# US 8,544,086 B2 · Tagging obtained content for white and black listing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,086 B2 - Document ID: US8544086B2 - Status: Granted - Kind: B2 - Application number: 11/450,608 - Filed: 2006-06-09 - Published: 2006-10-12 - Granted: 2013-09-24 - Earliest claimed: 2004-10-29 - Assignees: Microsoft Corporation - Applicants: Scott A Field - Inventors: Scott A Field - Web page: https://patentgrep.com/patent/US8544086B2 ## CPC - G06F 21/562: {Static detection} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for providing enhanced security with regard to obtained files is presented. Upon obtaining a file from an external location, the obtained file is tagged with tagging information regarding the origin of the obtained file. Additionally, an operating system suitable for execution on a computing device is also presented. The operating system includes at least one application-callable function (API) for obtaining content from an external location. Each application-callable function for obtaining content from an external location is configured to associate tagging information with each obtained file, the tagging information comprising the origin of the obtained file. The origin of the obtained file can be used for subsequent security policy decisions, such as whether to allow or block execution or rendering of the content, as well as whether the content will be accessed in a constrained environment such as a “sandbox” or virtual machine. ## Claims ### Claim 1 A computer system for providing enhanced security with regard to obtained files, the computer system comprising: a processor; and a memory storing instructions that, when executed by the processor, implement an operating system configured to: provide at least one application-callable operating system function that, when called by an application, obtains a user-modifiable file from an external location; generate, by the at least one application-callable operating system function as part of a process of obtaining the user-modifiable file from the external location for the application, tagging information regarding a source of the user-modifiable file; and tag, by the at least one application-callable operating system function as part of the process of obtaining the user-modifiable file from the external location for the application, the user-modifiable file with the tagging information regarding a source of the user-modifiable file, whereby file tagging is performed automatically by the operating system when obtaining the user-modifiable file for the application, wherein the computer system is further configured to: determine a trustworthiness of the user-modifiable file based at least in part on the tagging information; and process the user-modifiable file based at least in part on the trustworthiness. ### Claim 2 (depends on 1) The computer system of claim 1 further comprising a rules data store describing rules for acting upon obtained files according to the obtained file's trustworthiness; and wherein the computer system is configured to act upon the obtained file according to a rule in the rules data store corresponding to the trustworthiness. ### Claim 3 (depends on 2) The computer system of claim 2 further comprising a black-list data store comprising information regarding untrustworthy sources, and wherein the computer system determines the trustworthiness by determining whether the source of the user-modifiable file, as described in the tagging information, is found in the black-list data store. ### Claim 4 (depends on 3) The computer system of claim 3, further comprising an anti-malware component configured to dynamically update at least one rule stored in the rules data store and/or at least some of the information regarding untrustworthy sources in the black-list data store. ### Claim 5 (depends on 2) The computer system of claim 2 further comprising a white-list data store comprising information regarding trustworthy sources, and wherein the computer system determines the trustworthiness by determining whether the source of the user-modifiable file, as described in the tagging information, is found in the white-list data store. ### Claim 6 (depends on 5) The computer system of claim 5, wherein at least one rule stored in the rules data store and/or at least some of the information regarding trustworthy sources in the white-list data store is configurable by a user of the computer system. ### Claim 7 (depends on 1) The computer system of claim 1, wherein a file is stored in a file system as one or more separate data streams in the file system, and wherein the operating system is configured to tag the user-modifiable file with the tagging information by storing information regarding the source of the user-modifiable file as one of the one or more separate data streams. ### Claim 8 (depends on 1) The computer system of claim 1, wherein a file is stored as one or more records in a file system database, and wherein the operating system is configured to tag the user-modifiable file with the tagging information by storing information regarding the source of the user-modifiable file as one of the one or more records in the file system database. ### Claim 9 (depends on 1) The computer system of claim 1 further comprising an obtained files tag store for storing tagging information corresponding to each obtained file on the computer system, and wherein the operating system is configured to tag the user-modifiable file with the tagging information by storing information regarding the source of the user-modifiable file in the obtained files tag store. ### Claim 10 (depends on 1) The computer system of claim 1, wherein the computer system is further configured to identify the source of the user-modifiable file based at least in part on information regarding the external location from which the user-modifiable file is obtained. ### Claim 11 (depends on 1) The computer system of claim 1, wherein the at least one application-callable operating system function is selected from a group consisting of: copy and download. ### Claim 12 A method for enhancing the security of a computing device comprising an operating system, the method comprising: obtaining, by at least one application-callable operating system function, a first user-modifiable file from a first external source; upon obtaining the first user-modifiable file, generating, by the at least one application-callable operating system function that obtains the first file, tagging information identifying a source of the first user-modifiable file; tagging, by the at least one application-callable operating system function that obtains the first user-modifiable file, the first user-modifiable file with the tagging information identifying a source of the first user-modifiable file; obtaining, by an application running on the computing device, a second user-modifiable file from a second external source, the second user-modifiable file obtained independent of calling the at least one application-callable operating system; and tagging, by the application that obtains the second user-modifiable file, the second user-modifiable file with tagging information identifying a source of the second user-modifiable file. ### Claim 13 (depends on 12) The method of claim 12 further comprising: determining a trustworthiness of at least one of the first user-modifiable file or the second user-modifiable file according to the tagging information; and processing the at least one of the first user-modifiable file or the second user-modifiable file according to predetermined rules based on the trustworthiness. ### Claim 14 (depends on 13) The method of claim 13, wherein determining the trustworthiness comprises comparing the tagging information to a white-list of trustworthy sources. ### Claim 15 (depends on 14) The method of claim 14, wherein determining the trustworthiness further comprises comparing the tagging information to a black-list of untrustworthy sources. ### Claim 16 (depends on 12) The method of claim 12, wherein tagging at least one of the first user-modifiable file or the second user-modifiable file with tagging information comprises storing an origin of the at least one of the first user-modifiable file or the second user-modifiable file in an alternate data stream of the at least one of the first user-modifiable file or the second user-modifiable file. ### Claim 17 (depends on 12) The method of claim 12, wherein the tagging information comprises at least one information item selected from a group consisting of: a Uniform Resource Identifier of at least one of the first user-modifiable file or the second user-modifiable file, an author of the at least one of the first user-modifiable file or the second user-modifiable file, and a domain from which the at least one of the first user-modifiable file or the second user-modifiable file was obtained. ### Claim 18 (depends on 12) The method of claim 12, further comprising: identifying at least one of the source of the first user-modifiable file or the second user-modifiable file based at least in part on information regarding a corresponding one of the first external location or the second external location. ### Claim 19 At least one computer-readable storage device having encoded thereon instructions that, when executed by a processor, implement: an operating system comprising a plurality of application-callable functions for obtaining content from external locations, wherein each of the plurality of application-callable functions for obtaining content from external locations is configured to: upon obtaining a user-modifiable file from an external location, generate tagging information comprising a source of the user-modifiable file; and associate with the user-modifiable file the tagging information comprising the source of the user-modifiable file. ### Claim 20 (depends on 19) The computer-readable storage device of claim 19, wherein the operating system associates tagging information with each corresponding user-modifiable file by storing the tagging information in an alternate data stream associated with the corresponding user-modifiable file. ### Claim 21 (depends on 19) The computer-readable storage device of claim 19, wherein the operating system is further configured to process the user-modifiable file according to predetermined rules based on a trustworthiness of the user-modifiable file, and wherein the trustworthiness is determined according to the tagging information and at least one list identifying a source with the trustworthiness. ### Claim 22 (depends on 21) The computer-readable storage device of claim 21, wherein at least one of the predetermined rules and/or the at least one list is dynamically updated by an anti-malware component. ### Claim 23 (depends on 21) The computer-readable storage device of claim 21, wherein at least one of the predetermined rules and/or the at least one list is configurable by a user. ### Claim 24 (depends on 19) The computer-readable storage device of claim 19, wherein the operating system is further configured to identify the source of the user-modifiable file based at least in part on information regarding the external location from which the user-modifiable file is obtained.