US 11,636,219 B2Granted

System, method, and apparatus for enhanced whitelisting

AssigneePC Matic, Inc.

InventorsMatthew Quincy Riley, Robert J. Cheng, Robert J. Woodworth, Jr., Andrew Tuch

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer security system with enhanced whitelisting includes administrative interfaces that accept user inputs to create and modify entries in a whitelist that define which programs are allowed to execute on one or more target computer systems. Upon an attempt to run a program, the entries in the whitelist are used to determine if the program is allowed to run. If an entry in the whitelist indicates that the program is allowed to run, the program is run. Otherwise, at a later time, an administrative interface is used to either block future execution of the program or to create an entry in the whitelist that allows execution of a class of programs or only that the program in the future until revoked. The whitelist is for a single target computer or many computers.

Claims20

Dependent claims

A system for computer security, the system comprising:

a target computer;
computer security system software stored in non-transitory storage of the target computer;
the computer security system software running on the target computer;
a whitelist accessible by the computer security system software, the whitelist containing entries indicative of which programs are allowed to run on the target computer;
when a program attempts to execute on the target computer, the computer security system software determines whether the program is allowed to run using the whitelist and when the program is allowed to run, the computer security system software running on the computer allows the program to run;
when the program is prevented from running, data regarding the program is captured and stored;
after the program is prevented from running, a set of rules accessible by administrative software determines if the program is within a program classification and when the program is within the program classification, the administrative software presents a user interface for an administrator that includes allowing by the program classification, the administrative software then accepts inputs and upon acceptance of the program classification, the administrative software updates the whitelist to add an entry that allows execution of the programs in the program classification;
and
when the program is not within the program classification, the administrative software presents a second user interface for the administrator that request approval solely for the program and the administrative software then accepts the inputs and upon the acceptance of the program, the administrative software updates the whitelist to add the entry for the program;
otherwise, the whitelist is not updated and future attempts to run the program will be blocked.

7 more elements

A system for computer security, the system comprising:

a target computer;
computer security system software stored in non-transitory storage of the target computer;
the computer security system software running on the target computer;
a whitelist accessible by the computer security system software, the whitelist containing entries indicative of which programs are allowed to run on the target computer;
when a program attempts to execute on the target computer, the computer security system software determines whether the program is allowed to run using the whitelist and when the program is allowed to run, the computer security system software running on the computer allows the program to run;
when the program is prevented from running, data regarding the program is captured and stored;
after the program is prevented from running, a set of rules determines if the program is within a program classification and when the program is within the program classification, administrative software presents a user interface for an administrator that includes the program classification, upon receiving an acceptance of the program classification, the administrative software updates the whitelist to add an entry that allows execution of the programs in the program classification;
otherwise, the administrative software presents a second user interface for the administrator that requests approval solely for the program and upon the acceptance, the administrative software updates the whitelist to add the entry for the program;
and
otherwise, the whitelist is not updated and future attempts to run the program will be blocked.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/246,869Filed 3 May 2021 · continuation in part
Priority: 11 Sep 2020
Published: US 2022/0083650 A117 Mar 2022
Granted: 25 Apr 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/51
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: at application…
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/54
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by adding security routines or objects to programs

Family

Application17/018,427Parent of this continuation-in-part · filed 11 Sep 2020
Application17/134,716Parent of this continuation-in-part · filed 28 Dec 2020
US 2022/0083673 A1Pre-grant publication · published 17 Mar 2022
US 11,507,675 B2Parent of this continuation-in-part
US 11,275,828 B1Parent of this continuation-in-part
US 2022/0083650 A1Published application
US 2022/0083672 A1Published application
US 11,636,219 B2This patent

From the US filing history. Foreign family members aren’t listed.