# US 7,613,926 B2 · Method and system for protecting a computer and a network from hostile downloadables > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,613,926 B2 - Document ID: US7613926B2 - Status: Granted - Kind: B2 - Application number: 11/370,114 - Filed: 2006-03-07 - Published: 2006-07-06 - Granted: 2009-11-03 - Earliest claimed: 1997-11-06 - Assignees: Finjan Software, Ltd. - Inventors: Yigal Mordechai Edery; Nimrod Itzhak Vered; David R. Kroll; Shlomo Touboul - Web page: https://patentgrep.com/patent/US7613926B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/168: {above the transport layer} - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Protection systems and methods provide for protecting one or more personal computers (“PCs”) and/or other intermittently or persistently network accessible devices or processes from undesirable or otherwise malicious operations of Java™ applets, ActiveX™ controls, JavaScript™ scripts, Visual Basic scripts, add-ins, downloaded/uploaded programs or other “Downloadables” or “mobile code” in whole or part. A protection engine embodiment provides, within a server, firewall or other suitable “re-communicator,” for monitoring information received by the communicator, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information, more suitably by forming a protection agent including the MPC, protection policies and a detected-Downloadable. An MPC embodiment further provides, within a Downloadable-destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing (predetermined) corresponding operations to be executed in response to the attempts, more suitably in conjunction with protection policies. ## Claims ### Claim 1 A computer-based method, comprising the steps of: receiving an incoming Downloadable; performing a hashing function on the incoming Downloadable to compute an incoming Downloadable ID; retrieving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on the incoming Downloadable ID, the security profile data including a list of suspicious computer operations that may be attempted by the Downloadable; appending a representation of the retrieved Downloadable security profile data to the incoming Downloadable, to generate an appended Downloadable; and transmitting the appended Downloadable to a destination computer. ### Claim 2 (depends on 1) The computer-based method of claim 1 wherein the Downloadable includes an applet. ### Claim 3 (depends on 1) The computer-based method of claim 1 wherein the Downloadable includes an active control. ### Claim 4 (depends on 1) The computer-based method of claim 1 wherein the Downloadable includes program script. ### Claim 5 (depends on 1) The computer-based method of claim 1 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, and to memory. ### Claim 6 (depends on 1) The computer-based method of claim 1 wherein the Downloadable security profile data includes a URL from where the Downloadable originated. ### Claim 7 (depends on 1) The computer-based method of claim 1 wherein the Downloadable security profile data includes a digital certificate. ### Claim 8 A system for managing Downloadables, comprising: a receiver for receiving an incoming Downloadable; a Downloader identifier for performing a hashing function on the incoming Downloadable to compute an incoming Downloadable ID; a database manager for retrieving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on the incoming Downloadable ID, the security profile data including a list of suspicious computer operations that may be attempted by the Downloadable; a file appender coupled with said receiver for appending are presentation of the Downloadable security profile data to the incoming Downloadable, to generate an appended Downloadable; and a transmitter coupled with said file appender, for transmitting the appended Downloadable to a destination computer. ### Claim 9 (depends on 8) The system of claim 8 wherein the Downloadable includes an applet. ### Claim 10 (depends on 8) The system of claim 8 wherein the Downloadable includes an active control. ### Claim 11 (depends on 8) The system of claim 8 wherein the Downloadable includes program script. ### Claim 12 (depends on 8) The system of claim 8 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, and to memory. ### Claim 13 (depends on 8) The system of claim 8 wherein the Downloadable security profile data includes a URL from where the Downloadable originated. ### Claim 14 (depends on 8) The system of claim 8 wherein the Downloadable security profile data includes a digital certificate. ### Claim 15 A computer-based method, comprising the steps of: receiving an incoming Downloadable; performing a hashing function on the incoming Downloadable to compute an incoming Downloadable ID; retrieving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on the incoming Downloadable ID, the security profile data including a list of suspicious computer operations that may be attempted by the Downloadable; and transmitting the incoming Downloadable and a representation of the retrieved Downloadable security profile data to a destination computer, via a transport protocol transmission. ### Claim 16 (depends on 15) The computer-based method of claim 15 wherein the Downloadable includes an applet. ### Claim 17 (depends on 15) The computer-based method of claim 15 wherein the Downloadable includes an active control. ### Claim 18 (depends on 15) The computer-based method of claim 15 wherein the Downloadable includes program script. ### Claim 19 (depends on 15) The computer-based method of claim 15 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, and to memory. ### Claim 20 (depends on 15) The computer-based method of claim 15 wherein the Downloadable security profile data includes a URL from where the Downloadable originated. ### Claim 21 (depends on 15) The computer-based method of claim 15 wherein the Downloadable security profile data includes a digital certificate. ### Claim 22 A system for managing Downloadables, comprising: a receiver for receiving an incoming Downloadable; a Downloadable identifier for performing a hashing function on the incoming Downloadable to compute an incoming Downloadable ID; a database manager for retrieving security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on the incoming Downloadable ID, the security profile data including a list of suspicious computer operations that may be attempted by the Downloadable; and a transmitter coupled with said receiver, for transmitting the incoming Downloadable and a representation of the retrieved Downloadable security profile data to a destination computer, via a transport protocol transmission. ### Claim 23 (depends on 22) The system of claim 22 wherein the Downloadable includes an applet. ### Claim 24 (depends on 22) The system of claim 22 wherein the Downloadable includes an active control. ### Claim 25 (depends on 22) The system of claim 22 wherein the Downloadable includes program script. ### Claim 26 (depends on 22) The system of claim 22 wherein suspicious computer operations include calls made to an operating system, a file system, a network system, and to memory. ### Claim 27 (depends on 22) The system of claim 22 wherein the Downloadable security profile data includes a URL from where the Downloadable originated. ### Claim 28 (depends on 22) The system of claim 22 wherein the Downloadable security profile data includes a digital certificate. ### Claim 29 A computer-readable storage medium storing program code for causing at least one computing device to: receive an incoming Downloadable; perform a hashing function on the incoming Downloadable to compute an incoming Downloadable ID; retrieve security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on the incoming Downloadable ID, the security profile data including a list of suspicious computer operations that may be attempted by the Downloadable; append a representation of the retrieved Downloadable security profile data to the incoming Downloadable, to generate an appended Downloadable; and transmit the appended Downloadable to a destination computer. ### Claim 30 A computer-readable storage medium storing program code for causing at least one computing device to: receive an incoming Downloadable; perform a hashing function on the incoming Downloadable to compute an incoming Downloadable ID; retrieve security profile data for the incoming Downloadable from a database of Downloadable security profiles indexed according to Downloadable IDs, based on the incoming Downloadable ID, the security profile data including a list of suspicious computer operations that may be attempted by the Downloadable; and transmit the incoming Downloadable and a representation of the retrieved Downloadable security profile data to a destination computer, via a transport protocol transmission.