System and method of monitoring and controlling application files

• US 7,797,270 B2
• Filed: 01/18/2007
• Issued: 09/14/2010
• Est. Priority Date: 03/14/2003
• Status: Expired due to Term

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Dimm, John Ross, Kester, Harold M., Anderson, Mark Richard, Hegli, Ronald B.
• Primary Examiner(s): Mahmoudi; Tony
• Assistant Examiner(s): Uddin; MD. I
• Application Number:
  US11/624,635
• Publication Number:
  US 20070162463A1
• Time in Patent Office: 1,335 Days
• Field of Search: 707/10, 707/4, 707/102, 707/104.1, 707/6, 707/9, 707/665, 707/694, 707/781, 709/203, 709/211, 709/221, 709/222, 717/100, 717/124, 717/128, 717/130, 717/168, 717/174, 717/120
• US Class Current: 717/168
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 20/203 Inventory monitoring
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

A system and method for updating a system that controls applications requested for execution on a workstation. A workstation management module is configured to detect requested execution of an application. A workstation application server receives data associated with the application from the workstation. The application server module can determine one or more categories to associate with the application by referencing an application inventory database or requesting the category from an application database factory. The application database factory can receive applications from multiple application server modules. The application database factory determines whether the application was previously categorized and provides the category to the application server module; which forwards a hash/policy table to the workstation management module. Upon receipt of the hash/policy table, the workstation management module applies the policy to control access to the requested application on the workstation.

Claims

1. A method of controlling operation of an application on a workstation, the method comprising:

detecting, with a processor, a launch of an application on the workstation;

determining whether the application is categorized, wherein a categorized application is associated with one or more policies;

if the application is locally categorized, then applying the one or more policies that are associated with the application;

if the application is not locally categorized, then

uploading data indicative of the application to an application server module; and

determining whether the application is identified in an application inventory database of categorized applications, wherein a categorized application is associated with one or more categories; and

if the application is not identified in the application inventory database, then posting the data indicative of the application to an uncategorized application database,

if the application is identified in the application inventory database, then applying one or more policies associated with the application.

2. The method of claim 1, wherein the one or more policies include allowing or disallowing the application to run based on the one or more categories associated with the application and a user of the workstation.

3. The method of claim 1 further comprising:

uploading the uncategorized application database to an application database factory;

determining whether each application has been previously categorized by the application database factory;

for each application that was not previously categorized, categorizing each application and/or data associated with the application by associating one or more categories with each application.

4. The method of claim 3 further comprising:

posting data indicative of each application along with its associated one or more categories into a database of categorized applications; and

downloading the database of categorized applications for incorporation into the application inventory database.

5. The method of claim 3 further comprising:

updating a request frequency in the application inventory database if the application is in the application inventory database; and

uploading the application inventory database request frequency and the associated application to the application database factory.

6. The method of claim 3, wherein the one or more policies include allowing the application to run on the workstation based on the one or more categories associated with the application and a user of the workstation.

7. The method of claim 3, wherein the logging database further includes additional data associated with the application.

8. The method of claim 7, wherein the additional data includes a request frequency.

9. The method of claim 7, wherein the additional data includes a suite.

10. The method of claim 7, wherein the additional data includes a publisher.

11. The method of claim 7, wherein the additional data includes a source directory.

12. The method of claim 1 further comprising:

analyzing the application and/or the additional data associated with the application for data characteristics that are indicative of the one or more categories; and

associating one or more indicators with the application.

13. The method of claim 12, wherein the analyzing the application and/or additional data is performed on text strings that are associated with the application.

14. The method of claim 12, wherein the one or more indicators can include a category flag.

15. The method of claim 14, further comprising screening the application using the one or more indicators prior to uploading the uncategorized application database to the application database factory.

16. A method of controlling execution of programs on a workstation, the method comprising:

detecting with a processor a launch of a program at the workstation;

determining whether the program is identified in a table;

if the program is identified, applying a first rule that is associated with the program;

pre-filtering the program and/or data associated with the program for data characteristics that are indicative of one or more categories;

associating a second rule with the program based on at least in part the one or more categories indicated by the data characteristics;

if the program is not identified, posting data indicative of the program to a database.

17. A method of controlling programs on a workstation, the method comprising:

detecting, with a processor a launch of an application on the workstation;

generating a hash value for the launched application;

determining whether the application is categorized by comparing the generated hash value to one or more hash values in a hash/policy table, the hash/policy table including one or more policies associated with the one or more hash values;

if the generated hash value matches one or more of the hash values in the hash/policy table, then applying the one or more policies that are associated with the one or more hash values;

if the generated hash value does not match one or more hash values in the hash/policy table, then posting information about the application to a logging database;

uploading the logging database to an application server module;

determining whether the application from the logging database is in an application inventory database; and

if the application is not identified in the application inventory database, then posting information about the application to an uncategorized application database.

18. The method of claim 17 further comprising scanning the logging database to determine a frequency count for the application.

19. The method of claim 17 further comprising:

uploading the uncategorized application database to an application database factory;

determining whether the application has been previously categorized by the application database factory; and

for each application that was not previously categorized, categorizing each application by selecting one or more categories associated with that application.

20. The method of claim 19, further comprising:

posting data indicative of each application along with its selected one or more categories into a database of categorized applications; and

downloading the database of categorized applications for incorporation into the application inventory database.

21. A method of controlling applications on a workstation, the method comprising:

detecting, with a processor, a running application on a workstation;

determining whether the running application is identified in a database;

if the running application is not identified in the database, then storing data indicative of the running application to the database;

associating one or more policies to the running application; and

controlling the running application based on the one or more policies;

pre-filtering the program and/or data associated with the program for data characteristics that are indicative of one or more categories;

associating a rule with the program based on at least in part the one or more categories indicated by the data characteristics.