce to said user and requiring said user to enter said nonce.

8. The non-transitory computer readable medium of claim 6 wherein said query is presented to said user as a result of said executable process attempting to disable security software on said local system and wherein said challenge comprises presenting a nonce to said user and requiring said user to enter said nonce.

9. A computer system comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface; and

wherein the memory is encoded with an application that when performed on the processor, provides a process for of providing challenge protected user queries on a local system, the process causing the computer system to perform the operations of;

in response to detecting that an executable process is attempting a modification to the local system, presenting a query and a set of acceptable responses to a user;

receiving a particular response of the set of acceptable responses to said query;

determining whether said particular response requires further validation of the user; and

upon determining that said response requires further validation of the user, then;

providing a challenge to said user; and

performing one of the group consisting of accepting said response when said user correctly responds to said challenge, and not accepting said response when said user fails to respond correctly to said challenge;

wherein the determining whether said particular response requires further validation of the user comprises at least one of determining whether said particular response is less secure than a threshold, determining whether said particular response is less secure than a default response for said query, and determining whether the particular response indicates that the user accepts a modification that presents a security risk to the local system;

wherein the particular response does not require further validation of the user when the particular response denies the modification to the local system; and

wherein the challenge is not provided to the user upon determining that the particular response does not require further validation of the user.

10. The computer system of claim 9 wherein one of said set of acceptable responses includes a default response.

11. The computer system of claim 9 wherein said query is presented to said user as a result of said executable process attempting to install software on said local system and wherein said challenge comprises presenting a nonce to said user and requiring said user to enter said nonce.