# US 8,474,011 B2 · On-line centralized and local authorization of executable files

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,474,011 B2
- Document ID: US8474011B2
- Status: Granted
- Kind: B2
- Application number: 13/287,475
- Filed: 2011-11-02
- Published: 2012-02-23
- Granted: 2013-06-25
- Earliest claimed: 2004-04-19
- Assignees: Lumension Security, Inc.
- Applicants: Viacheslav Usov
- Inventors: Viacheslav Usov
- Web page: https://patentgrep.com/patent/US8474011B2

## CPC

- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/121: {Restricting unauthorised execution of programs}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 2221/2101: Auditing as a secondary aspect
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and system for controlling the execution of executable files. The executables are identified by either a cryptographic digest or a digital certificate. The cryptographic digest is computed from the binary image of the executable. An executable that is attempting to execute is intercepted by a protection module that consults a database of stored rules over a secure channel to determine whether or not the executable can be identified as a permitted executable and whether or not it has permission to execute on a particular computer system under certain specified conditions. If a stored permission is available, it is used to control the execution. Otherwise, the user is consulted for permission.

## Claims

### Claim 1

A method comprising:
(a) attempting to execute a first executable file on a first computer system associated with a first user;
(b) intercepting a system service in response to the attempting step (a);
(c) after the attempting step (a), determining whether to execute the first executable file, wherein the determining step comprises examining a set of global authorization rules;
(i) wherein at least some of the rules of the set of global authorization rules at least include a listing of:
(A) applicable users;
(B) applicable executable files;
(ii) wherein, when one located rule of the set of global authorization rules includes both (I) the first user in the listing of applicable users and (II) the first executable file in the listing of applicable executable files, the first computer system applies a stored permission associated with the one located rule to determine whether it is permissible to execute the first executable file;
(iii) wherein, when the set of global authorization rules is free of any one rule having both (A) the first user in the listing of applicable users and (B) the first executable file in the listing of applicable executable files, the first computer system examines a local authorization listing associated with the first user to determine whether there is a stored user input associated with the first executable file;
(A) wherein, when the local authorization listing associated with the first user includes a stored user input associated with the first executable file, the computer system applies the stored user input associated with the first executable file to determine whether it is permissible to execute the first executable file;
(B) wherein, when the local authorization listing is absent of a stored user input associated with the first executable file, the computer system obtains a user input from the first user to determine whether it is permissible to execute the first executable tile, and stores the user input in the local authorization listing relative to the first user and the first executable file; and
(d) after the examining step (c), invoking the system service when it is permissible to execute the first executable file.

### Claim 2 (depends on 1)

The method of claim 1, wherein the intercepting step (e) comprises identifying the first executable file via a cryptographic digest.

### Claim 3 (depends on 2)

The method of claim 2, wherein the identifying step comprises using a binary image of the first executable file.

### Claim 4 (depends on 3)

The method of claim 3, wherein the binary image is a full binary image.

### Claim 5 (depends on 3)

The method of claim 3, wherein the binary image is a partial binary image.

### Claim 6 (depends on 1)

The method of claim 1, comprising identifying at least some of the applicable executable files via a digital certificate of an executable file.