`Edery et a].
`
`(10) Patent N0.:
`(45) Date of Patent:
`
`US 8,079,086 B1
`*Dec. 13, 2011
`
`US008079086B1
`
`5,361,359 A 11/1994 Tajalli et a1. .................. .. 726/23
`(Continued)
`
`Ep
`EP
`
`FOREIGN PATENT DOCUMENTS
`1091276
`4/2001
`1132796
`9/2001
`OTHER PUBLICATIONS
`
`Zhong, et 211., “Security in the Large: is Java’s Sandbox Scalable?,”
`Seventh IEEE Symposium on Reliable Distributed Systems, pp. 1-6,
`Oct: 1998'
`
`(Continued)
`
`Primary Examiner * Christopher Revak
`(74) Attorney, Agent, or Firm * Dawn-Marie Bey; King &
`Spalding LLP
`ABSTRACT
`(57)
`Protection systems and methods provide for protecting one or
`more personal computers (“PCs”) and/or other intermittently
`or persistently network accessible devices or processes from
`undesirable or otherwise malicious operations of Java TN
`applets, ActiveXTM controls, JavaScriptTM scripts, Visual
`Basic scripts, add-ins, downloaded/uploaded programs or
`other “DoWnloadables” or “mobile code” in Whole or part. A
`protection engine embodiment provides, Within a server, ?re
`Wall or _Other sultable recommumcatq’ for momwng
`information received by the communicator, determimng
`Whether received information does or is likely to include
`.
`.
`.
`executable code, and if so, causes mobile protection code
`(MPC) to be transferred to and rendered operable Within a
`destination device of the received information, more suitably
`.
`.
`.
`.
`.
`by forming a protection agent including the MPC, protection
`.
`.
`.
`policies and a detected-DoWnloadable. An MPC embodiment
`further provides, Within a DoWnloadable-destination, for ini
`timing the Downloadable’ enabling malicious Downloadable
`operation attempts to be received by the MPC, and causing
`(predetermined) corresponding operations to be executed in
`response to the attempts, more suitably in conjunction With
`protection policies.
`
`-
`
`,,
`
`-
`
`-
`
`-
`
`t,
`
`42 Claims, 10 Drawing Sheets
`
`(54) MALICIOUS MOBILE CODE RUNTIME
`MONITORING SYSTEM AND METHODS
`(75) Inventors: Yigal Mordechai Edery, Pardesia (1L);
`Nimrod Itzhak Vered, Goosh Tel-Mond
`(IL); David R Kl‘Oll, San Jose, CA (US);
`Shl0m0 T0ub0ul, Kefar-Haim (1L)
`(73) Assignee: Finjan, Inc., San Jose, CA (US)
`( * ) Notice:
`Subject to any disclaimer, the term of this
`patent is extended or adjusted under 3 5
`U.S.C. 154(b) by 0 days.
`This patent is subject to a terminal dis-
`Claimer'
`(21) Appl.No.: 12/471,942
`(22) Filedi
`May 26, 2009
`Related U-s- Application Data
`(63) Continuation of application No. 11/370,114, ?led on
`Mar. 7, 2006, noW Pat. No. 7,613,926, Which is a
`Commuanon of appl1cat1on NO‘ 09/861329}??? on
`Mail, 17’t_200_1’ ngrvtv P?‘ N10] 7t’_058’I\8I22’0g/513C9 6127a
`g’ndmua lon'ln'p
`O app lea Ion 0'
`’hi I;
`_ e on Mar‘ 3,0’ 2000’ 119W Pat'NO' 6’804’780’ W C
`15 a Connnuanon of appl1cat1on NO‘ 08/964388’ ?le?
`on 1N0?‘ 6iI19O997/E6I1OZVZ9PZ‘L Not‘, 6’292’194’ 21:11 f
`appllca lon 0'
`/
`’
`1S 250511 mua lon'ln'p
`0
`app lgailog N343?) 32302’ e on Apr‘ 18’ 2000’
`(60) Provisional appl1cat1on No. 60/205,591, ?led on May
`17 2000
`’
`(51) Int. Cl.
`G06F 21/00
`G06F 11/30
`
`noW a. o.,_ ,_
`
`.
`
`(2006 01)
`(200601)
`'
`(2006.01)
`
`G06F 15/16
`
`(2006.01)
`H04L 9/32
`726/24_ 713/175 713/176
`(52) U 5 Cl
`’
`’
`_'
`'
`' """ "_' """ "_ """" "
`(58) Field of ~Classi?cation Search ............. ..: ...... .. None
`See appl1cat1on ?le for Complete Search hlstory'
`References Cited
`
`(56)
`
`US. PATENT DOCUMENTS
`
`5,077,677 A 12/1991 Murphy et a1. ............... .. 706/62
`5,359,659 A 10/1994 Rosenthal ..................... .. 726/24
`
`Farm 1 prumlctbn agent min on mobile
`pmecmn code, poMrl?ul-Duwnluldahl
`(nuw I dellnad-Dawnloadmle) . my
`pn'mection paliulet
`
`Cause we wot-mien learnt in he delivered
`I: ma \nmrm-wn-nnnnnion
`
`
`
`US 8,079,086 B1
`Page 2
`
`US. PATENT DOCUMENTS
`
`5/1995 Hershey et al. ............... .. 726/22
`5,414,833 A
`1/1996 Gupta et al.
`726/25
`5,485,409 A
`1/1996 Chess et al. .
`714/38
`5,485,575 A
`5,572,643 A 11/1996 Judson ...... ..
`. 709/218
`5,579,509 A 11/1996 Furtney et al.
`703/27
`5,606,668 A
`2/1997 Shwed
`726/13
`5,623,600 A
`4/1997 Jiet al. .
`726/24
`5,638,446 A
`6/1997 Rubin .... ..
`705/51
`5,675,711 A 10/1997 Kephart et al.
`706/12
`5,692,047 A 11/1997 McManis
`. 713/167
`5,692,124 A 11/1997 Holden et al.
`726/2
`5,720,033 A
`2/1998 Deo .......... ..
`.. 726/2
`5,724,425 A
`3/1998 Chang et al. .................. .. 705/52
`5,740,248 A
`4/1998 Fieres et al. ................ .. 713/156
`5,740,441 A
`4/1998 Yellin et al.
`. 717/134
`5,761,421 A
`6/1998 van Hoffet al.
`. 709/223
`5,765,205 A
`6/1998 Breslau etal.
`. 711/203
`5,784,459 A
`7/1998 Devarakonda et al.
`. 713/165
`5,796,952 A
`8/1998 Davis et al. ...... ..
`. 709/224
`5,805,829 A
`9/1998 Cohen et al.
`. 709/202
`5,832,208 A 11/1998 Chen et al. ..
`726/24
`5,832,274 A 11/1998 Cutler et al. ................ .. 717/171
`5,850,559 A 12/1998 Angelo et al. .............. .. 713/320
`5,859,966 A
`1/1999 Hayman et al.
`726/23
`5,864,683 A
`1/1999 Boebert et al. .
`. 709/249
`5,881,151 A
`3/1999 Yamamoto ..
`726/24
`5,884,033 A
`3/1999 Duvallet al. ..
`. 709/206
`5,892,904 A
`4/1999 Atkinson et al.
`726/22
`5,951,698 A
`9/1999 Chen et al.
`714/38
`5,956,481 A
`9/1999 Walsh etal.
`726/23
`5,963,742 A 10/1999 Williams .................... .. 717/143
`5,974,549 A 10/1999 Golan ........................... .. 726/23
`5,978,484 A 11/1999 Apperson et al.
`705/54
`5,983,348 A 11/1999 Ji .............. ..
`726/13
`5,987,611 A 11/1999 Freund
`.. 726/4
`6,088,801 A
`7/2000 Grecsek
`726/1
`6,088,803 A
`7/2000 Tso et al. .
`726/22
`6,092,194 A *
`7/2000 Touboul .... ..
`726/24
`6,154,844 A * 11/2000 Touboulet al
`726/24
`6,167,520 A * 12/2000 Touboul .... ..
`726/23
`6,339,829 B1
`1/2002 Beadle et al.
`726/15
`6,425,058 B1
`7/2002 Arimilliet al.
`. 711/134
`6,434,668 B1
`8/2002 Arimilliet al.
`. 711/128
`6,434,669 B1
`8/2002 Arimilliet al. ............. .. 711/128
`6,480,962 B1* 11/2002 Touboul ........................ .. 726/22
`6,487,666 B1
`11/2002 Shanklin et al.
`726/23
`6,519,679 B2
`2/2003 Devireddy et al.
`. 711/114
`6,598,033 B2
`7/2003 Ross etal.
`706/46
`6,732,179 B1
`5/2004 Brown et al.
`. 709/229
`6,804,780 B1* 10/2004 Touboul .... ..
`. 713/181
`6,917,953 B2
`7/2005 Simon et al.
`. 707/204
`7,058,822 B2* 6/2006 Edery et al. .
`726/22
`7,143,444 B2 11/2006 Porras et al. .................. .. 726/30
`7,210,041 B1
`4/2007 Gryaznov etal. ........... .. 713/188
`7,308,648 B1
`12/2007 Buchthalet al.
`. 715/234
`7,343,604 B2
`3/2008 Grabarnik et al. .
`. 719/313
`7,418,731 B2
`8/2008 Touboul ....... ..
`726/22
`7,613,926 B2* 11/2009 Edery et al. .
`. 713/181
`7,647,633 B2* 1/2010 Edery et al. .
`726/22
`2003/0014662 A1
`1/2003 Gupta et al.
`726/23
`2003/0101358 A1
`5/2003 Porras et al.
`726/4
`2004/0073811 A1
`4/2004 Sanin ............................ .. 726/13
`2004/0088425 A1
`5/2004 Rubinstein et al. ......... .. 709/230
`2005/0050338 A1
`3/2005 Liang et al.
`. 713/188
`2005/0172338 A1
`8/2005 Sandu et al.
`726/22
`2006/0031207 A1
`2/2006 Bjarnestam et al.
`707/3
`2006/0048224 A1
`3/2006 Duncan et al. ..
`726/22
`2008/0066160 A1
`3/2008 Becker et al. ..
`726/4
`2010/0195909 A1
`8/2010 Wasson et al. .............. .. 382/176
`
`OTHER PUBLICATIONS
`
`Rubin, et al., “Mobile Code Security,” IEEE Internet, pp. 30-34, Dec.
`1998.
`Schmid, et al. “Protecting Data From Malicious Software,” Proceed
`ing of the 18th Annual Computer Security Applications Conference,
`pp. 1-10, 2002.
`
`Corradi, et al., “A Flexible Access Control Service for Java Mobile
`Code,” IEEE, pp. 356-365, 2000.
`International Search Report for Application No. PCT/IB97/01626, 3
`pp., May 14, 1998 (mailing date).
`International Search Report for Application No. PCT/ IL05/ 00915, 4
`pp., dated Mar. 3, 2006.
`Written Opinion for Application No. PCT/ IL05/ 00915, 5 pp., dated
`Mar. 3, 2006 (mailing date).
`International Search Report for Application No. PCT/IB01/01 138, 4
`pp., Sep. 20, 2002 (mailing date).
`International Preliminary Examination Report for Application No.
`PCT/IB01/01138, 2 pp., dated Dec. 19,2002.
`Gerzic, Amer, “Write Your Own Regular Expression Parser,” Nov.
`17, 2003, 18 pp.
`Power, James, “Lexical Analysis,” 4 pp., May 14, 2006.
`Sitaker, Kragen, “Rapid Genetic Evolution of Regular Expressions”
`[online], The Mia/Archive, Apr. 24, 2004 (retrieved on Dec. 7, 2004),
`5 pp.
`“Lexical Analysis: DFA Minimization & Wrap Up” [online], Fall,
`2004 [retrieved on Mar. 2, 2005], 8 pp.
`“Minimization of DFA” [online], [retrieved on Dec. 7, 2004], 7 pp.
`“Algorithm: NFS -> DFA” [online], Copyright 1999-2001 [retrieved
`on Dec. 7, 2004], 4 pp.
`“CS 3813: Introduction to Formal Languages and AutomataiState
`Minimization and OtherAlgorithms for Finite Automata,” 3 pp., May
`11, 2003.
`Watson, Bruce W., “Constructing Minimal Acyclic Deterministic
`Finite Automata,” [retrieved on Mar. 20, 2005], 38 pp.
`Chang, Chia-Hsiang, “From Regular Expressions to DFA’s Using
`Compressed NFA’s,” Oct. 1992, 243 pp.
`“Products,” Articles published on the Internet, “Revolutionary Secu
`rity for a New Computing Paradigm” regarding Sur?nGateTM, 7 pp.
`“Release Notes for the Microsoft ActiveX Development Kit,” Aug.
`13, 1996, activex.adsp.orjp/inetsdk/readmetxt, pp. 1-10.
`Doyle, et al., “Microsoft Press Computer Dictionary,” Microsoft
`Press, 2d Edition, pp. 137-138, 1993.
`Finjan Software Ltd., “Powerful PC Security for the New World of
`JavaTM and Downloadables, Sur?n ShieldTM,” Article published on
`the Internet by Finjan Software Ltd., 2 pp. 1996.
`Finjan Sofrtware Ltd., “FinjanAnnounces a Personal JavaTM Firewall
`for Web Browsersithe Sur?nShieldTM 1.6 (formerly known as
`Sur?nBoard),” Press Release of Finjan Releases Sur?nShield 1.6, 2
`pp., Oct. 21, 1996.
`Finjan Software Ltd., “Finjan Announces Major Power Boost and
`New Features for Sur?nShieldTM 2.0,” Las Vegas Convention Center/
`Pavillion 5 P5551, 3 pp., Nov. 18, 1996.
`Finjan Software Ltd., “Finjan Software Releases Sur?nBoard, Indus
`try’s First JAVA Security Product for the World Wide Web,” Article
`published on the Internet by Finjan Software Ltd., 1 p., Jul. 29, 1996.
`Finjan Software Ltd., “Java Security: Issues & Solutions,” Article
`published on the Internet by Finjan Software Ltd., 8 pp. 1996.
`Finjan Software Ltd., Company Pro?le, “FinjaniSafe Sur?ng, The
`Java Security Solutions Provider,” Article published on the Internet
`by Finjan Software Ltd., 3 pp., Oct. 31, 1996.
`“IBM AntiVirus User’s Guide, Version 2.4,”, International Business
`Machines Corporation, pp. 6-7, Nov. 15, 1995.
`Khare, R., “Microsoft Authenticode Analyzed” [online], Jul. 22,
`1996 [retrieved on Jun. 25, 2003], 2 pp.
`LaDue, M., Online Business Consultant: Java Security: Whose Busi
`ness is It?, Article published on the Internet, Home Page Press, Inc.,
`4 pp., 1996.
`Leach, Norvin, et al., “IE 3.0 Applets Will Earn Certi?cation,” PC
`Week, vol. 13, No. 29, 2 pp., Jul. 22, 1996.
`Moritz, R., “Why We Shouldn’t Fear Java,” Java Report, pp. 51-56,
`Feb. 1997.
`Microsoft, “MicrosoftActiveX Software Development Kit” [online],
`Aug. 12, 1996 [retrieved on Jun. 25, 2003], pp. 1-6.
`Microsoft® Authenticode Technology, “Ensuring Accountability
`and Authenticity for Software Components on the Internet,”
`Microsoft Corporation, Oct. 1996, including Abstract, Contents,
`Introduction, and pp. 1-10.
`
`
`
`US 8,079,086 B1
`Page 3
`
`Microsoft Corporation, Web Page Article “Frequently Asked Ques
`tions About Authenticode,” last updated Feb. 17, 1997, printed Dec.
`23, 1998, pp. 1-13.
`Okamoto, E., et al., “ID-Based Authentication System for Computer
`Virus Detection,” IEEE/IEE Electronic Library online, Electronics
`Letters, vol. 26, Issue 15, ISSN 0013-5194, Jul. 19, 1990, Abstract
`and pp. 1169-1170.
`Omura, J. K., “Novel Applications of Cryptography in Digital Com
`munications,” IEEE Communications Magaine, pp. 21-29, May
`1990.
`
`Schmitt, D.A., “.EXE ?les, OS-2 style,”PC Tech Journal, vol. 6, No.
`11, p. 76(13), Nov. 1988.
`Zhang, X. N., “Secure Code Distribution,” IEEE/IEE Electronic
`Library online, Computer, vol. 30, Issue 6, pp. 76-79, Jun. 1997.
`D. Grune, et al., “Parsing Techniques: A Practical Guide,” John Wiley
`& Sons, Inc., NeWYork, New York, USA, pp. 1-326, 2000.
`Power, James, “Notes on Formal Language Theory and Parsing,”
`National University of Ireland, pp. 1-40, 1999.
`
`* cited by examiner
`
`
`
`US. Patent
`
`Dec. 13, 2011
`
`Sheet 1 0f 10
`
`US 8,079,086 B1
`
`100
`
`Redundanc Su ort
`V
`pp
`Subsystem-1
`(Sandbox Protected)
`
`Subsystem-N
`(Unprotected)
`
`subsystemM
`(Protected)
`
`102
`ResourceServer-1 W
`121
`Resource-1 W/
`
`ResourceServer-N
`
`103
`W
`131
`?/
`132
`Resource-M
`Reswce‘" W
`
`FIG. 121
`
`10421
`
`104b
`
`140a
`ISP-Server W
`
`141b
`w\ Server
`
`Protection Engine
`(PE)
`
`<—
`D
`
`141b
`
`Corporate Server
`_
`\ Sewer _ F|rewall
`
`140D
`W143
`f”
`
`PE
`
`PE
`
`4
`D
`
`iMPQD
`
`145a i- _____ "I ______ n
`
`User W145
`Device-n
`146
`
`Client
`
`i
`
`~—
`
`142a
`
`142D
`
`142b
`
`MPC,D
`/
`
`145%‘ User
`Device-n
`146
`\“ Client
`
`MPC,D
`a
`
`User W145
`Device-n
`146
`
`Client
`
`FIG. 1b
`
`FIG. 1c
`
`
`
`US. Patent
`
`Dec. 13, 2011
`
`Sheet 2 0f 10
`
`US 8,079,086 B1
`
`mom K
`
`mam \\
`
`
`
`0333M $39200
`
`
`
`0333M EEQEQU
`
`
`
`
`
`63oz 838E uwSoHm
`
`
`
`mEEwoE GEO
`
`
`
`D0822 ma?a?
`
`
`
`@0225 :55
`
`mas \\
`
`Nam \\
`
`KEN
`
`v/
`
`
`
`U.S. Patent
`
`Dec. 13, 2011
`
`01f03LI.6ehS
`
`US 8,079,086 B1
`
`=o:m:.:o._S
`
`\oE8:ouxm.:oZv
`
`
`
`3::Bnfiaooxm
`
`__m>>w.__n_
`
`
`
`nuzooomo_....m~un..._10xm_
`
`:o_.o2o.n.
`
`mi256
`
`
`
`U.S. Patent
`
`Dec. 13, 2011
`
`Sheet 4 of 10
`
`US 8,079,086 B1
`
`
`
`
`
`mmnotmscomfl5&0.505cumgun.u2u2o._n_
`
`w.E.%2=_5:3.35
`
`wmflouw
`
`.o~>_m:<
`
`:o=m.u=cuE:<
`
`
`
`_ouU0_.0Q0000
`
`Lmumom
`
`
`
`2_9_w.coauflmo
`
`_.~vNmv
`
`
`
`Ewan.co=oo%c_oifiauoxuuoz
`
`
`
`:o=mF:o+:_6.00E._m:m.._.
`
`
`
`E.2_Ss_2_9m_msmcm
`
`.8m.o:o0=§,.<A__mvmwvm:...n
`
`ovm
`
`PIIIIIIIIIIIIIII
`
`III
`III
`II
`
`IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII
`
`mo_o=on_
`
`:o=mu._E0£:<__
`§_._zumm
`
`
`
`U.S. Patent
`
`Dec. 13, 2011
`
`01f05LI.6ehS
`
`US 8,079,086 B1
`
`22oEflmuQEmfiflaouxw
`
`_9m=:_
`
`.uw.mv.m._&
`
`commmuoa
`
`
`
`
`
`m..2oEEmn_ouooofiflzooxwma?2E
`
`
`
`w._oEEw_mmEm:.m:.u$u.
`
`mmo
`
`
`
`
`
`22oEEan_Emsma._8o9on_
`
`
`
`m_EwEm..waEflmaw
`
`1|.llI.Y_E250
`.|I:In.l|._
`
`
`
`
`
`w_w~mEm_mm_m_m:m.U._o..o2m.D
`
`
`
`m.E...EEmn_8mtmE_
`
`E50,:
`
`
`
`.ouu..u:o0o:_m:m
`
`.:au<8.._2mca._._.oh
`
`
`
`m.._.=._:0...
`
`m:_u:m
`
`,.E
`
`fiwamufioa
`
`x.n_.s_h....0568.2
`.8&_~
`
`
`asmcm9__._.._:x.n_-s_
`
`
`
`.uv_c_._._ommouc._..
`
`comwwaEeoV.._,«._
`
`m_E
`
`um:
`
`5.05.
`
`\\.\283E
`
`
`
`US. Patent
`
`Dec. 13, 2011
`
`Sheet 6 0110
`
`US 8,079,086 B1
`
`700
`
`340
`\N
`
`701
`J
`Memory Space-N
`
`702
`W
`Memory Spaces-P1 and P2
`
`Protection
`343
`Agent
`146
`2 R Destination
`MW 0" )
`
`4} Resources
`711
`+
`C
`Sandbox Engine
`M Initiator
`(JVM) V
`N w
`341
`721
`
`POL
`
`342
`
`FIG. 7a
`
`703
`704
`W W
`Memory Space-P1
`Memory Space~P2
`‘
`_
`342
`343
`@E-h/
`731
`341
`
`341
`
`\N
`
`801
`///802
`Package Extractor
`803
`Executable installer
`Sandbox Engine Installer 4/ 8o 4
`Resource Access Diverter W805
`Resource Access Analyzer 14/ 806
`Policy Enforcer
`4/807
`MP0 De-lnstaller W
`
`FIG. 7b
`
`FIG. 8
`
`
`
`U.S. Patent
`
`Dec. 13, 2011
`
`01f07LI.6ehS
`
`US 8,079,086 B1
`
`
`
`r5...............................................m"..---..a.mu_._...w...wmm.m.amm...m---...u.E_.E2uu::«
`
`
`
`
`
`coumccmwv:o=mE.=E:_
`
`
`
`.._m_nmumo_Esoo-_m_E9o...flu
`
`cosfiouo
`
`
`
`
`
`.UU~UU«D._n_mm:_>w:co.auc....n¢_c_uluuum
`
`
`
`n._o>._..vw.m.£._ofi.u_::EE0...Yu.».2_:o_2
`
`
`
`
`
`
`
`
`
`.o.mhAm_c_E_.u¢...$.:u__w..__.£.6._....._m:c£oa9:.w£mE>..m:_::u.mo
`
`
`
`
`
`
`
`u_n_mUwo_:3oD-.m.acm.0Q69.50
`
`menonU@._.0>=WUWD0..
`
`m5
`
`ozpmuao
`
`..wm.n.:.Uc.
`
`nu.r
`
`
`
`:o_.m::mu.u.:o:mE.£:_0.5052nmutoo.:um..wtoaoouoga_mF_.:Un_
`
`
`
`
`
`
`
`
`
`m_nmUmo_r§>DDu_m_ur_m..on_fiuoo.._o_uum.oE
`
`xcm+Am._nmumo_:3oD-u3uu.o_um265
`
`
`
`mm_u__oncozuwuoa
`
`
`
`:o=.w:=.muD-:o_:mE._O__:_m59Um.._w>__w_umm.onEwancozumuoi05mmamu
`
`
`
`0.900@mDW«—.._UWXU.WU.U3_UC_U_nuflUW°_.C>?Oo
`
`
`
`
`
`
`
`U.S. Patent
`
`Dec. 13, 2011
`
`LI.6ehS
`
`01f000
`
`US 8,079,086 B1
`
`
`
`
`
`E8.ucmm.2mEm.macozofioaw>mEwm
`
`
`
`
`
`
`
`m52mc_Eooomwuouco_.om.o.am_5oE
`
`m§wEm_ma
`
`
`
`
`
`E8.ucmm._8mEm.mncozofloaw>mEmm
`
`
`
`
`
`m59m£Eooommm_o__oqco_.om.o._a
`
`22wEm._ma
`
`
`
`
`
`dvoocozomzoam__n_oE9:29.00
`
`
`
`
`
`-um>_oom._ucmmw_o__oacozofloa
`
`
`
`.m.$EmmacozoflofiwE._£2:o_HmE.o_c_
`
`
`
`
`
`€.__£EEaficoowmww_o__oa_.mEOn=>_
`
`E:.wE
`
`<3.UH.m
`
`
`
`
`
`duosw_nmSowxmmmu:_uc_
`
`m5mumo_:>>oa-u2o£wumo_nmumo_§>on_-_m_EwEqm5._mu_w:oo
`
`
`
`-_m_E2oa9:.m£mE>m:_c.:Emo
`
`
`
`mzflsomxmcmw$mo_nc_m_nmumo_Eson_
`
`25mE
`
`
`
`mEmEoomems._m£m_.._>>w:_E._m.wo
`
`
`
`
`
`mcanma2.00.o:o=mE_oE_Ewesmc:_o:_
`
`9:E598_E_88En593%:
`
`
`
`
`
`29:.m._oEm_nmumo_Eson_._m_E2oa
`
`
`
`US. Patent
`
`Dec. 13, 2011
`
`Sheet 9 0f 10
`
`US 8,079,086 B1
`
`lnstall mobile protection code elements /V1101
`and policies within a destination device
`I
`Y
`-
`1102
`Load the downioadble without actually W
`initiating it
`l
`V
`
`Form an access interceptor for intercepting
`downloadable destination device access
`attempts within the destination device
`
`1103
`
`1105
`i
`Initiate the Downloadable within the W
`destination device
`
`No
`
`Yes
`
`Determine policies in accordance with the /,/1 109
`access attempt
`i
`Execute the policies (including causing an
`allowable response expected by the A111
`Donwloadable to be returned to the
`Downloadable)
`
`FIG. 11
`
`
`
`U.S. Patent
`
`Dec. 13, 2011
`
`01r1001LI.eehS
`
`US 8,079,086 B1
`
`
`
`«Nu.UHm
`
`:26:.
`
`
`
`muooco=o9oa
`
`_n_<B5829:m_>
`
`
`
`>o__on_mmEE._2m._u2mw_u__oauo._2m>530
`
`o_n_m_umo_Eson_oz.2mcficoamwtoo
`
`$039wmmoom
`
`
`
`
`
`#8252wwmoomm_gmumo_Esoomwaauwm
`
`m_nmnmo_Eson_m5__m.mc_
`
`
`
`tmzu9_n_<m_n...umo_sson_9:E_Uo_>_
`
`
`
`
`
`o__noE9:9flmmzcw.mmmoumm:o_o__mE
`
`
`
`US 8,079,086 B1
`
`1
`MALICIOUS MOBILE CODE RUNTIME
`MONITORING SYSTEM AND METHODS
`
`PRIORITY REFERENCE TO RELATED
`APPLICATIONS
`
`This application is a continuation of assignee’ s application
`Ser. No. 11/370,114, ?led Mar. 7, 2006, now US. Pat. No.
`7,613,926, entitled “Method and System for Protecting a
`Computer and a Network from Hostile Downloadables,”
`which is a continuation of Ser. No. 09/ 861,229, ?led on May
`17, 2001, now US. Pat. No. 7,058,822, entitled “Malicious
`Mobile Code Runtime Monitoring System And Methods”, all
`of which are hereby incorporated by reference. U.S. applica
`tion Ser. No. 09/861,229 claims bene?t of provisional appli
`cation Ser. No. 60/205,591, entitled “Computer Network
`Malicious Code Run-time Monitoring,” ?led on May 17,
`2000 by inventors Nimrod ItZhak Vered, et al., which is
`hereby incorporated by reference. US. application Ser. No.
`09/861,229 is also a Continuation-In-Part of US. patent
`application Ser. No. 09/539,667, entitled “System and
`Method for Protecting a Computer and a Network From Hos
`tile Downloadables” ?led on Mar. 30, 2000 by inventor
`Shlomo Touboul, now US. Pat. No. 6,804,780, and hereby
`incorporated by reference, which is a continuation of assign
`ee’s US. patent application Ser. No. 08/964,388, ?led on
`Nov. 6, 1997, now US. Pat. No. 6,092,194, also entitled
`“System and Method for Protecting a Computer and a Net
`work from Hostile Downloadables” and hereby incorporated
`by reference. U.S. Ser. No. 09/ 861 ,229 is also a Continuation
`In-Part of US. patent application Ser. No. 09/551,302,
`entitled “System and Method for Protecting a Client During
`Runtime From Hostile Downloadables”, ?led on Apr. 18,
`2000 by inventor Shlomo Touboul, now US. Pat. No. 6,480,
`962, which is hereby incorporated by reference.
`
`20
`
`25
`
`30
`
`35
`
`BACKGROUND OF THE INVENTION
`
`40
`
`1. Field of the Invention
`This invention relates generally to computer networks, and
`more particularly provides a system and methods for protect
`ing network-connectable devices from undesirable down
`loadable operation.
`2. Description of the Background Art
`Advances in networking technology continue to impact an
`increasing number and diversity of users. The Internet, for
`example, already provides to expert, intermediate and even
`novice users the informational, product and service resources
`of over 100,000 interconnected networks owned by govem
`ments, universities, nonpro?t groups, companies, etc. Unfor
`tunately, particularly the Internet and other public networks
`have also become a major source of potentially system-fatal
`or otherwise damaging computer code commonly referred to
`as “viruses.”
`Efforts to forestall viruses from attacking networked com
`puters have thus far met with only limited success at best.
`Typically, a virus protection program designed to identify and
`remove or protect against the initiating of known viruses is
`installed on a network ?rewall or individually networked
`computer. The program is then inevitably surmounted by
`some new virus that often causes damage to one or more
`computers. The damage is then assessed and, if isolated, the
`new virus is analyZed. A corresponding new virus protection
`program (or update thereof) is then developed and installed to
`combat the new virus, and the new program operates success
`65
`fully until yet another new virus appearsiand so on. Of
`course, damage has already typically been incurred.
`
`45
`
`50
`
`55
`
`60
`
`2
`To make matters worse, certain classes of viruses are not
`well recogniZed or understood, let alone protected against. It
`is observed by this inventor, for example, that Downloadable
`information comprising program code can include distribut
`able components (eg JavaTM applets and JavaScript scripts,
`ActiveXTM controls, Visual Basic, add-ins and/or others). It
`can also include, for example, application programs, Trojan
`horses, multiple compressed programs such as Zip or meta
`?les, among others. US. Pat. No. 5,983,348 to Shuang, how
`ever, teaches a protection system for protecting against only
`distributable components including “Java applets or ActiveX
`controls”, and further does so using resource intensive and
`high bandwidth static Downloadable content and operational
`analysis, and modi?cation of the Downloadable component;
`Shuang further fails to detect or protect against additional
`program code included within a tested Downloadable. US.
`Pat. No. 5,974,549 to Golan teaches a protection system that
`further focuses only on protecting against ActiveX controls
`and not other distributable components, let alone other
`Downloadable types. US. Pat. No. 6,167,520 to Touboul
`enables more accurate protection than Shuang or Golan, but
`lacks the greater ?exibility and ef?ciency taught herein, as do
`Shuang and Golan.
`Accordingly, there remains a need for e?icient, accurate
`and ?exible protection of computers and other network con
`nectable devices from malicious Downloadables.
`
`SUMMARY OF THE INVENTION
`
`The present invention provides protection systems and
`methods capable of protecting a personal computer (“PC”) or
`other persistently or even intermittently network accessible
`devices or processes from harmful, undesirable, suspicious or
`other “malicious” operations that might otherwise be effec
`tuated by remotely operable code. While enabling the capa
`bilities of prior systems, the present invention is not nearly so
`limited, resource intensive or in?exible, and yet enables more
`reliable protection. For example, remotely operable code that
`is protectable against can include downloadable application
`programs, Trojan horses and program code groupings, as well
`as software “components”, such as JavaTM applets,
`ActiveXTM controls, JavaScriptTM/Visual Basic scripts, add
`ins, etc., among others. Protection can also be provided in a
`distributed interactively, automatically or mixed con?gurable
`manner using protected client, server or other parameters,
`redirection, local/remote logging, etc., and other server/client
`based protection measures can also be separately and/or
`interoperably utiliZed, among other examples.
`In one aspect, embodiments of the invention provide for
`determining, within one or more network “servers” (e.g. ?re
`walls, resources, gateways, email relays or other devices/
`processes that are capable of receiving-and-transferring a
`Downloadable) whether received information includes
`executable code (and is a “Downloadable”). Embodiments
`also provide for delivering static, con?gurable and/ or exten
`sible remotely operable protection policies to a Download
`able-destination, more typically as a sandboxed package
`including the mobile protection code, downloadable policies
`and one or more received Downloadables. Further client
`based or remote protection code/policies can also be utiliZed
`in a distributed manner. Embodiments also provide for caus
`ing the mobile protection code to be executed within a Down
`loadable-destination in a manner that enables various Down
`loadable operations to be detected, intercepted or further
`responded to via protection operations. Additional server/
`information-destination device security or other protection is
`also enabled, among still further aspects.
`
`
`
`US 8,079,086 B1
`
`3
`A protection engine according to an embodiment of the
`invention is operable Within one or more netWork servers,
`?rewalls or other netWork connectable information re-com
`municating devices (as are referred to herein summarily one
`or more “servers” or “re-communicators”). The protection
`engine includes an information monitor for monitoring infor
`mation received by the server, and a code detection engine for
`determining Whether the received information includes
`executable code. The protection engine also includes a pack
`aging engine for causing a sandboxed package, typically
`including mobile protection code and doWnloadable protec
`tion policies to be sent to a DoWnloadable-destination in
`conjunction With the received information, if the received
`information is determined to be a DoWnloadable.
`A sandboxed package according to an embodiment of the
`invention is receivable by and operable With a remote DoWn
`loadable-destination. The sandboxed package includes
`mobile protection code (“MPC”) for causing one or more
`predetermined malicious operations or operation combina
`tions of a DoWnloadable to be monitored or otherWise inter
`cepted. The sandboxed package also includes protection poli
`cies (operable alone or in conjunction With further
`DoWnloadable-destination stored or received policies/MPCs)
`for causing one or more predetermined operations to be per
`formed if one or more undesirable operations of the DoWn
`loadable is/are intercepted. The sandboxed package can also
`include a corresponding DoWnloadable and can provide for
`initiating the DoWnloadable in a protective “sandbox”. The
`MPC/policies can further include a communicator for
`enabling further MPC/policy information or “modules” to be
`utiliZed and/or for event logging or other purposes.
`A sandbox protection system according to an embodiment
`of the invention comprises an installer for enabling a received
`MPC to be executed Within a DoWnloadable-destination (de
`vice/process) and further causing a DoWnloadable applica
`tion program, distributable component or other received
`doWnloadable code to be received and installed Within the
`DoWnloadable-destination. The protection system also
`includes a diverter for monitoring one or more operation
`attempts of the DoWnloadable, an operation analyZer for
`determining one or more responses to the attempts, and a
`security enforcer for effectuating responses to the monitored
`operations. The protection system can further include one or
`more security policies according to Which one or more pro
`tection system elements are operable automatically (e.g. pro
`grammatically) or in conjunction With user intervention (eg
`as enabled by the security enforcer). The security policies can
`also be con?gurable/extensible in accordance With further
`doWnloadable and/or DoWnloadable-destination informa
`tion.
`A method according to an embodiment of the invention
`includes receiving doWnloadable information, determining
`Whether the doWnloadable information includes executable
`code, and causing a mobile protection code and security
`policies to be communicated to a netWork client in conjunc
`tion With security policies and the doWnloadable information
`if the doWnloadable information is determined to include
`executable code. The determining can further provide mul
`tiple tests for detecting, alone or together, Whether the doWn
`loadable information includes executable code.
`A further method according to an embodiment of the
`invention includes forming a sandboxed package that
`includes mobile protection code (“MPC”), protection poli
`cies, and a received, detected-DoWnloadable, and causing the
`sandboxed package to be communicated to and installed by a
`receiving device or process (“user device”) for responding to
`one or more malicious operation attempts by the detected
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`4
`DoWnloadable from Within the user device. The MPC/poli
`cies can further include a base “module” and a “communica
`tor” for enabling further up/doWnloading of one or more
`further “modules” or other information (eg events, user/user
`device information, etc.).
`Another method according to an embodiment of the inven
`tion includes installing, Within a user device, received mobile
`protection code (“MPC”) and protection policies in conjunc
`tion With the user device receiving a doWnloadable applica
`tion program, component or other DoWnloadable(s). The
`method also includes determining, by the MPC, a resource
`access attempt by the DoWnloadable, and initiating, by the
`MPC, one or more predetermined operations corresponding
`to the attempt. (Predetermined operations can, for example,
`comprise initiating user, administrator, client, netWork or pro
`tection system determinable operations, including but not
`limited to modifying the DoWnloadable operation, extricating
`the DoWnloadable, notifying a user/another, maintaining a
`local/remote log, causing one or more MPCs/policies to be
`doWnloaded, etc.)
`Advantageously, systems and methods according to
`embodiments of the invention enable potentially damaging,
`undesirable or otherWise malicious operations by even
`unknoWn mobile code to be detected, prevented, modi?ed
`and/or otherWise protected against Without modifying the
`mobile code. Such protection is further enabled in a manner
`that is capable of minimiZing server and client resource
`requirements, does not require pre-installation of security
`code Within a DoWnloadable-destination, and provides for
`client speci?c or generic and readily updateable security mea
`sures to be ?exibly and ef?ciently implemented. Embodi
`ments further provide for thWarting efforts to bypass security
`measures (eg by “hiding” undesirable operation causing
`information Within apparently inert or otherWise “friendly”
`doWnloadable information) and/or dividing or combining
`security measures for even greater ?exibility and/or e?i
`ciency.
`Embodiments also provide for determining protection
`policies that can be doWnloaded and/or ascertained from
`other security information (eg broWser settings, administra
`tive policies, user input, uploaded information, etc.). Differ
`ent actions in response to different DoWnloadable operations,
`clients, users and/or other criteria are also enabled, and
`embodiments provide for implementing other security mea
`sures, such as verifying a doWnloadable source, certi?cation,
`authentication, etc. Appropriate action can also be accom
`plished automatically (e.g. programmatically) and/ or in con
`junction With alerting one or more users/ administrators, uti
`liZing user input, etc. Embodiments further enable desirable
`DoWnloadable operations to remain substantially unaffected,
`among other aspects.
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`FIG. 1a is a block diagram illustrating a netWork system in
`accordance With an embodiment of the present invention;
`FIG. 1b is a block diagram illustrating a netWork sub
`system example in accordance With an embodiment of the
`invention;
`FIG. 10 is a block diagram illustrating a further netWork
`sub system example in accordance With an embodiment of the
`invention;
`FIG. 2 is a block diagram illustrating a computer system in
`accordance With an embodiment of the invention;
`FIG. 3 is a How diagram broadly illustrating a protection
`system host according to ru an embodiment of the invention;
`
`
`
`US 8,079,086 B1
`
`5
`FIG. 4 is a block diagram illustrating a protection engine
`according to an embodiment of the invention;
`FIG. 5 is a block diagram illustrating a content inspection
`engine according to an embodiment of the invention;
`FIG. 6a is a block diagram illustrating protection engine
`parameters according to an embodiment of the invention;
`FIG. 6b is a ?ow diagram illustrating a linking engine use
`in conjunction with ordinary, compressed and distributable
`sandbox package utiliZation, according to an embodiment of
`the invention;
`FIG. 7a