US 7,743,425 B2Granted

Security restrictions on binary behaviors

AssigneeMicrosoft Corporation

InventorsShankar Ganesh, John G. Bedworth

Life of this patent

Estimating the term…

Loading patent…

Abstract

A security model restricts binary behaviors on a machine based on identified security zones. Binary behaviors can be attached to an element of a document, web-page, or email message. The binary behavior potentially threatens security on the local machine. A security manager intercepts download requests and/or execution requests, identifies a security zone for the requested binary behavior, and restricts access based on the security zone. The binary behavior can identify a security zone according to the related URL. In one example, all binary behaviors associated with a security zone are handled identically. In another example, a list of permissible binary behaviors is associated with a security zone such that only specified binary behaviors are granted access. In still another example, a list of impermissible binary behaviors is associated with a security zone such that binary behaviors that are found in the list cannot initiate access.

Claims17

Dependent claims

A computer implemented method of casting security on a binary behavior that is associated with an element in a document, comprising:

processing the element to identify an association with the binary behavior, the binary behavior configured to cause a request to execute a binary executable external to the document, the binary behavior configured using a compiled language that is non-script based to enable access to an operating system and attached to a hypertext markup language (HTML) element;
intercepting the request before execution of the binary executable;
determining whether the binary behavior corresponds to a standard format uniform resource locator (URL) by at least tracing a markup associated with at least one style attribute to locate the URL;
identifying a security zone that is associated with the URL, wherein the URL is associated with a domain;
and
selecting a permission level for the binary behavior in the identified security zone to selectively control execution of the binary executable, including at least one of:
selecting the permission level to permit access when an identifier associated with the binary behavior is located in a permission list for the identified security zone, selecting the permission level to deny access when the identifier associated with the binary behavior is located in a deny list for the identified security zone, selecting the permission level to permit access when binary behaviors are enabled in the identified security zone, or selecting the permission level to deny access when binary behaviors are disabled in the identified security zone.

4 more elements

A computer readable storage medium comprising computer-executable instructions configured to cast security on a binary behavior that is associated with an element in a document on a computing device, the computer-executable instructions configured to:

evaluate the element to identify a binary executable external to the document that is referenced by the binary behavior associated with the element, the binary behavior configured using a compiled non-script-based code language that enables attachment to a hypertext markup language (HTML) element and access to an operating system, wherein the compiled non-script-based language includes at least a COM object or a COM+ object;
intercept a request, during rendering of the element in the document, for the binary executable to prevent execution of the binary executable by the computing device;
identify a security zone for the binary behavior;
retrieve a security setting for the binary behavior in the identified security zone;
deny retrieval of the binary executable for execution on the computing device when the retrieved security setting denies access for the binary behavior in the identified security zone;
and
grant retrieval of the binary executable for execution on the computing device when the retrieved security setting grants access for the binary behavior in the identified security zone, wherein the binary executable is associated with the identified binary behavior.

4 more elements

A system configured to cast security on a binary behavior that is associated with content from a remote computing device, comprising:

a local computing device, wherein the content is communicated from the remote computing device to the local computing device over a communication medium, and wherein the local computing device is configured to perform a method comprising:
parsing the content, the content including multiple elements having attached binary behaviors that comprise one or more compiled non-script-based languages, to build an element tree including identified elements on the local computing device and behaviors associated with the identified elements, the binary behaviors configured using the one or more compiled non-script-based languages to enable access to an operating system on the local computing device;
processing at least one selected element from the identified elements on the local machine to render a behavior of the selected element by:
identifying a binary behavior that is associated with the selected element and is configured to cause execution of a binary executable separate from the content;
mapping a security zone to the identified binary behavior;
retrieving a security setting associated with the binary behavior in the mapped security zone;
and
selectively denying execution of the binary executable by the local computing device based on the retrieved security setting;
and
responsive to a determination that the binary executable is resident on the local computing device:
bypassing the mapping, retrieving, and selectively denying;
and
enabling local execution of the binary executable.

10 more elements

Dependencies are inferred from the claim text.