Auto-containment of potentially vulnerable applications
OwnerMelih Abdulhayoglu, Ilker Simsirinventors
Life of this patent
Estimating the term…
Abstract
There is provided a method and system for advanced endpoint protection. With this methodology, when a file is requested to be executed on any endpoint, all intelligence sources would be checked to decide if that file has any known or potential vulnerability associated with it. If there is any information about any known or potential vulnerability, it would be launched inside the secure container to isolate the all resource usage of that application from the rest of the known good and secure applications in order to achieve the securest computing environment on an endpoint.
Claims13
A method for providing security on endpoints comprising:
- checking a rating of an application by a security client on an endpoint device before the application is launched to decide if the application has any known or potential vulnerability associated with said application;
- checking an intelligence source for vulnerability information by the security client;
- creating a secure container by the security client in case there are any vulnerabilities of said application;
- said secure container having an application level of said secure container which includes unknown/vulnerable applications;
- an operating system level of said secure container that includes a virtual registry, a virtual file system and a virtual OS core;
- and
- a hardware level of said secure container that includes hardware equipment, virtualization, and enhancements;
- said secure container providing an option to enable or disable auto containment of known good applications with a known vulnerability;
- said secure container providing an option to enable or disable auto containment of known good applications with a potential vulnerability;
- isolating, by the secure container, all resource usage of the application from known good and secure applications;
- running said application with full access on the endpoint device after said application is patched against the known vulnerability or the potential vulnerability.
A method for providing security on endpoints comprising:
- requesting an application to be launched and triggering a security client on an endpoint device;
- checking a rating of said application by the security client on said endpoint device before the application is launched to decide if the application has any known or potential vulnerability associated with said application;
- receiving the rating of said application by said security client;
- checking auto-containment rules by the security client if the rating is trusted;
- checking an intelligence source for available vulnerability or patch information by the security client;
- receiving, by the security client, the available vulnerability or patch information;
- creating a secure container by the security client if said available vulnerability or patch information for said application exists;
- and
- isolating, by the secure container, all resource usage of the application from known good and secure applications;
- running the application isolated within said secure container;
- and
- running the application as a normal executable on the endpoint device with system default settings and access if said available vulnerability or patch information for said application does not exist.
Dependencies are inferred from the claim text.