# US 7,613,918 B2 · System and method for enforcing a security context on a downloadable > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,613,918 B2 - Document ID: US7613918B2 - Status: Granted - Kind: B2 - Application number: 11/354,893 - Filed: 2006-02-16 - Published: 2007-08-16 - Granted: 2009-11-03 - Earliest claimed: 2006-02-16 - Assignees: Finjan Software, Ltd. - Inventors: Yuval Ben-Itzhak - Web page: https://patentgrep.com/patent/US7613918B2 ## CPC - G06F 21/54: by adding security routines or objects to programs - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for computer security, including receiving content including potentially malicious executable code (“CODE-A”), intended for downloading at a client computer, scanning CODE-A to derive a profile thereof, determining, based on the derived profile of CODE-A, an appropriate computer account from among a plurality of computer accounts, under which CODE-A may be processed by the client computer, wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable run under such account is processed, combining (i) information about the determined computer account name and (ii) CODE-A, with executable wrapper code (“CODE-B”) into combined code (“CODE-C”), and forwarding CODE-C to the client computer for processing. A system and a computer-readable storage medium are also described and claimed. ## Claims ### Claim 1 A method for computer security, comprising: receiving content including potentially malicious executable code (“CODE-A”), intended for downloading at a client computer, wherein the client computer manages a plurality of computer accounts for logging in to the client computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the client computer under such account is processed; scanning CODE-A to derive a profile thereof; determining, based on the derived profile of CODE-A, an appropriate computer account from among the plurality of computer accounts, under which CODE-A may be processed by the client computer; combining (i) information about the determined computer account name and (ii) CODE-A, with (iii) executable wrapper code (“CODE-B”) into combined code (“CODE-C”); and forwarding CODE-C to the client computer for processing. ### Claim 2 (depends on 1) The method of claim 1 further comprising attaching a digital signature to CODE-C. ### Claim 3 (depends on 1) The method of claim 1 wherein said determining is also based on at least one security rule applicable to the client computer. ### Claim 4 (depends on 1) The method of claim 1 wherein said determining comprises: identifying an appropriate security context; and identifying an appropriate computer account corresponding to the identified security context. ### Claim 5 (depends on 1) The method of claim 1 wherein said determining accesses the plurality of computer accounts from a database of computer accounts. ### Claim 6 (depends on 1) The method of claim 1 wherein said determining accesses the plurality of computer accounts from a Microsoft Active Directory of computer accounts. ### Claim 7 (depends on 1) The method of claim 1 wherein said determining checks if the appropriate computer account exists on the client computer. ### Claim 8 (depends on 7) The method of claim 7 wherein said determining replaces the appropriate computer account with a default computer account if the appropriate computer account does not exist on the client computer. ### Claim 9 (depends on 1) The method of claim 1 wherein CODE-A is a member of the group consisting of JavaScript, VBScript, PerScript, Java applet, Active X, and a standalone executable. ### Claim 10 (depends on 1) The method of claim 1 wherein CODE-B is a Windows Portable Executable. ### Claim 11 (depends on 1) The method of claim 1 further comprising maintaining an activity log including an entry for each combined CODE-C generated by said combining. ### Claim 12 A computer security system for a gateway computer, comprising: a receiver for receiving content including potentially malicious executable code (“CODE-A”), intended for downloading at a client computer, wherein the client computer manages a plurality of computer accounts for logging in to the client computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the client computer under such account is processed; a code profiler, coupled with said receiver, for scanning CODE-A and deriving a profile thereof; a security context generator, coupled with said code profiler, for determining, based on the profile of CODE-A derived by said profiler, an appropriate computer account from among the plurality of computer accounts, under which CODE-A may be processed by the client computer; a code packager, coupled with said security context generator, for packaging (i) information about the computer account determined by said security context generator and (ii) CODE-A, with (iii) executable wrapper code (“CODE-B”), into a combined code (“CODE-C”); and a transmitter, coupled with said code packager, for forwarding CODE-C to the client computer for processing. ### Claim 13 (depends on 12) The computer security system of claim 12 further comprising a digital authenticator for attaching a digital signature to CODE-C. ### Claim 14 (depends on 12) The computer security system of claim 12 wherein said security context generator also bases its determination on at least one security rule applicable to the client computer. ### Claim 15 (depends on 12) The computer security system of claim 12 wherein said security context generator first identifies an appropriate security context, and then identifies an appropriate computer account for the identified security context. ### Claim 16 (depends on 12) The computer security system of claim 12 further comprising a database for storing information about the plurality of computer accounts accessed by said context security generator. ### Claim 17 (depends on 12) The computer security system of claim 12 wherein said context security generator accesses information about the plurality of computer accounts from a Microsoft Active Directory of computer accounts. ### Claim 18 (depends on 12) The computer security system of claim 12 wherein CODE-A is a member of the group consisting of JavaScript, VBScript, PerScript, Java applet, Active X, and a standalone executable. ### Claim 19 (depends on 12) The computer security system of claim 12 wherein CODE-B is a Windows Portable Executable. ### Claim 20 (depends on 12) The computer security system of claim 12 further comprising a log manager for maintaining an activity log including an entry for each combined CODE-C generated by said code packager. ### Claim 21 A computer-readable storage medium storing program code for causing at least one computing device to: receive content including potentially malicious executable code (“CODE-A”), intended for downloading at a client computer, wherein the client computer manages a plurality of computer accounts for logging in to the client computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the client computer under such account is processed; scan CODE-A to derive a profile thereof; determine, based on the derived profile of CODE-A, an appropriate computer account from among the plurality of computer accounts, under which CODE-A may be processed by the client computer; combine (i) information about the determined computer account name and (ii) CODE-A, with (iii) executable wrapper code (“CODE-B”) into combined code (“CODE-C”); and forward CODE-C to the client computer for processing. ### Claim 22 A method for computer security, comprising: downloading, by a computer, executable code (“CODE-C”), where CODE-C includes (i) wrapper executable code (“CODE-B”), (ii) potentially malicious executable code (“CODE-A”), and (iii) information about a computer account for CODE-A, wherein the computer manages a plurality of computer accounts for logging in to the computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the computer under such account is processed; and processing, by the computer, CODE-B, comprising: extracting CODE-A from within CODE-C; extracting the information about the computer account for CODE-A from within CODE-C; and processing CODE-A within the security context associated with the computer account for CODE-A. ### Claim 23 (depends on 22) The method of claim 22 further comprising: checking if the computer account for CODE-A exists on the computer; and replacing the computer account for CODE-A with a default computer account, if the computer account for CODE-A does not exist on the computer. ### Claim 24 (depends on 22) The method of claim 22 wherein said processing CODE-A includes invoking a Windows function CreateProcessAsUser() with the computer account name as an input parameter. ### Claim 25 (depends on 22) The method of claim 22 further comprising if CODE-A itself initiates executable code (“CODE-D”), then inserting CODE-D into CODE-C. ### Claim 26 (depends on 22) The method of claim 22 further comprising: if CODE-A itself initiates executable code (“CODE-D”), then scanning CODE-D to derive a profile thereof; determining, based on the derived profile of CODE-D, an appropriate computer account for CODE-D from among a plurality of computer accounts, under which CODE-D may be processed, wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable is processed; and combining (i) information about the determined computer account name and (ii) CODE-D, with (iii) CODE-B into combined code (“Code E”). ### Claim 27 (depends on 22) The method of claim 22 wherein CODE-C is signed, the method further comprising authenticating the signature of CODE-C. ### Claim 28 A computer security system, comprising: a receiver within a computer, for downloading executable code (“CODE-C”), where CODE-C includes (i) wrapper executable code (“CODE-B”), (ii) potentially malicious executable code (“CODE-A”), and (iii) information about a computer account for CODE-A; an account manager within the computer, for managing a plurality of computer accounts for logging in to the computer, wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the computer under such account is processed by a processor within the computer; a code extractor within the computer, coupled with said receiver, for extracting CODE-A from within CODE-C; a computer account extractor within the computer, coupled with said receiver, for extracting the information about the computer account name for CODE-A from within CODE-C; and a processor within the computer, coupled with said account manager, said code extractor and said computer account extractor, for processing CODE-A within the security context associated with the computer account for CODE-A. ### Claim 29 (depends on 28) The system of claim 28 wherein said computer account extractor checks if the computer account for CODE-A exists on the computer, and replaces the computer account for CODE-A with a default computer account if the computer account for CODE-A does not exist on the computer. ### Claim 30 (depends on 28) The computer security system of claim 28 wherein said processor further comprises a code packager for inserting executable code (“CODE-D”) into CODE-C if CODE-A itself initiates such executable code. ### Claim 31 (depends on 28) The computer security system of claim 28 wherein said processor further comprises: a code profiler for scanning executable code (“CODE-D”) and deriving a profile thereof; a security context generator for determining, based on the profile of CODE-D derived by said code profiler, an appropriate computer account from among a plurality of computer accounts, under which CODE-D may be processed, wherein each account of the plurality of computer accounts has associated therewith a security context within which an executable is processed; and a code packager for packaging (i) information about the computer account name determined by said security context generator and (ii) CODE-D, with (iii) executable wrapper code (“Code B”), into a combined code (“CODE-E”). ### Claim 32 (depends on 28) The computer security system of claim 28 wherein CODE-C is signed, the system further comprising a code validator for validating the signature of CODE-C. ### Claim 33 A computer-readable storage medium storing program code for causing at least one computing device to: download executable code (“CODE-C”), where CODE-C includes (i) wrapper executable code (“CODE-B”), (ii) potentially malicious executable code (“CODE-A”), and (iii) information about a computer account for CODE-A, wherein the computer manages a plurality of computer accounts for logging in to the computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the computer under such account is processed; and process Code B, comprising: extracting CODE-A from within CODE-C; extracting the information about the computer account name for CODE-A from within CODE-C; and processing CODE-A within the security context associated with the computer account for CODE-A. ### Claim 34 A method for computer security, comprising: receiving content including potentially malicious executable code (“CODE-A”), intended for downloading at a client computer, wherein the client computer manages a plurality of computer accounts for logging in to the client computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the client computer under such account is processed; receiving the name of a predetermined computer account from the plurality of computer accounts; scanning CODE-A to derive a profile thereof; combining (i) information about the predetermined computer account and (ii) CODE-A, with (iii) executable wrapper code (“CODE-B”) into combined code (“CODE-C”); and forwarding CODE-C to the client computer for processing. ### Claim 35 A computer security system for a gateway computer, comprising: a receiver for receiving content including potentially malicious executable code (“CODE-A”), intended for downloading at a client computer, wherein the client computer manages a plurality of computer accounts for logging in to the client computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the client computer under such account is processed; a code profiler, coupled with said receiver, for scanning CODE-A and deriving a profile thereof; and a code packager, coupled with said security context generator, for packaging (i) information about a predetermined computer account from the plurality of computer accounts, and (ii) CODE-A, with (iii) executable wrapper code (“CODE-B”), into a combined code (“CODE-C”); and a transmitter, coupled with said code packager, for forwarding CODE-C to the client computer for processing. ### Claim 36 A computer-readable storage medium storing program code for causing at least one computing device to: receive content including potentially malicious executable code (“CODE-A”), intended for downloading at a client computer, wherein the client computer manages a plurality of computer accounts for logging in to the client computer, and wherein each computer account of the plurality of computer accounts has associated therewith a security context within which an executable running on the client computer under such account is processed; receive the name of a predetermined computer account from the plurality of computer accounts scan CODE-A to derive a profile thereof; combine (i) information about the predetermined computer account name and (ii) CODE-A, with (iii) executable wrapper code (“CODE-B”) into combined code (“CODE-C”); and forward CODE-C to the client computer for processing.