Widget security

• US 9,032,318 B2
• Filed: 05/07/2010
• Issued: 05/12/2015
• Est. Priority Date: 10/27/2005
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Louch, John O., Forstall, Scott, Peyton, Eric Steven
• Primary Examiner(s): Nguyen, Kevin
• Application Number:
  US12/776,282
• Publication Number:
  US 20100242110A1
• Time in Patent Office: 1,831 Days
• Field of Search: 715762-765, 715766-778, 715/835, 715/804, 715/841
• US Class Current: 715/766
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A widget security system, method and computer-readable medium detects a security event associated with a widget, assesses the risk associated with the security event, and initiates a security action based on the assessed risk.

Claims

1. A widget security method, comprising:

detecting a security event associated with a widget;

determining a risk associated with the detected security event by monitoring widget activity and identifying a risk by comparing the activity to security policy information; and

initiating a security action based on the risk,

where the detecting, determining and initiating are performed by one or more processors of a hardware device.

2. The method of claim 1, wherein detecting includes detecting unauthorized access to resources by the widget.

3. The method of claim 1, wherein detecting includes detecting unauthorized access to content by the widget.

4. The method of claim 1, wherein determining the risk includes:

identifying risks based on characteristics of the event and one or more policies associated with the event; and

identifying a risk based on the results of the comparison.

5. The method of claim 1, wherein monitoring widget activity includes logging widget activity.

6. The method of claim 1, wherein determining the risk level includes:

retrieving a list of widgets;

determining if the widget is on the list; and

assessing risk associated with the widget based on whether the widget is included on the list.

7. The method of claim 1, wherein performing a security action includes:

informing a user about the security risk;

requesting a response from the user;

selecting a security action based on the response; and

initiating the selected security action.

8. The method of claim 1, wherein performing a security action is selected from the group including at least one of disabling the widget, notifying the user of the security event, or changing resource access rights associated with the widget.

9. The method of claim 1, where identifying a risk further comprises:

determining if the widget activity violates a security policy; and

responsive to the activity violating a security policy, initiating a security action.

10. The method of claim 1, where identifying a risk further comprises:

determining if the widget activity is consistent with an associated security policy; and

responsive to the activity being consistent with an associated security policy, initiating a security action.

11. The method of claim 1, further comprising:

receiving notification of a security event in response to user interaction with a widget; and

initiating a security action based on the security event and one or more user privileges.

12. A widget security system, comprising:

one or more processors;

memory coupled to the one or more processors and configured to store instructions, which, when executed by the one or more processors, causes the one or more processors to perform operations comprising;

detecting a security event associated with a widget;

determining a risk associated with the detected security event by monitoring widget activity and identifying a risk by comparing the activity to security policy information; and

initiating a security action based on the risk.

13. The system of claim 12, wherein detecting includes detecting unauthorized access to resources by the widget.

14. The system of claim 12, wherein detecting includes detecting unauthorized access to content by the widget.

15. The system of claim 12, wherein determining the risk includes:

identifying risks based on characteristics of the event and one or more policies associated with the event; and

identifying a risk based on the results of the comparison.

16. The system of claim 12, wherein monitoring widget activity includes logging widget activity.

17. The system of claim 12, wherein determining the risk level includes:

retrieving a list of widgets;

determining if the widget is on the list; and

assessing risk associated with the widget based on whether the widget is included on the list.

18. The system of claim 12, wherein performing a security action includes:

informing a user about the security risk;

requesting a response from the user;

selecting a security action based on the response; and

initiating the selected security action.

19. The system of claim 12, wherein performing a security action is selected from the group including at least one of disabling the widget, notifying the user of the security event, or changing resource access rights associated with the widget.

20. The system of claim 12, further comprising:

receiving notification of a security event in response to user interaction with a widget; and

initiating a security action based on the security event and one or more user privileges.

21. The system of claim 12, where identifying a risk further comprises:

determining if the widget activity violates a security policy; and

responsive to the activity violating a security policy, initiating a security action.

22. The system of claim 12, where identifying a risk further comprises:

determining if the widget activity is consistent with an associated security policy; and

responsive to the activity being consistent with an associated security policy, initiating a security action.