Method and system for protecting a computer and a network from hostile downloadables

• US 20060149968A1
• Filed: 03/07/2006
• Published: 07/06/2006
• Est. Priority Date: 11/06/1997
• Status: Active Grant

• Current Assignee: Finjan Holdings, Inc. (SoftBank Group Corp.)
• Original Assignee: Finjan, Inc. (SoftBank Group Corp.)
• Inventors: Touboul, Shlomo, Kroll, David R., Vered, Nimrod Itzhak, Edery, Yigal Mordechai
• Granted Patent: US 7,613,926 B2
• Time in Patent Office: Days
• US Class Current: 713/181
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Protection systems and methods provide for protecting one or more personal computers (“PCs”) and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java™ applets, ActiveX™ controls, JavaScript™ scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other “Downloadables” or “mobile code” in whole or part. A protection engine embodiment provides, within a server, firewall or other suitable “re-communicator,” for monitoring information received by the communicator, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information, more suitably by forming a protection agent including the MPC, protection policies and a detected-Downloadable. An MPC embodiment further provides, within a Downloadable-destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing (predetermined) corresponding operations to be executed in response to the attempts, more suitably in conjunction with protection policies.

Claims

1-76. -76. (canceled)

77. A computer-based method, comprising the steps of:

receiving an incoming Downloadable;

deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

storing the Downloadable security profile data in a database.

78. The computer-based method of claim 77 further comprising storing a date &

time when the Downloadable security profile data was derived in the database.

79. The computer-based method of claim 77 wherein the Downloadable includes a Java applet.

80. The computer-based method of claim 77 wherein the Downloadable includes an ActiveX control.

81. The computer-based method of claim 77 wherein the Downloadable includes a JavaScript script.

82. The computer-based method of claim 77 wherein the Downloadable includes a Visual Basic script.

83. The computer-based method of claim 77 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, a network system, and to memory.

84. The computer-based method of claim 77 wherein the Downloadable security profile data includes a URL from where the Downloadable originated.

85. The computer-based method of claim 77 wherein the Downloadable security profile data includes a digital certificate.

86. The computer-based method of claim 77 wherein said deriving Downloadable security profile data comprises disassembling the incoming Downloadable.

87. A system for managing Downloadables, comprising:

a receiver for receiving an incoming Downloadable;

a Downloadable scanner coupled with said receiver, for deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

a database manager coupled with said Downloadable scanner, for storing the Downloadable security profile data in a database.

88. The system of claim 87 wherein said database manager also stores a date &

time when the Downloadable security profile data was derived by said Downloadable scanner, in the database.

89. The system of claim 87 wherein the Downloadable includes a Java applet.

90. The system of claim 87 wherein the Downloadable includes an ActiveX control.

91. The system of claim 87 wherein the Downloadable includes a JavaScript script.

92. The system of claim 87 wherein the Downloadable includes a Java applet.

93. The system of claim 87 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, and to memory.

94. The system of claim 87 wherein the Downloadable security profile data includes a URL from where the Downloadable originated.

95. The system of claim 87 wherein the Downloadable security profile data includes a digital certificate.

96. The system of claim 87 wherein said Downloadable scanner comprises a disassembler for a disassembling the incoming Downloadable.

97. A computer-based method, comprising the steps of:

receiving an incoming Downloadable;

deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable;

appending a representation of the Downloadable security profile data to the Downloadable, to generate an appended Downloadable; and

transmitting the appended Downloadable to a destination computer.

98. The computer-based method of claim 97 wherein the Downloadable includes a Java applet.

99. The computer-based method of claim 97 wherein the Downloadable includes an ActiveX control.

100. The computer-based method of claim 97 wherein the Downloadable includes a JavaScript script.

101. The computer-based method of claim 97 wherein the Downloadable includes a Visual Basic script.

102. The computer-based method of claim 97 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, and to memory.

103. The computer-based method of claim 97 wherein the Downloadable security profile data includes a URL from where the Downloadable originated.

104. The computer-based method of claim 97 wherein the appended Downloadable includes a digital certificate.

105. The computer-based method of claim 97 wherein said deriving Downloadable security profile data comprises disassembling the incoming Downloadable.

106. A system for managing Downloadables, comprising:

a receiver for receiving an incoming Downloadable;

a Downloadable scanner coupled with said receiver for deriving security profile data for Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable;

a file appender coupled with said Downloadable scanner, for appending a representation of the Downloadable security profile data to the Downloadable, to generate an appended an appended Downloadable; and

a transmitter coupled with said file appender, for transmitting the appended Downloadable to a destination computer.

107. The system of claim 106 wherein the Downloadable includes a Java applet.

108. The system of claim 106 wherein the Downloadable includes a ActiveX control.

109. The system of claim 106 wherein the Downloadable includes a JavaScript script.

110. The system of claim 106 wherein the Downloadable includes a Visual Basic script.

111. The system of claim 106 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, and to memory.

112. The system of claim 106 wherein the Downloadable security profile data includes a URL from where the Downloadable originated.

113. The system of claim 106 wherein the appended Downloadable includes a digital certificate.

114. The system of claim 106 wherein said Downloadable scanner comprises a disassembler for dissembling the incoming Downloadable.

115. A computer-based method, comprising the steps of:

receiving an incoming Downloadable;

deriving security profile data for Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

transmitting the Downloadable and a representation of the Downloadable security profile data to a destination computer, via a transport protocol transmission.

119. The computer-based method of claim 115 wherein the transport protocol is network transport protocol, and wherein the Downloadable security profile data is inserted as a frame within the transport protocol transmission.

120. The computer-based method of claim 119 wherein the network transport protocol is TCP/IP.

121. The computer-based method of claim 119 wherein the network transport protocol is UDP.

122. A system for managing Downloadables, comprising:

a receiver for receiving an incoming Downloadable;

a Downloadable scanner coupled with said receiver, for deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

a transmitter coupled with said receiver and with said Downloadable scanner, for transmitting the Downloadable and a representation of the Downloadable security profile data to a destination computer, via a transport protocol transmission.

123. The system of claim 122 wherein the transport protocol is an application transport protocol and wherein the Downloadable security profile data is inserted as a header within the transport protocol transmission.

124. The system of claim 123, wherein the application transport protocol is HTTP.

125. The system of claim 123, wherein the application transport protocol is FTP.

126. The system of claim 122 wherein the transport protocol is a network transport protocol, and wherein the Downloadable security profile data is inserted as a frame within the transport protocol transmission.

127. The system of claim 126 wherein the network transport protocol is TCP/IP.

128. The system of claim 126 wherein the network transport protocol is UDP.

129. A computer-based method, comprising the steps of:

receiving an incoming Downloadable;

receiving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable;

appending a representation of the Downloadable security profile data to the Downloadable, to generate an appended Downloadable; and

transmitting the appended Downloadable to a destination computer.

130. The computer-based method of claim 129 further comprising forwarding the Downloadable to an external computer, for deriving the Downloadable security profile data.

131. A system for managing Downloadables, comprising:

a receiver for receiving an incoming Downloadable, and for receiving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable;

a file appender coupled with said receiver for appending a representation of the Downloadable security profile data to the Downloadable, to generate an appended Downloadable; and

a transmitter coupled with said file appender, for transmitting the appended Downloadable to a destination computer.

132. The system of claim 131 wherein said transmitter forwards the Downloadable to an external computer, for deriving the Downloadable security profile data, and wherein said receiver receives the security profile data from the external computer.

133. A computer-based method, comprising the steps of:

receiving an incoming Downloadable;

receiving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

transmitting the Downloadable and a representation of the Downloadable security profile data to a destination computer, via a transport protocol transmission.

134. The computer-based method of claim 133 further comprising forwarding the Downloadable to an external computer, for deriving the Downloadable security profile data.

135. A system for managing Downloadables, comprising:

a receiver for receiving an incoming Downloadable, and for receiving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

a transmitter coupled with said receiver, for transmitting the Downloadable and a representation of the Downloadable security profile data to a destination computer, via a transport protocol transmission.

136. The system of claim 135 wherein said transmitter forwards the Downloadable to an external computer, for deriving the Downloadable security profile data, and wherein said receiver receives the security profile data from the external computer.

137. A computer-based method, comprising the steps of:

receiving an incoming Downloadable addressed;

retrieving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on an ID of the incoming Downloadable, the security profile data including a list of suspicious computer operations that may be attempted by the Downloadable;

appending a representation of the retrieved Downloadable security profile data to the incoming Downloadable, to generate an appended Downloadable; and

transmitting the appended Downloadable to a destination computer.

138. The computer-based method of claim 137 further comprising performing a hashing function on the incoming Downloadable to compute the incoming Downloadable ID.

139. A system for managing Downloadables, comprising:

a receiver for receiving an incoming Downloadable addressed to a client;

a database manager for retrieving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on an ID of the incoming Downloadable, the security profiled data including a list of suspicious computer operations that may be attempted by the Downloadable;

a file appender coupled with said receiver for appending a representation of the Downloadable security profile data to the incoming Downloadable, to generate an appended Downloadable; and

a transmitter coupled with said file appender, for transmitting the appended Downloadable to a destination computer.

140. The system of claim 139 further comprising a Downloadable identifier for performing a hashing function on the incoming Downloadable to compute the incoming Downloadable to compute the incoming Downloadable ID.

141. A computer-based method, comprising the steps of:

receiving an incoming Downloadable;

receiving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on an ID of the incoming Downloadable, the security profiled data including a list of suspicious computer operations that may be attempted by the Downloadable; and

transmitting the incoming Downloadable and a representation of the retrieved Downloadable security profiled data to a destination computer, via a transport protocol transmission.

142. The computer-based method of claim 141 further comprising performing a hashing function on the incoming Downloadable to compute the incoming Downloadable ID.

143. A system for managing Downloadable, comprising;

a receiver for receiving an incoming Downloadable addressed to a client;

a database manager for retrieving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on an ID of the incoming Downloadable, the security profiled data including a list of suspicious computer operations that may be attempted by the Downloadable; and

a transmitter coupled with said receiver, for transmitting the incoming Downloadable and a representation of the retrieved Downloadable security profile data to a destination computer, via a transport protocol transmission.

144. The system of claim 143 further comprising a Downloadable identifier for performing a hashing function on the incoming Downloadable to compute the incoming Downloadable to compute the incoming Downloadable ID.

145. The system of claim 143 further comprising a Downloadable identifier for performing a hashing function on the incoming Downloadable to compute the incoming Downloadable ID receive an incoming Downloadable;

derive security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

store the Downloadable security profile data in a database.

146. A computer-readable storage medium storing program code for causing at least one computing device to:

receive an incoming Downloadable;

derive security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable;

append a representation of the Downloadable security profile data to the Downloadable, to generate an appended Downloadable; and

transmit the appended Downloadable to a destination computer.

147. A computer-readable storage medium storing program code for causing at least one computing device to:

receive an incoming Downloadable;

derive security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

transmit the Downloadable and a representation of the Downloadable security profile data to a destination computer, via a transport protocol transmission.

148. A computer-readable storage medium storing program code for causing at least one computing device to:

receive an incoming Downloadable;

receive security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable;

append a representation of the Downloadable security profile data to the Downloadable, to generate an appended Downloadable; and

transmit the appended Downloadable to a destination computer.

149. A computer-readable storage medium storing program code for causing at least one computing device to:

receive an incoming Downloadable;

receive security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and

transmit the Downloadable and a representation of the Downloadable security profile data to a destination computer, via a transport protocol transmission.

150. A computer-readable storage medium storing program code for causing at least one computing device to:

receive an incoming Downloadable;

retrieve security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on an ID of the incoming Downloadable, the security profiled data including a list of suspicious computer operations that may be attempted by the Downloadable;

append a representation of the retrieved Downloadable security profile data to the incoming Downloadable, to generate an appended Downloadable; and

transmit the appended Downloadable to a destination computer.

151. A computer-readable storage medium storing program code for causing at least one computing device to:

receive an incoming Downloadable;

retrieve security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on an ID of the incoming Downloadable, the security profiled data including a list of suspicious computer operations that may be attempted by the Downloadable; and

transmit the incoming Downloadable and a representation of the retrieved Downloadable security profile data to a destination computer, via a transport protocol transmission.