Device-tailored whitelists

• US 9,262,624 B2
• Filed: 09/16/2011
• Issued: 02/16/2016
• Est. Priority Date: 09/16/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Muttik, Igor
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): DOAN, TRANG T
• Application Number:
  US13/234,985
• Publication Number:
  US 20130074186A1
• Time in Patent Office: 1,614 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A particular set of attributes of a particular computing device is identified. A first plurality of whitelisted objects is identified in a global whitelist corresponding to the particular set of attributes. A particular whitelist is generated to include the identified set of whitelisted objects, the particular whitelist tailored to the particular computing device. In some aspects, device-tailored updates to the particular whitelist are also generated.

Claims

1. At least one non-transitory, machine-accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify a particular set of attributes of a particular computing device, wherein the particular set of attributes include one or more software programs identified as potentially used by the particular computing device and at least one user attribute corresponding to expected usage of the particular computing device by at least one particular user;

determine that a first set of whitelisted objects in the global whitelist are usable by the one or more programs based on the identified particular set of attributes;

predict, based on the at least one user attribute, that a second set of whitelisted objects in the global whitelist will be accessed by the at least one user; and

generate a particular whitelist tailored to the particular computing device, wherein the particular whitelist is to comprise a subset of whitelisted objects in the global whitelist, and the subset of whitelisted objects comprises the first and second sets of whitelisted objects.

2. The at least one non-transitory, machine-accessible storage medium of claim 1, wherein the one or more software programs include at least one of an operations system, application, software agent, driver, library or plugin.

3. The at least one non-transitory, machine-accessible storage medium of claim 1 wherein the one or more software programs are installed on the particular computing device.

4. The at least one non-transitory, machine-accessible storage medium of claim 1, wherein the instructions, when executed, further cause the machine to:

identify a second set of attributes of a second computing device, the second set of attributes different from the particular set of attributes;

identify a second plurality of whitelisted objects, in a global whitelist, corresponding to the second set of attributes, the second plurality of whitelisted objects different from the first plurality of whitelisted objects; and

generate a second whitelist including the second plurality of whitelisted objects.

5. The at least one non-transitory, machine-accessible storage medium of claim 1, wherein the particular whitelist is used to perform at least one computer security task relating to the particular computing device.

6. The at least one non-transitory, machine-accessible storage medium of claim 5, wherein the instructions, when executed, further cause the machine to serve the particular whitelist to a particular client configured to perform the security task.

7. The at least one non-transitory, machine-accessible storage medium of claim 6, wherein the particular client is local to the particular computing device.

8. The at least one non-transitory, machine-accessible storage medium of claim 1, wherein the particular computing device comprises a mobile communications device.

9. The at least one non-transitory, machine-accessible storage medium of claim 1, wherein the instructions, when executed, further cause the machine to:

identify an update to the global whitelist;

identify at least one update for the particular whitelist corresponding to the update to the global whitelist; and

cause an updated version of the particular whitelist to be generated corresponding to the at least one update.

10. The at least one non-transitory, machine-accessible storage medium of claim 9, wherein the instructions, when executed, further cause the machine to send at least a portion of the updated version of the particular whitelist to a computing device tasked with performing computer security tasks on the particular computing device.

11. The at least one non-transitory, machine-accessible storage medium of claim 9, wherein the update to the global whitelist includes the addition of at least one new whitelist object, and the instructions, when executed, further cause the machine to map associations between the at least one new whitelist object and at least one device attribute.

12. The at least one non-transitory, machine-accessible storage medium of claim 1, wherein the instructions, when executed, further cause the machine to:

identify a change to a set of programs on the particular computing device;

determine at least one update to the particular whitelist corresponding to the identified change on the particular computing device; and

cause an updated version of the particular whitelist to be generated corresponding to the at least one update.

13. The at least one non-transitory, machine-accessible storage medium of claim 12, wherein the change is a predicted change and the at least one update to the particular whitelist is determined prior to the change being implemented on the particular computing device.

14. The at least one non-transitory, machine-accessible storage medium of claim 13, wherein at least a portion of the updated version of the particular whitelist is sent to a computing device tasked with performing computer security tasks on the particular computing device prior to the change being implemented on the particular computing device.

15. A method comprising:

identifying, using at least one processor device, a particular set of attributes of a particular computing device, wherein the particular set of attributes include one or more software programs identified as potentially used by the particular computing device and at least one user attribute corresponding to expected usage of the particular computing device by at least one particular user;

determining a first plurality of whitelisted objects, in a global whitelist, corresponding to the particular set of attributes, wherein determining the first plurality of whitelisted objects includes;

determining that a first set of whitelisted objects in the global whitelist are usable by the one or more programs based on the identified particular set of attributes; and

predicting, based on the at least one user attribute, that a second set of whitelisted objects in the global whitelist will be accessed by the at least one user; and

generating a particular whitelist tailored to the particular computing device, wherein the particular whitelist is to comprise a subset of whitelisted objects in the global whitelist, and the subset of whitelisted objects comprises the first and second sets of whitelisted objects.

16. A system comprising:

at least one processor device;

at least one memory element; and

a tailored whitelist manager, adapted when executed by the at least one processor device to;

identify a particular set of attributes of a particular computing device, wherein the particular set of attributes include one or more software programs identified as potentially used by the particular computing device and at least one user attribute corresponding to expected usage of the particular computing device by at least one particular user;

determine that a first set of whitelisted objects in the global whitelist are usable by the one or more programs based on the identified particular set of attributes;

predict, based on the at least one user attribute, that a second set of whitelisted objects in the global whitelist will be accessed by the at least one user; and

generate a particular whitelist tailored to the particular computing device, wherein the particular whitelist is to comprise a subset of whitelisted objects in the global whitelist, and the subset of whitelisted objects comprises the first and second sets of whitelisted objects.

17. The system of claim 16, wherein the tailored whitelist manager is further to generate, from the global whitelist, a respective whitelist for each of the plurality of computing devices and each whitelist is to be tailored to corresponding attributes of the respective computing device.