`
`U.S. DEPARTMENT OF COMMERCE
`PATENT AND TRADEMARK OFFICE
`FEE RECORD SHEET
`
`PT0-1556
`(5/87)
`
`I
`
`'\
`
`. \
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 1
`
`
`
`BAR CODE LABEL
`
`llllllllllllllllllllllllllllllllllllllllllllllllll
`
`U.S. PATENT APPLICATION
`
`SERIAL NUMBER
`
`FILING DATE
`
`CLASS
`
`GROUP ART UNIT
`
`60/030,639
`PROVISIONAL
`
`ll/08/96
`
`SHLOMO TOUBOUL , KEFAR HAIM , ISRAEL.
`
`**CONTINUING DATA*********************
`VERIFIED
`
`*•FOREIGN/PCT APPLICATIONS************
`VERIFIED
`
`STA TE OR
`COUNTRY
`
`SHEETS
`DRAWING
`
`TOTAL
`CLAIMS
`
`INDEPENDENT
`CLAIMS
`
`FILING FEE
`RECEIVED
`
`A H ORNEY DOCKET NO.
`
`I LX
`
`7
`
`$150 . 00
`
`D-5 58
`
`EPPA HITE
`CARTER DEFILIPPO & FERRELL
`SUITE 200
`2225 EAST BAYSHORE ROAD
`PALO ALTO CA 94303
`
`SYSTEM AND METHOD FOR PROTECTING A COMPUTER FROM HOSTILE
`DOWNLOADABLES
`
`(/)
`(/)
`
`LIJ a:
`0
`0
`<(
`
`LU
`~
`i=
`
`This is t o certify that annexed hereto is a true copy from the records of the United States
`Patent and Trademark Office of t he application wh1ch is identified above.
`By authority of the
`COMMISSIONER OF PATENTS AND TRADEMARKS
`
`Date
`
`Certifying Officer
`
`PALO ALTO NETWORKS Exhibit 1027 Page 2
`
`
`
`jl, ·.·
`
`/11/ 80&/~~39
`PAlE~~~
`
`DOWNLOADABLES
`
`BACKGROUND OF THE INVENTION
`
`5
`
`1.
`
`Field of the Invention
`
`This invention relates generally to computer networks, and
`
`more particularly to a system and method for protecting computers
`
`from hostile Downloadables.
`
`10
`
`2.
`
`Description of the Back~round Art
`
`The Internet is a collection of currently over 100,000
`
`individual computer networks owned by governments, universities,
`
`nonprofit groups and companies, and is expanding at an accelerating
`
`rate. Because the Internet is public, the Internet has become a major
`
`15
`
`source of many system damaging and system fatal application
`
`programs, commonly referred to as "viruses."
`
`Accordingly, programmers continue to design computer
`
`security systems for blocking these viruses from attacking both
`
`individual and network computers. On the most pa.J;t, these security
`
`20
`
`systems have been relatively successful. However, these security
`
`systems are not configured to recognize computer viruses which
`
`have been attached to Downloadable application programs,
`
`-1-
`
`PALO ALTO NETWORKS Exhibit 1027 Page 3
`
`
`
`PATENT
`
`commonly referred to as "applets" or "Downloadables." A
`
`Downloadable is an executable application program which is
`
`automatically downloaded from a source computer and run on the
`
`destination computer. Examples of Downloadables include applets
`
`5
`
`designed for use in the Java™ distributing environment produced by
`
`Sun Microsystems or for use in the Active X distributing
`
`environment produced by Microsoft Corporation. Therefore, a
`
`system and method are needed to protect computers from viruses
`
`attached to
`
`these Downloadables.
`
`-2-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 4
`
`
`
`PATENT
`
`SUMMARY OF THE INVENTION
`
`The present invention provides a system for protecting a
`
`computer from hostile Downloadables. The system comprises an
`
`interface for receiving a Downloadable, a first memory portion
`
`5
`
`storing security policies and a second memory portion storing known
`
`hostile Downloadables. The system further comprises a first
`
`comparator, coupled to the interface and to the first memory portion,
`
`for discarding the received Downloadable when it matches one of the
`
`known hostile Downloadables. The system further comprises a
`
`10
`
`second comparator, coupled to the first comparator and to the second
`
`memory portion, for discarding the received Downloadable if it
`
`violates one of security policies.
`
`The present invention further provides a method for protecting
`
`a computer from hostile Downloadables. The method comprises the
`
`15
`
`steps of receiving a Downloadable, discarding the received
`
`Downloadable when the received Downloadable matches a
`
`predetermined hostile Downloadable, obtaining Downloadable
`
`security profile data on the received Downloadable when the
`
`Downloadable does not match a predetermined hostile Downloadable
`
`20
`
`and discarding the received Downloadable when the Downloadable
`
`security profile data violates a predetermined security policy.
`
`-3-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 5
`
`
`
`PATENT
`
`The system and method of the present invention provide
`
`computer protection from potentially hostile computer viruses which
`
`have been attached to Downloadables. The system and method of
`
`the present invention advantageously identifies both known hostile
`
`5 Downloadables and identifies potentially hostile commands by
`
`decomposing unknown Downloadables.
`
`-4-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 6
`
`
`
`PATENT
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`FIG. 1 is a block diagram illustrating a network system m
`
`accordance with the present invention;
`
`FIG. 2 is a block diagram illustrating the internal network
`
`5
`
`security system of FIG. 1;
`
`FIG. 3 is a block diagram illustrating the security program of
`
`FIG. 2;
`
`FIG. 4 is a flow chart illustrating an example security policy of
`
`FIG. 2;
`
`10
`
`FIG. 5 is a block diagram illustrating the security management
`
`console of FIG. 1;
`
`FIG. 6 is a flowchart illustrating a method for protecting an
`
`internal computer network from hostile Downloadables; and
`
`FIG. 7 is a flowchart illustrating the FIG. 6 method for
`
`15
`
`decomposing a Downloadable.
`
`-5-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 7
`
`
`
`PATENT
`
`DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
`
`FIG. 1 is a block diagram illustrating a network system 100 in
`
`accordance with the present invention. Network system 100
`
`includes an external computer network 105, such as the Wide Area
`
`5 Network (WAN) commonly referred to as the Internet, coupled via a
`
`signal bus 125 to an internal network security system 110. Network
`
`system 100 further includes an internal computer network 115, such
`
`as a corporate Local Area Network (LAN), coupled via a signal bus
`
`130 to internal network computer system 110 and coupled via a
`
`10
`
`signal bus 135 to a security management console 120.
`
`Internal network security system 110 examines Downloadables
`
`received from external computer network 105, and prevents all
`
`recognizably-hostile Downloadables from reaching internal computer
`
`network 115. A Downloadable is hostile if it threatens the integrity
`
`15
`
`of an internal computer network 115 component.
`
`Security
`
`management console 120 enables modification of internal n.etwork
`
`security system 110.
`
`FIG. 2 is a block diagram of a internal network security system
`
`20
`
`110 which includes a Central Processing Unit (CPU) 205, such as a
`
`Motorola Power PC® microprocessor or an Intel Pentium®
`
`microprocessor, coupled to a signal bus 220.
`
`Internal network
`
`-6-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 8
`
`
`
`PATENT
`
`security system 110 further includes an external communications
`
`interface 210 coupled between signal bus 125 and signal bus 220
`
`for receiving the Downloadables from external computer network
`
`105, and an internal communications interface 225 coupled between
`
`5
`
`signal bus 220 and signal bus 130 for forwarding non-hostile
`
`Downloadables to internal computer network 115. Alternatively,
`
`external communications interface 210 and internal communications
`
`interface 225 may be functional components of an integral
`
`communications interface (not shown) for both receiving
`
`10
`
`Downloadables from external computer network 105 and forwarding
`
`non-hostile Downloadables to internal computer network 115.
`
`Internal network security system 110 further includes
`
`Input/Output (I/0) interfaces 215 such as a keyboard, mouse and
`
`Cathode Ray Tube (CRT) display, a data storage device 230 such as
`
`15
`
`Read Only Memory (ROM) or magnetic disk, and a Random-Access
`
`Memory (RAM) 235, each being coupled to signal bus 220. Data
`
`storage . device 230 stores a security database 240 which includes
`
`security policies and Downloadable data on for determining whether
`
`a received Downloadable is hostile, and stores an events log 245
`
`20
`
`which includes the determination results for each Downloadable. An
`
`operating system 250 controls processing by CPU 205, and is
`
`typically stored data storage device 230 and loaded into RAM 235
`
`-7-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 9
`
`
`
`PATENT
`
`for execution. A security program 255 controls operations of
`
`internal network security system 110, and also may be stored in
`
`data storage device 230 and loaded into RAM 235 for execution by
`
`CPU 205.
`
`5
`
`FIG. 3 is a block diagram illustrating details of security
`
`program 255. Security program 255 includes an ID generator 315, a
`
`first comparator 320 coupled to ID generator 315, a code scanner
`
`coupled to first comparator 320, a second comparator 330 coupled to
`
`10
`
`code scanner 325 and to first comparator 320, and a record-keeping
`
`engine 335 coupled to first comparator 320 and to second
`
`comparator 330.
`
`Security program 255 operates in conjunction with security
`
`database 240 and events log 245. Security database 240 stores
`
`15
`
`security policies 305 in a first data storage device 230 portion,
`
`known Downloadables 307 in a second data storage device 230
`
`portion and Downloadable Security Profiles (DSPs) data
`
`corresponding to the known Downloadables 310 in a third data
`
`storage device 230 portion. Security policies 305 include a list of
`
`20
`
`computer operations which are deemed to be potentially hostile to
`
`the integri~y of internal computer network 115. Potentially hostile
`
`operations may include READ/WRITE operations on a system
`
`-8-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 10
`
`
`
`PATENT
`
`configuration file, READ/WRITE operations on a document containing
`
`trade secrets, or any other operation that a user deems potentially
`
`hostile. Known Downloadables 307 may include Downloadables
`
`which Original Equipment Manufacturers (OEMs) know to be hostile,
`
`5
`
`Downloadables which OEMs know to be non-hostile, Downloadables
`
`which second comparator 330 (described below) has previously
`
`determined to be hostile, and Downloadables which second
`
`comparator 330 (described below) has previously determined to be
`
`non-hostile. DSP data 310 includes the fundamental computer
`
`10 · operations included in each known Downloadable 307, and may
`
`include READs, WRITEs, file management operations, system
`
`management operations, memory management operations and CPU
`
`allocation operations.
`
`ID generator 315 receives Downloadables from external
`
`15
`
`computer network 105 via external communications interface 210,
`
`and which generates a digital signature for each Downloadable. A
`
`digital signature may include a Downloadable identification number,
`
`the Downloadable type, the Downloadable source and the
`
`Downloadable destination.
`
`20
`
`First comparator 320 receives and bit-wise compares the
`
`Downloadables from ID generator 315 with known Downloadables
`
`307 stored in security database 240.
`
`If first comparator 320
`
`-9-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 11
`
`
`
`PATENT
`
`determines a received Downloadable is identical to a known hostile
`
`Downloadable 307, then first comparator 320 discards the received
`
`Downloadable, and forwards a non-hostile Downloadable to the
`
`intended destination to inform the user that internal network
`
`5
`
`security system 110 discarded the Downloadable.
`
`If first
`
`comparator 320 determines that the received Downloadable is
`
`identical to a known non-hostile Downloadable 307, then first
`
`comparator 320 forwards the received Downloadable and the
`
`corresponding DSP data 310 to second comparator 330.
`
`If first
`
`10
`
`comparator 320 determines that the received Downloadable does
`
`not match a known Downloadable (i.e., an "unknown Downloadable"),
`
`then first comparator 320 forwards the received Downloadable to
`
`code scanner 325 (described below).
`
`In any case, first comparator
`
`320 then sends a status report to record-keeping engine 335
`
`15
`
`(described below).
`
`Code scanner 325 receives unknown Downloadables from first
`
`comparator 320 and uses conventional parsing techniques to
`
`decompose the byte code of the unknown Downloadable into DSP
`
`data. Code scanner 325 then sends the Downloadable and the
`
`20
`
`corresponding DSP data to second comparator 330.
`
`Second comparator 330 receives the Downloadable and the
`
`corresponding DSP data either from code scanner 325 or from first
`
`-10-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 12
`
`
`
`PATENT
`
`comparator 320, and compares the DSP data against security policies
`
`305 stored in security database 305.
`
`If, from the DSP data, second
`
`comparator 330 determines that the Downloadable includes a
`
`hostile operation, then second comparator 330 prevents the
`
`5
`
`Downloadable from passing to internal computer network 115.
`
`Similarly to first comparator 320, second comparator 330 forwards a
`
`non-hostile Downloadable to the intended destination to inform the
`
`user that internal network security system 110 discarded the
`
`Downloadable.
`
`If second comparator 330 determines that the
`
`10
`
`received Downloadable does not violate any security policy 305,
`
`then second comparator 330 forwards the received non-hostile
`
`Downloadable to internal computer network 115. Further, if second
`
`comparator 330 received the non-hostile Downloadable from code
`
`scanner 325, then the non-hostile Downloadable is stored in known
`
`15
`
`Downloadables 307 and its corresponding DSP data is stored in DSP
`
`data 310.
`
`In any case, second comparator 330 sends a status report
`
`to record-keeping engine 335 (described below).
`
`Record-keeping engine 335 receives status reports from first
`
`comparator 320 and from second comparator 330, and stores the
`
`20
`
`reports in events log 245 in data storage device 230.
`
`-11-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 13
`
`
`
`FIG. 4 is a block diagram illustrating an example security policy
`
`305.
`
`PATENT
`
`FIG. 5 is a block diagram illustrating details of security
`
`5 management console 120, which includes a security policy generator
`
`505 coupled to signal bus 135, an event log analysis engine 510
`
`coupled to signal bus 135, a user notification engine 515 coupled to
`
`event log analysis engine 510 and a Downloadable database review
`
`engine 520 coupled to signal bus 135. Security management console
`
`10
`
`120 further includes computer components similar to the computer
`
`components illustrated in FIG. 2.
`
`Security policy generator 505 uses an 1/0 interface similar to
`
`I/0 interface 215 for enabling user modification of security policies
`
`305. Further, security policy generator 505 enables the user to
`
`15
`
`provide multiple security levels, i.e., enables the storage of multiple
`
`sets of security policies 305 (wherein second comparator 330 can
`
`use only a particular set of security policies 305 based on the
`
`destination of a received Downloadable). For example, security
`
`policies 305 may enable a corporate manager to receive selected
`
`20
`
`Downloadables but may prevent the corporate manager's secretary
`
`from receiving those Downloadables.
`
`-12-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 14
`
`
`
`PATENT
`
`Event log analysis engine 510 examines the status reports
`
`stored in events log 245 of data storage device 230.. Event log
`
`analysis engine 510 determines if notification of the user (e.g., the
`
`security system manager) is warranted. For example, event log
`
`5
`
`analysis engme 510 may warrant user notification whenever ten
`
`(1 0) hostile Downloadables have been discarded by internal network
`
`security system 110 within a thirty (30) minute period, thereby
`
`flagging a possible security threat. Accordingly, event log analysis
`
`engine 510 instructs user notification engine 515 to inform the user.
`
`10
`
`For example, user notification engine 515 may send an e-mail via
`
`internal communications interface 220 or via external
`
`communications interface 210 to the user, or may display a message
`
`on the user's display device (not shown).
`
`Downloadable database review engine 520 enables a user (e.g.,
`
`15
`
`a network security manager) to examine and modify known
`
`Downloadables 307 and DSP data 310. Thus, if for example a user
`
`learns of new hostile Downloadables, the user can add them to
`
`known Downloadables 307 and the corresponding DSP data to DSP
`
`data 310. Similarly, the user can add new non-hostile
`
`20
`
`Downloadables to known Downloadables 307 and corresponding DSP
`
`data to DSP data 310.
`
`-13-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 15
`
`
`
`PATENT
`
`FIG. 6 is a flowchart illustrating a method 600 for protecting an
`
`internal computer network 115 from hostile Downloadables.
`
`Method 600 begins with step 605 by ID generator 315 receiving a
`
`5
`
`Downloadable.
`
`ID generator 315 in step 610 generates a signature
`
`representing the received Downloadable. First comparator 320 in
`
`step 615 compares the received Downloadable with known
`
`Downloadables 307 previously-stored in security database 240.
`
`If
`
`first comparator 320 in step 620 determines that the received
`
`10
`
`Downloadable is the same as a known hostile Downloadable 307,
`
`then first comparator 320 in step 625 discards the received
`
`Downloadable and in step 630 forwards a substitute non-hostile
`
`Downloadable to the intended destination to inform the user. First
`
`comparator 320 in step 635 instructs record-keeping engine 335 to
`
`15
`
`record the findings, i.e., a status report, in events log 245. Method
`
`600 then ends.
`
`If first comparator 320 in step 620 did not recognize the
`
`received Downloadable as a hostile Downloadable 307, then first
`
`comparator 320 in step 640 determines whether the received
`
`20
`
`Downloadable is a known non-hostile Downloadable 307.
`
`If so, then
`
`first comparator 320 in step 645 retrieves the DSP data 310
`
`corresponding to the known non-hostile Downloadable and jumps to
`
`-14-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 16
`
`
`
`PATENT
`
`step 655. Otherwise, first comparator 320 forwards the received
`
`Downloadable to code scanner 325, which in step 650 decomposes
`
`the received Downloadable into DSP data and then jumps to step
`
`655.
`
`5
`
`In step 655, second comparator 330 compares the DSP data,
`
`either retrieved by first comparator 320 from. security database 240
`
`or generated by code scanner 325, with sec~rity policies 310 stored
`
`in security database 240.
`
`If second comparator 330 in step 660 ·
`
`determines that the DSP data violates a security policy 310, then
`
`10
`
`second comparator 330 proceeds to step 625. Otherwise, second
`
`comparator 330 in step 665 passes the received Downloadable to
`
`internal computer network 115 as a non-hostile Downloadable, and
`
`proceeds to step 635.
`
`15
`
`FIG. 7 is a flowchart illustrating details of method 650 for
`
`decomposing a Downloadable. Method 650 begins in step 705 with
`
`code scanner 3 25 disassembling the machine code of the
`
`Downloadable. Code scanner 325 in step 710 resolves a respective
`
`command in the machine code. Code scanner 325 in step 715
`
`20
`
`determines whether the resolved command is a suspect command.
`
`Examples of suspect commands include a memory allocation
`
`-15-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 17
`
`
`
`PATENT
`
`command, a loop command such as "go to", "while", "if', ~'than" or the
`
`like.
`
`If not, then code scanner 325 returns to step 710.
`
`Otherwise, code scanner 325 in step 720 decodes and registers
`
`the command and the command parameters as DSP data. Code
`
`5
`
`scanner 325 in step 720 registers commands and command
`
`parameters into a format based on command class, e.g., file system
`
`class, network system class, memory system class and CPU system
`
`class). Code scanner 325 in step 725 determines whether the
`
`machine code includes another command.
`
`If so, then code scanner
`
`10
`
`325 returns to step 710. Otherwise, method 650 ends.
`
`-16-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 18
`
`
`
`PATENT
`
`The foregoing description of the preferred embodiments of the
`
`invention is by way of example only, and other variations of the
`
`above-described embodiments and methods are provided by
`
`the
`
`present invention. For example, although the invention has been
`
`5
`
`described in a system for protecting an internal computer network,
`
`the invention can be embodied in a system for protecting an
`
`individual computer. Components of this invention may be
`
`implemented using a programmed general purpose digital computer,
`
`using application specific integrated circuits, or using a network of
`
`10
`
`interconnected conventional components and circuits. The
`
`embodiments described herein have been presented for purposes of
`
`illustration and are not intended to be exhaustive or limiting. Many
`
`variations and modifications are possible in light of the foregoing
`
`teaching. The system IS limited only by the following claims.
`
`-17-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 19
`
`
`
`PATENT
`
`WHAT IS CLAIMED IS:
`
`1
`
`1.
`
`A computer-based method for determining whether a
`
`2 Downloadable is hostile, comprising the steps of:
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`receiving a Downloadable;
`
`decomposing the Downloadable into Downloadable security
`
`profile data;
`
`comparing the Downloadable security profile data against
`
`predetermined security policies to determine if a security policy has
`
`been violated; and
`
`discarding the received Downloadable when a security policy
`
`10
`
`has been violated.
`
`1
`
`2
`
`3
`
`4
`
`2.
`
`A computer-based method for protecting a computer from
`
`hostile Downloadables, comprising the steps of:
`
`receiving a Downloadable;
`
`discarding the received Downloadable when the received.
`
`5 Downloadable matches a predetermined hostile Downloadable;
`
`6
`
`obtaining Downloadable security profile data on the received
`
`7 Downloadable when the Downloadable does not match a
`
`8
`
`predetermined hostile Downloadable; and
`
`-18-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 20
`
`
`
`9
`
`discarding the received Downloadable when the Downloadable
`
`10
`
`security profile data violates a predetermined security policy.
`
`'PATENT
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`3.
`
`A system for determining whether a Downloadable is hostile,
`
`comprising:
`
`a security database storing security policies;
`
`an interface for receiving a current Downloadable;
`
`a code scanner, coupled to the interface, for decomposing the
`
`current Downloadable into Downloadable security profile data; and
`
`a comparator, coupled to the code scanner and to the security
`
`database, for comparing the security policies against the
`
`9 Downloadable security profile data to determine if a security policy
`
`10
`
`has been violated.
`
`1
`
`4.
`
`A system for protecting a computer from hostile
`
`2 Downloadables, comprising:
`
`3
`
`4
`
`5
`
`6
`
`an interface for receiving a Downloadable;
`
`a first memory portion storing security policies;
`
`a second memory portion storing known hostile Downloadables;
`
`a first comparator, coupled to the interface and to the first
`
`7 memory portion, for discarding the received Downloadable when it
`
`8 matches one of the known hostile Downloadables; and
`
`-19-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 21
`
`
`
`9
`
`a second comparator, coupled to the first comparator and to the
`
`10
`
`second memory portion, for discarding the received Downloadable if
`
`11
`
`it violates one of security policies.
`
`PATENT
`
`1
`
`2
`
`3
`
`4
`
`5.
`
`A system for determining whether a Downloadable 1s hostile,
`
`comprising:
`
`means for receiving a Downloadable;
`
`means for decomposing the Downloadable into Downloadable
`
`5
`
`security profile data;
`
`6
`
`7
`
`8
`
`9
`
`means for comparing the Downloadable security profile data
`
`against predetermined security policies to determine if a security
`
`policy has been violated; and
`
`means for discarding the received Downloadable when a
`
`10
`
`security policy has been violated.
`
`1
`
`6.
`
`A system for protecting a computer from hostile
`
`2 Downloadables, comprising:
`
`3
`
`4
`
`5
`
`means for receiving a Downloadable;
`
`means for discarding the received Downloadable when the
`
`received Downloadable matches a ·predetermined hostile
`
`6 Downloadable;
`
`-20-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 22
`
`
`
`PATENT
`
`7
`
`8
`
`9
`
`10
`
`means for obtaining Downloadable security profile data on the
`
`received Downloadable when the Downloadable does not match a
`
`predetermined hostile Downloadable; and
`
`means for discarding the received Downloadable when the
`
`11 Downloadable security profile data violates a predetermined security
`
`12
`
`policy.
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`7.
`
`A computer-readable storage medium storing program code for
`
`causmg a computer to perform the steps of:
`
`receiving a Downloadable;
`
`decomposing the Downloadable into Downloadable security
`
`profile data;
`
`comparing the Downloadable security profile data against
`
`predetermined security policies to determine if a security policy has
`
`been violated; and
`
`discarding the received Downloadable when a security policy
`
`10
`
`has been violated.
`
`1
`
`2
`
`3
`
`8.
`
`A computer-readable storage medium storing program code for
`
`causing a computer to perform the steps of:
`
`receiving a Downloadable;
`
`-21-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 23
`
`
`
`PATENT
`
`4
`
`discarding the received Downloadable when the received
`
`5 Downloadable matches a predetermined hostile Downloadable;
`
`6
`
`obtaining Downloadable security profile data on the received
`
`7 Downloadable when the Downloadable does not match a
`
`8
`
`9
`
`predetermined hostile Downloadable; and
`
`discarding the received Downloadable when the Downloadable
`
`10
`
`security profile data violates a predetermined security policy.
`
`-22-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 24
`
`
`
`SYSTEM AND METHOD FOR PROTECTING A COMPUTER FROM HOSTILE
`
`PATENT
`
`DOWNLOAD ABLES
`
`ABSTRACT OF THE DISCLOSURE
`
`5
`
`A system protects a computer from hostile Downloadables. The
`
`system comprises an interface for receiving a Downloadable, a first
`
`memory portion storing. security policies and a second memory
`
`portion storing known hostile Downloadables. The system further
`
`comprises a first comparator, coupled to the interface and to the first
`
`10 memory portion, for discarding the received Downloadable when it
`
`matches one of the known hostile Downloadables. The system
`
`further comprises a second comparator, coupled to the first
`
`comparator and to the second memory portion, for discarding the
`
`received Downloadable if it violates one of security policies.
`
`-23-
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 25
`
`
`
`6 0 I 0·3 063 9
`
`\{) ---
`
`~
`<..
`~
`t
`2.
`~
`~
`}
`0
`0
`
`~
`~
`
`~
`'
`t\
`
`(.
`
`\()
`
`~ ~
`~ ~)
`10
`-F- ~ ('I
`~-<. ~VI
`- ¢
`~ ,_
`4 ~
`,; ~
`
`~
`\)
`2
`~
`}- -
`J
`
`\()
`(')
`
`I '
`:X
`( ,
`
`j
`
`~
`~
`
`~
`w
`
`. :><
`
`PALO ALTO NETWORKS Exhibit 1027 Page 26
`
`
`
`F r oYl"l.
`£x f-e.r-Ao.l C.ovv, pv--f-~
`{\1.-_,-twcr-k.
`l05
`
`r /?._5
`
`l l Oo-to...
`
`I ..---;::-- - ; - --
`
`S~l-fy i
`b o.:t aJoo..,se.-
`/ I E:_~-ts Los~:<45
`
`:2..'10
`
`FfG. 2
`
`/(10
`
`~us
`
`:I./ 0 :S:nT-erfo . .c.e.,s
`
`220
`:
`------~~5
`
`I
`
`R AM
`
`\
`
`( 5-e-cU-A"rfy ~ :zss
`J Pro3 ra.-rn ! (
`
`0 p-ero--tl "'')
`S y s t..::..-m.._,
`
`I
`
`~/ ;:<So
`.... _, •.. ,
`
`~
`
`'
`
`I
`.. ·
`
`..): ,.· •. ;· ~,.
`. ,.
`
`~05
`r'
`
`le-ru I
`
`r;::! r.-1-<.-rno-(
`
`Co m M U.Yl i eo.:1T o 1'1 ~
`:f. Y\ -t-e.r-f'o..c.-G
`r'30
`
`lo
`.:f.n-t"e.r-Yl&<-{ CoWl f~cr't:-.1
`N~-tv...10-rk us
`
`~
`0
`
`' 0
`
`Coo
`0
`0')
`co '
`<:0 .
`
`PALO ALTO NETWORKS Exhibit 1027 Page 27
`
`
`
`60/0 30 639
`
`v
`~:0 ·tj_ ·- - -
`--c~
`-
`I
`·:r x:.
`)
`I <'
`~ ~
`·-
`() 2 ( J
`
`'
`
`).
`
`J
`
`I
`I
`I
`I
`{
`
`\
`
`(
`
`I
`I
`I
`I
`
`\
`
`I
`
`PALO ALTO NETWORKS Exhibit 1027 Page 28
`
`
`
`60/030639
`. ,
`
`~
`
`Do€S"
`
`'"'"'s AfPLt:r
`co IJT At fl A CcMMA#J)
`~ 10
`_ _ -!.p_c_< Ill/ f-It c. H
`If 1 o c.. A iES A
`c,. e k~R tc_ S"€Cc.t r<.rtt
`pol-ICY
`?
`
`D 1> c A~D !tPf LEI
`
`[>rtrL.ET
`
`PALO ALTO NETWORKS Exhibit 1027 Page 29
`
`
`
`9
`
`-
`Qfi\\
`
`Oflm
`
`
`
` QSwWEWBusumawe.nfi.,+dQ
`
`
`
`cg£332:38
`
`_...Q:.L...U\.u._:.+C..%7g
`
`Lflwflu
`
`®:wm.:...w
`
`mQC
`
`
`
`Lu+3m§oo_E:..a+cH
`
`r¢...u.._:w\nu\
`
`¥.o3+92
`
`PALO ALTO NETWORKS Exhibit 1027 Page 30
`
`PALO ALTO NETWORKS Exhibit 1027 Page 30
`
`
`
`
`
`
`~~
`.
`r--
`) Re.c.e.lv·& DovvV1Iood--o~(:lc.-1-'&oS
`.------~- -·- ·-
`
`··-·
`
`.
`
`0-e-n~ fe iJOLV¥1/ao.olal,l<:-r & (0
`.
`fZ-e,c...e..'tv-e.d.' DowV1 t oo.dl(]._,bf.i-_ ____ r& I '5
`1~-=~~=~=~--
`
`S T 3 Y1 a~'fuJre_.,.
`
`G0'>"¥1 po--r-e-
`wif~ Pr-e-t./i o"'-'sf y- S-tar-eo(... lJot-vYl too.d...c..ble.-s
`··-·--M-~-------·-' '- ''''''''''' • -- " --·· •• "' ~~--~ -·-----·-- ~- Oo 0 · ·-·-·~ 0 .,,,,
`
`Ye-s
`
`'>-----·----~---~
`
`040
`
`PALO ALTO NETWORKS Exhibit 1027 Page 31
`
`
`
`60I0 -3 0639
`
`(Ze-so1 ve- o_ 1<._-c::-s p-e.c-t; v-e.-(cid:173)
`Go.mWJa,v1c{ 1r1 -the- ;V1o..d,(J1-c, Coole
`
`715
`
`, ____ __ ___ _
`
`7::Zo
`/
`De-c-ade.- a.-Y!d Y<.~ ~st<!'.r CoMMa~
`O~n d.- Go rYl r>'ltUv'ld- Po.. r-o-m e.--r~ s
`o.--s OSP do::fo- bo-5ed.- on
`( f I I e... 1 t'le--t wo.r-K
`V01M rnoN-' CAo ,s 5
`
`N\.-t?-¥nory / C, PD£,) -r----------------I
`
`\ \
`
`~ ?;z.s
`
`No
`
`............. "'
`<+-<;-s-+ Com m o41 r£ J
`>
`~
`~ / /
`
`:r;s
`
`(2nd, )
`~
`
`PALO ALTO NETWORKS Exhibit 1027 Page 32
`
`
`
`31-0CT-1'396 20:46
`
`FROM >J NJAN SOFTWARE
`
`TO
`
`00l d'~8123444------
`
`P.07
`
`APP ~lJ b 11._
`
`Gateway Level Corporate Security for the
`New World of Javar~ and Downloadables
`
`SurfinGate™ Means Business
`
`New downloadable technologies including Java™ and Adive){'M present today's enterprises with
`expanded Intranet capabilities, but they also expose corporate computer resources to new kinds of
`security attacks. SurfinGateTM addresses the new computing paradigm with corporate-level security at
`the gateway kvcl fiJr safe u~e of Java and other Internet downloadablcs. An intelligent security solution
`lor companies w ith access to the Internet, SurlinGatc functions at the corporate gateway, where it
`intelligently scans, digitally signs, and controls a ll downloadables before they access the network.
`SurfinG ate· s powerful enterprise-wide security is combined with efficient, centralized control of the
`com pany's Intranet cumputer users.
`
`SurfinGate offers corporate secw·ity managers the ability to:
`
`Establish a security policy for use of Java applets and other Internet downloadables
`
`•
`
`Prevent loading of suspicious Java applets or ActiveX entities at the gateway level
`
`Provide corporate users with safe Internet access without having to disable downloadable technology
`such as Java or ActiveX
`
`•
`
`Protect the corporate resources from damage or unauthorized access by downtoadabtes
`
`SurfinGate addresses a new computing paradigm, where mini-applications called downloadab1es are
`automatically pushed into corporate lntranets unbeknownst to users. As Intranet users access the on(cid:173)
`line resources they need, the business enterprise is exposed to downloadable-transmitted risks like
`corporate espionage, e-mail fraud , or resource attacks. For the corporate security manager, the new
`paradigm's Java applets and Active X technologies represent serious new security threats that are
`simply not addressed by built-in security systems like the Java Security Manager. SurtinGate offers
`sophisticated security at the outcm1ost gateway kvcl, keeping potentially problematic applets
`completely outside ol'thc corporate environment.
`
`SlU·fin<Jale function~:
`
`•
`
`Intelligently scans. analyzes. and controls automatically downloaded Java applets or ActiveX entities
`
`Specifically executes corporate sec-.urity policy as defined by the security manager via Security
`Management Console (SMC), including:
`
`o
`
`0
`
`o
`
`blocking out any applet that meets a suspicious applet profile
`
`positively identifying applets before allowing them into the system
`
`scanning applets for unauthorized actions and assigning appropriat~ apple! security profile
`
`PALO ALTO NETWORKS Exhibit 1027 Page 33
`
`
`
`·.)I~-ocT-19'36 20:47
`,,./}'
`
`FRml F I NJHN SOFTW!=lRE
`
`TO
`
`0014158123444------
`
`P.08
`
`o
`
`intelligently deciding appropriate access based on security policy guidelines and on apple!
`security profile
`
`0
`
`digitally signing acceptable applets before entry
`
`• Page 212
`
`
`
`PALO ALTO NETWORKS Exhibit 1027 Page 34
`
`
`
`TO
`
`. 001<" "'1123444------
`
`P. 0'3
`
`~· .. · ~-
`
`Control and Security ;/·om Three Different Perspectives
`The essence of SurfinGate's protective powers is a_thrce-fold checks and balances process that includes
`rhe profile generator, database, and Security Management Console. Incoming applets or objects are
`first "x-rayed" to expose any potential problems and are assigned a security profile. That profile is· then
`