US 8,429,756 B2Granted

Security restrictions on binary behaviors

AssigneeMicrosoft Corporation

InventorsShankar Ganesh, John G. Bedworth

Life of this patent

Estimating the term…

Loading patent…

Abstract

A security model restricts binary behaviors on a machine based on identified security zones. Binary behaviors can be attached to an element of a document, web-page, or email message. The binary behavior potentially threatens security on the local machine. A security manager intercepts download requests and/or execution requests, identifies a security zone for the requested binary behavior, and restricts access based on the security zone. The binary behavior can identify a security zone according to the related URL. In one example, all binary behaviors associated with a security zone are handled identically. In another example, a list of permissible binary behaviors is associated with a security zone such that only specified binary behaviors are granted access. In still another example, a list of impermissible binary behaviors is associated with a security zone such that binary behaviors that are found in the list cannot initiate access.

Claims20

Dependent claims

A computer implemented method for casting security on binary behaviors comprising:

establishing a plurality of security zones that are configured to place security restrictions on binary behaviors that are attached to hypertext markup language (HTML) elements and control rendering associated with respective HTML elements, wherein the security restrictions are configured to restrict access of the binary behaviors to operating system functionality;
ascertaining HTML elements and associations of the HTML elements with the binary behaviors in an HTML document prior to rendering the HTML document, including processing style sheets associated with the HTML elements indicative of style attributes for the HTML elements;
initiating the rendering of the HTML document;
identifying, during rendering of the HTML document, a security zone of the plurality of security zones that is associated with a request initiated by an HTML element that is being rendered and is from the HTML document to execute an associated binary behavior, the identifying being performed responsive to intercepting the request to execute the associated binary behavior;
and
selecting a permission level for the binary behavior in the identified security zone to selectively control execution of the binary behavior including permitting access to the operating system functionality when binary behaviors are enabled in the identified security zone, or denying access to the operating system functionality when binary behaviors are disabled in the identified security zone.

3 more elements

One or more computer readable storage devices storing computer-executable instructions that, when executed by one or more components of a client device, cause the client device to perform acts comprising:

casting security on a binary behavior that is attached to a hypertext markup language (HTML) element in a document and is configured to control rendering associated with the HTML element by at least:
establishing a plurality of security zones configured to place security restrictions on binary behaviors with respect to access of the binary behaviors to operating system functionality;
ascertaining an association between the HTML element and the binary behavior in the document prior to rendering the document, including processing a style sheet associated with the HTML element to identify style attributes for the HTML element;
initiating the rendering of the document;
rendering the HTML element in the document and responsive to intercepting an attempt made during the rendering to retrieve the binary behavior, identifying a security zone corresponding to the binary behavior when the attempt is made;
and
retrieving a security setting for the binary behavior in the identified security zone;
denying retrieval of a binary behavior on the client device when the retrieved security setting denies access for the binary behavior in the identified security zone;
and
granting retrieval of the binary behavior on the client when the retrieved security setting grants access for the binary behavior in the identified security zone.

7 more elements

A system for casting security on a binary behavior that is associated with content from a remote computing device, comprising:

one or more processing devices;
and
one or more computer readable storage media storing instructions that, when executed by the one or more processing devices, implement a security manager configured to perform acts including:
establishing a plurality of security zones configured to place security restrictions on binary behaviors that are attached to hypertext markup language (HTML) elements and control rendering associated with respective HTML elements, wherein the security restrictions are configured to restrict access of the binary behaviors to operating system functionality;
parsing the content from the remote computing device to identify HTML elements of the content and behaviors associated with the HTML elements prior to rendering the content, including processing style sheets associated with the HTML elements indicative of style attributes that are associated with the binary behaviors;
initiating the rendering of the content;
identifying, as the content is being rendered, a binary behavior that is associated with a selected HTML element that is being rendered of the parsed content responsive to intercepting a request for the binary behavior;
mapping a security zone of the plurality of security zones to the identified binary behavior;
selectively enabling or denying access for the binary behavior to the operating system functionality based on the retrieved security setting.

6 more elements

Dependencies are inferred from the claim text.