# US 2008/0189796 A1 · Method and apparatus for deferred security analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0189796 A1 - Document ID: US20080189796A1 - Status: Published application - Kind: A1 - Application number: 11/672,428 - Filed: 2007-02-07 - Published: 2008-08-07 - Earliest claimed: 2007-02-07 - Assignees: Apple Inc. - Inventors: Christopher S. Linn; Jacques Vidrine; Aaron Sigel - Web page: https://patentgrep.com/patent/US20080189796A1 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract It has been discovered that identifying files introduced into a system, particularly those originating from external sources, as being subject to security evaluation and deferring the security evaluation until access or attempted access of the file reduces security vulnerabilities of a system. A file introduced into a processing system is tagged with a security tag if the file is introduced via a supervised introduction point and/or introduced by a supervised program. Upon access or attempted access of the tagged file, security evaluation is initiated on the file. ## Claims ### Claim 1 A method of managing files received by a processing system from a source external to the processing system, the method comprising the acts of: introducing a file into the processing system; tagging the file with a security tag; and upon an activation event for the tagged file, detecting the security tag and initiating a security evaluation of the file. ### Claim 2 (depends on 1) The method of claim 1 further comprising the acts of: determining that an introduction point to the processing system is one of a set of introduction points to the processing system previously identified as subject to security supervision; and determining that the file is received via the introduction point; and wherein said act of tagging is in accordance with said act of determining that the file is received via the introduction point. ### Claim 3 (depends on 2) The method of claim 2 further comprising the act of identifying the set of introduction points. ### Claim 4 (depends on 1) The method of claim 1 further comprising the acts of: identifying a set of applications as subject to security supervision; and determining that a first application of the set of applications receives the file, wherein said act of tagging is contingent on determining that the first application is one of the identified set of applications. ### Claim 5 (depends on 1) The method of claim 1 further comprising the act of determining that the file is associated with the security tag prior to initiating the security analysis. ### Claim 6 (depends on 1) The method of claim 1, wherein the security analysis comprises at least one of a set of acts consisting essentially of analyzing a file type of the file, analyzing content of the file, and determining source of the file. ### Claim 7 (depends on 1) The method of claim 1, wherein said act of tagging comprises at least one of a set of acts consisting essentially of marking the file, installing executable code in the file that implements said act of initiating, and setting a value in the file. ### Claim 8 (depends on 1) The method of claim 1 further comprising the act of recording additional information about the file coincident with said act of tagging the file, wherein the additional information is selected from a group consisting essentially of one or more of, the network address of a source of the file, The creation date of the file, theserver name of the source of the file, the date the file was last modified, the author of the file, and the source context for the file, wherein the source context information allows determination of a conveyor of the file. ### Claim 9 A method of operating a processing system to provide a measure of security as to files received from sources external to the processing system, the method comprising the acts of: coincident with introduction of a file into the processing system, indicating that the file is subject to an access-based security evaluation; and initiating the access-based security evaluation for the file coincident with access of the file at the processing system. ### Claim 10 (depends on 9) The method of claim 9, wherein the security measure comprises at least one act selected from a set consisting essentially of generating a notification, quarantining the file, denying access to the file, and preventing activation of the file. ### Claim 11 (depends on 9) The method of claim 9, wherein said access of the file comprises one of a set consisting essentially of an open event, an execute event, a link event, and a transmit event. ### Claim 12 (depends on 9) The method of claim 9 further comprising the acts of: determining whether an application that introduces the file is indicated as subject to security supervision, wherein said act of indicating is in accordance with said act of determining. ### Claim 13 (depends on 12) The method of claim 12, wherein the application is selected from a set consisting essentially of an e-mail client, a browser, a virtual machine, and a file transfer protocol application. ### Claim 14 (depends on 9) The method of claim 9 further comprising the acts of: determining that the file contains at least a second file; and indicating that the second file is subject to access-based security evaluation. ### Claim 15 (depends on 14) The method of claim 14, wherein said act of indicating is performed upon attempted access of the second file, wherein the attempted access is selected from a set consisting essentially of moving the second file, copying the second file, discovering the second file, and identifying the second file. ### Claim 16 A method of securing a processing system comprising the acts of: detecting a request for memory space for a file from an application; coincident with said act of detecting, setting an indication that activation of the file is contingent on a security analysis of the file; and initiating the security analysis of the file coincident with attempted activation of the file. ### Claim 17 (depends on 16) The method of claim 16 further comprising the act of recording information for the file including at least one of a set consisting essentially of the file source, the introduction time, the source of the application, the privilege level of the application, and the source context, wherein the source context information for the file indicates an object instance of the application that conveys the file. ### Claim 18 (depends on 17) The method of claim 17 further comprising the act of bypassing the act of indicating if the file is written to a pre-defined security bypass location. ### Claim 19 (depends on 16) The method of claim 16 further comprising the act of identifying the application as subject to security supervision. ### Claim 20 A computing machine program product encoded in one or more machine-readable media, the program product comprising: a first sequence of instructions executable to set a security indication that indicates activation of a file introduced from an external source is subject to security analysis; and a second sequence of instructions executable to initiate security evaluation of a file coincident with attempted access of the file if a security indication is set for the file. ### Claim 21 (depends on 20) The program product of claim 20 further comprising: a third sequence of instructions executable to identify a set of applications subject to security supervision, wherein the first sequence of instructions are further executable to set the security indication if an application that introduces the file is determined to be within the set of applications. ### Claim 22 (depends on 20) The program product of claim 20 further comprising a third sequence of instructions executable to identify a set of one or more introduction points into a processing system that are subject to security supervision, wherein the first sequence of instructions are further executable to set the security indication if the file is introduced into the processing system via one of the set of identified introduction points. ### Claim 23 (depends on 20) The program product of claim 20 further comprising a third sequence of instructions executable to determine whether the file is written to a pre-defined safe location configured as a bypass of the security analysis and executable to bypass execution of the first sequence of instructions if so determined. ### Claim 24 (depends on 20) The program product of claim 20 further comprising the first sequence of instructions further executable to indicate that one or more files embedded within a file are subject to the security measure if the file has been indicated as subject to the security analysis. ### Claim 25 (depends on 20) The program product of claim 20 further comprising a third sequence of instructions executable to set a security indication for an embedded file coincident with an operation selected from a set of operations consisting essentially of copying, moving, extracting, displaying, and identifying the one or more embedded files. ### Claim 26 A machine-readable medium having instructions encoded therein, which when implemented by a machine, cause operations to be performed which comprise: a first plurality of predetermined operations of an application, which when executed, provide a set of predetermined functionality of the machine to a user; and a second plurality of operations, which comprise, monitoring files of at least one application that receives files from a source external to the machine; associating a security indicator with a file received by the at least one application from a source external to the machine; coincident with an operation to access a file having an associated security indicator, evaluating the file for a possible security threat. ### Claim 27 (depends on 26) The machine-readable medium of claim 26, wherein the predetermined functionality provided by the first plurality of predetermined operations is at least one of a set consisting essentially of file management functionality, machine resource management functionality, communication functionality, and machine resource interface functionality. ### Claim 28 (depends on 26) The machine-readable medium of claim 26, wherein the second plurality of operations further comprise: propagating a security indicator associated with a file having an associated security indicator to one or more files embedded within the file. ### Claim 29 (depends on 26) The machine-readable medium of claim 26 further comprising a third plurality of comprising recording information about the received file, the information selected from a group consisting essentially of one or more of, the network address of a source of the file, the server name of the source of the file, date information for the file, author information for the file, and source context information for the file, wherein the source context information for the file indicates an object instance of the application that conveys the file. ### Claim 30 An apparatus comprising: a set of one or more processors operable to execute a set of one or more applications that introduce files into the apparatus; means for setting a security indication for a file introduced by a first application of the set of applications if the first application is indicated in a set of one or more applications previously identified as subject to security supervision; and means for initiating the security evaluation coincident with attempted access of the file if the security indication is set for the file. ### Claim 31 (depends on 30) The apparatus of claim 30, wherein the indicating means are independent of the set of applications. ### Claim 32 A system comprising: a first machine hosting a file; and a second machine in communication with the first machine, the second machine, hosting an application identified as capable of exposing the second machine to a security threat, introducing the file for the application, associating a security indicator with the introduced file coincident with the introducing, and upon attempted activation of the introduced file, determining that the security indicator is associated with the introduced file and initiating a security evaluation of the file. ### Claim 33 (depends on 32) The system of claim 32, wherein the second machine introduces a second file for the application from the first machine, places the second file at a pre-defined location, bypasses the associating upon determining location of the second file at the pre-defined location.