# US 7,613,930 B2 · Method for protecting computer programs and data from hostile code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,613,930 B2 - Document ID: US7613930B2 - Status: Granted - Kind: B2 - Application number: 11/141,909 - Filed: 2005-06-02 - Published: 2005-10-06 - Granted: 2009-11-03 - Earliest claimed: 2002-01-04 - Assignees: Trustware International Limited - Inventors: Eyal Dotan - Web page: https://patentgrep.com/patent/US7613930B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/6281: {at program execution time, where the protection is within the operating system} - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F 2221/2149: Restricted operating environment - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method that protects computer data from untrusted programs. Each computer's object and process is assigned with trust attributes, which define the way it can interact with other objects within the system. When an object is classified as untrusted, it can interact with other object within the system on a limited basis. A virtualized system is provided on the computer so that when the untrusted object attempts to perform an operation that is outside its scope of authorization, the virtualized system intercepts the operation but present the untrusted program with an indication that the requested operation has been performed. The method further includes processes to securely move a program from an untrusted group to a trusted group. ## Claims ### Claim 1 A computerized method of managing a computer's operation, comprising: whenever a new program is introduced to said computer performing a check to classify said program as one of trusted or untrusted; when a program is classified as an untrusted program, allowing installation of the untrusted program on said computer but limiting the untrusted program to run in a virtualized environment only; wherein said virtualized environment causes the computer to: intercept an operation request sent from the untrusted program to the computer's operating system; modify the operation request to obtain a modified operation request; provide the modified operation request to the operating system; send to the untrusted program an indication that the operation request has been performed by the operating system, to thereby virtualize the operation request. ### Claim 2 (depends on 1) The computerized method of claim 1, wherein when a program is classified as untrusted, said program is prevented from changing any existing program that has been classified as trusted. ### Claim 3 (depends on 1) The computerized method of claim 1, further comprising, enabling said computer to send an authorization request to a server, said authorization request requesting that an untrusted program be reclassified as a trusted program; and, whenever an authorization request is received by the server, the server may perform one of i. approve, ii. stall, or iii. deny. ### Claim 4 (depends on 3) The computerized method of claim 3, wherein said stall comprises indicating the time said authorization request has been made and postponing a decision as to whether to approve said reclassification until a specified period has lapsed. ### Claim 5 (depends on 3) The computerized method of claim 3, wherein prior to making a decision as to whether to approve said authorization request, a malicious code scanning is performed on said untrusted program. ### Claim 6 (depends on 3) The computerized method of claim 3, wherein said authorization request may include at least one of the indications i. whether the request is urgent and ii. whether the untrusted file is needed for a business or personal use. ### Claim 7 (depends on 3) The computerized method of claim 3, further comprising: providing a repository storage coupled to said server; when an untrusted program is installed on said computer, storing a designated copy of said program in said repository storage; when an authorization request is approved by the server, deleting said untrusted program from said computer and installing said designated copy as a trusted program on said computer. ### Claim 8 (depends on 1) The computerized virtualization method according to claim 1, wherein said modifying the operation request comprises modifying the directory name of the operation request and providing a modified directory name to the operating system. ### Claim 9 (depends on 8) The computerized virtualization method of claim 8, further comprising creating a virtualized directory and wherein said modified directory name refers to said virtualized directory. ### Claim 10 (depends on 9) The computerized virtualization method of claim 9, wherein when a program requests to modify a file during a virtualized mode operation, the file is copied onto the virtualized directory and the requested modification is performed only on the copied file, while the original file remains unchanged. ### Claim 11 (depends on 1) The computerized method of claim 1, further comprising creating a virtualized directory on said computer, and wherein when the operation request is to delete a file from a real directory, the method proceeds by generating an indication of a deletion of the file, and returning a deletion completion indication to the requesting program. ### Claim 12 (depends on 11) The computerized method of claim 11, wherein when a directory listing request is received, for each object name in the real directory the computer checks whether an indication if a delete operation exists, if yes, the computer does not include the object in the listing, if no computer checks whether the same name exists in the virtual directory and: if not, the computer includes the object name from the real directory in the listing if yes the computer does not include the object in the listing, and if no the computer includes the name of the virtual object in the listing. ### Claim 13 (depends on 1) computerized method of claim 1, further comprising creating a virtualized directory on said computer, and wherein when the operation request is to rename a file from a real directory, the method proceeds by copying the file into the virtualized directory, renaming the file in the virtual directory according to the rename request, generating an indication of a deletion of the original file name and returning a rename completion indication to the requesting program. ### Claim 14 (depends on 1) The computerized method of claim 1, further comprising creating a virtualized directory on said computer, and wherein when the operation request is to create a file in a real directory, the method proceeds by creating a file in the virtualized directory, and returning a file creation completion indication to the requesting program. ### Claim 15 A computerized method for managing a computer's operation using a plurality of virtual directories, each for providing an environment for running a program without contaminating the computer, the method comprising: whenever a new program is introduced to said computer, performing a check to determine whether the program should be allowed to run on the computer on an unlimited mode and, if yes, allowing the program to run on the computer on an unlimited mode; otherwise, when it is determined that the program should not be run on an unlimited mode, creating an assigned virtual directory and limiting the program to run in a virtualized environment corresponding to the assigned virtual directory; wherein said virtualized environment causes the computer to: intercept an operation request sent from the program to the computer's operating system; modify the operation request to obtain a modified operation request; provide the modified operation request to the operating system; send to the program an indication that the operation request has been performed by the operating system. ### Claim 16 (depends on 15) The method of claim 15, further comprising restoring the computer to its original condition existing prior to the step of limiting the program to run in a virtualized environment by deleting the assigned virtual directory. ### Claim 17 (depends on 15) The method o claim 15, wherein the operation request is any of read, write, delete, rename, create, and enumerate. ### Claim 18 (depends on 15) The method of claim 15, further comprising, when it is determined that the program should not be run on an unlimited mode, preventing the program from modifying any file existing outside the assigned virtual directory.