Method and apparatus for deferred security analysis
AssigneeApple Inc.
InventorsChristopher S. Linn, Jacques Vidrine, Aaron Sigel
Life of this patent
Estimating the term…
Abstract
It has been discovered that identifying files introduced into a system, particularly those originating from external sources, as being subject to security evaluation and deferring the security evaluation until access or attempted access of the file reduces security vulnerabilities of a system. A file introduced into a processing system is tagged with a security tag if the file is introduced via a supervised introduction point and/or introduced by a supervised program. Upon access or attempted access of the tagged file, security evaluation is initiated on the file.
Claims33
A method of managing files received by a processing system from a source external to the processing system, the method comprising the acts of:
- introducing a file into the processing system;
- tagging the file with a security tag;
- and
- upon an activation event for the tagged file, detecting the security tag and initiating a security evaluation of the file.
A method of operating a processing system to provide a measure of security as to files received from sources external to the processing system, the method comprising the acts of:
- coincident with introduction of a file into the processing system, indicating that the file is subject to an access-based security evaluation;
- and
- initiating the access-based security evaluation for the file coincident with access of the file at the processing system.
A method of securing a processing system comprising the acts of:
- detecting a request for memory space for a file from an application;
- coincident with said act of detecting, setting an indication that activation of the file is contingent on a security analysis of the file;
- and
- initiating the security analysis of the file coincident with attempted activation of the file.
A computing machine program product encoded in one or more machine-readable media, the program product comprising:
- a first sequence of instructions executable to set a security indication that indicates activation of a file introduced from an external source is subject to security analysis;
- and
- a second sequence of instructions executable to initiate security evaluation of a file coincident with attempted access of the file if a security indication is set for the file.
A machine-readable medium having instructions encoded therein, which when implemented by a machine, cause operations to be performed which comprise:
- a first plurality of predetermined operations of an application, which when executed, provide a set of predetermined functionality of the machine to a user;
- and
- a second plurality of operations, which comprise,
- monitoring files of at least one application that receives files from a source external to the machine;
- associating a security indicator with a file received by the at least one application from a source external to the machine;
- coincident with an operation to access a file having an associated security indicator, evaluating the file for a possible security threat.
An apparatus comprising:
- a set of one or more processors operable to execute a set of one or more applications that introduce files into the apparatus;
- means for setting a security indication for a file introduced by a first application of the set of applications if the first application is indicated in a set of one or more applications previously identified as subject to security supervision;
- and
- means for initiating the security evaluation coincident with attempted access of the file if the security indication is set for the file.
A system comprising:
- a first machine hosting a file;
- and
- a second machine in communication with the first machine, the second machine,
- hosting an application identified as capable of exposing the second machine to a security threat,
- introducing the file for the application,
- associating a security indicator with the introduced file coincident with the introducing, and
- upon attempted activation of the introduced file, determining that the security indicator is associated with the introduced file and initiating a security evaluation of the file.
Dependencies are inferred from the claim text.