Graduated Enforcement of Restrictions According to an Application's Reputation

• US 20100077445A1
• Filed: 09/25/2008
• Published: 03/25/2010
• Est. Priority Date: 09/25/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: McCorkendale, Bruce, Schneider, Kenneth
• Granted Patent: US 9,495,538 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

Security software on a client observes a request for a resource from an application on the client and then determines the application'"'"'s reputation. The application'"'"'s reputation may be measured by a reputation score obtained from a remote reputation server. The security software determines an access policy from a graduated set of possible access policies for the application based on the application'"'"'s reputation. The security software applies the access policy to the application'"'"'s request for the resource. In this way, the reputation-based system uses a graduated trust scale and a policy enforcement mechanism that restricts or grants application functionality for resource interactivity along a graduated scale.

Claims

1. A method for enforcing application restrictions according to an application'"'"'s reputation, the method comprising:

observing a request for a resource from an application on a client;

determining a measure of a reputation associated with the application;

selecting an access policy from a set of three or more possible access policies, the selecting based at least in part on the measure of the reputation associated with the application; and

enforcing the selected access policy to the request for the resource from the application.

2. The method of claim 1, wherein determining a measure of a reputation associated with the application comprises retrieving a reputation score from a reputation server via a network.

3. The method of claim 1, wherein the set of possible access policies comprises:

an access policy that allows any request for a resource if the requesting application has a reputation above a first threshold;

an access policy that denies any request for a resource if the requesting application has a reputation below a second threshold; and

at least one access policy that allows some requests for a resource and denies other requests for a resource if the requesting application has a reputation in a range that is lower than the first threshold and higher than the second threshold.

4. The method of claim 1, wherein the set of three or more possible access policies comprises a continuous scale of a level of access to a client resource as a function of the application'"'"'s reputation score.

5. The method of claim 1, wherein selecting the access policy comprises consulting a predefined mapping of reputation scores to access policies.

6. The method of claim 1, wherein the access policy is obtained from a policy server via a network.

7. The method of claim 1, wherein the access policy allows the application access to a subset of the resources on the client.

8. The method of claim 1, wherein enforcing the selected access policy comprises using one or more of:

application/resource virtualization, application network firewall, network access control, sandboxing, and behavior blocking policy enforcement point technology.

9. A computer program product for enforcing application restrictions according to an application'"'"'s reputation, the computer program product comprising a computer-readable storage medium containing computer program code that comprises:

a reputation module configured to determine a measure of a reputation associated with an application on a client;

a policy module coupled to the reputation module to obtain therefrom a measure of a reputation for an application, the policy module configured to select an access policy from a set of three or more access policies based at least in part on the measure of the reputation associated with the application; and

a security module coupled to the policy module to obtain therefrom a policy selected for an application, the security module configured to enforce the selected access policy to a request for a resource on a client from the application.

10. The computer program product of claim 9, wherein the reputation module is configured to determine a measure of a reputation associated with the application by retrieving a reputation score from a reputation server via a network.

11. The computer program product of claim 9, wherein the set of possible access policies comprises:

an access policy that allows any request for a resource if the requesting application has a reputation above a first threshold;

an access policy that denies any request for a resource if the requesting application has a reputation below a second threshold; and

at least one access policy that allows some requests for a resource and denies other requests for a resource if the requesting application has a reputation in a range that is lower than the first threshold and higher than the second threshold.

12. The computer program product of claim 9, wherein the set of three or more possible access policies comprises a continuous scale of a level of access to a client resource as a function of the application'"'"'s reputation score.

13. The computer program product of claim 9, wherein the policy module is configured to select an access policy by consulting a predefined mapping of reputation scores to access policies.

14. The computer program product of claim 9, wherein the policy module is configured to obtain the access policy from a policy server via a network.

15. The computer program product of claim 9, wherein the access policy allows the application access to a subset of the resources on the client.

16. The computer program product of claim 9, wherein the security module is configured to enforce the selected access policy by using one or more of:

application/resource virtualization, application network firewall, network access control, sandboxing, and behavior blocking policy enforcement point technology.

17. A computer program product for enforcing application restrictions according to an entity'"'"'s reputation, the computer program product comprising a computer-readable storage medium containing computer program code for:

observing an attempt to use a resource on a client by an entity;

obtaining a reputation score for the entity; and

determining a level of access to the resource for the entity based at least in part on the entity'"'"'s reputation score, wherein the level of access is between allowing full access to disallowing access to the resource; and

allowing a limited use of the resource by the entity according to the determined level of access.

18. The computer program product of claim 17, wherein the entity comprises an application running on the client.

19. The computer program product of claim 17, wherein the entity comprises a website.

20. The computer program product of claim 17, wherein the reputation score is obtained from a reputation server via a network.