Patent Grant
7660999
A system and method is described that restricts access for downloading, saving, and executing data based on a security enforcement model. The security enforcement model evaluates information related to the data such as (some or all of): the multipurpose internet mail exchange (MIME) type, any class identifiers, the cache-file extension, and the data itself. Inconsistencies in the evaluated information are reviewed to asses risk associated with allowing the user to access the data. Actions related to the data can be allowed or disallowed once the risk has been assessed, where the user can optionally be prompted for each action by an appropriate user interface (UI) trap.
The hypertext markup language (or HTML) is commonly used to define the structure for presenting content in a web-page. Web pages that are prepared using HTML can be viewed with a variety of web browser application programs. In addition, HTML web pages can be viewed on different computing systems that may otherwise be incompatible with one another. As such, HTML has been adopted throughout the computing community as a common platform for web page development to provide transportability of content between computing systems.
HTML employs a set of standard codes or “markup tags” that are used to define the format (e.g., text color, font size, etc.) and location associated with text, images, and other content. In general, a web browser builds a web page by retrieving the text file associated with the web page and interpreting the markup tags in the text file to format the web page for viewing. An example web page typically includes text, graphic images, and links to other web pages. Graphics images and remote executable programs such as binary executables are downloaded onto the local machine so that the web page can be built appropriately.
Typical web browsers will prompt a user for a decision on installing executable programs that are necessary for the display of content associated with a web page. Example executables include plug-ins, active-x controls, as well as others. In some instances, the web browser does not prompt the user for a decision based on MIME type information that is being reported to the browser. For example, a .JPG file is a graphics image that may be associated with an HTTP request. In this example, the web browser will simply display the image without requiring user interaction.
Briefly stated, a model is described that restricts un-trusted data/objects from running on a user's machine without permission. The data is received by a protocol layer that reports a MIME type associated with the DATA, and caches the data and related cache file name (CFN). A MIME sniffer is arranged to identify a sniffed MIME type based on the downloaded data, the CFN, and the reported MIME type. Reconciliation logic evaluates the sniffed MIME type and the CFN to determine a reconciled MIME type, and to update the CFN. A class ID sniffer evaluates the updated CFN, the cached data, and the reconciled MIME type to determine an appropriate class ID. Security logic evaluates the updated CFN, the reported class ID, and other related system parameters to build a security matrix. Parameters from the security matrix are used to intercept data/objects before an un-trusted data/object can create a security breach on the machine.
A more complete appreciation of the present invention and its improvements can be obtained by reference to the accompanying drawings, which are briefly summarized below, and to the following detailed description of illustrative embodiments of the invention, and to the appended claims.
Non-limiting and non-exhaustive embodiments of the present invention are described with reference to the following drawings.
Various embodiments of the present invention will be described in detail with reference to the drawings, where like reference numerals represent like parts and assemblies throughout the several views. Reference to various embodiments does not limit the scope of the invention, which is limited only by the scope of the claims attached hereto. Additionally, any examples set forth in this specification are not intended to be limiting and merely set forth some of the many possible embodiments for the claimed invention.
Security is an important issue to consider when implementing web browsers and other similar technologies. Problematic security risks exist such as computer viruses, Trojan horse programs, computer worms, and email replicators to name a few. Improved security for email and web browsers is desirable to prevent destruction/corruption of data, as well as preventing identity theft.
In an effort to prevent unauthorized access to computer systems various protection mechanisms have been developed such as firewall programs, anti-virus programs, and anti-spyware programs. Traditional security models have also been implemented to limit the execution and/or installation of software based on user permission levels.
A security enforcement model is described that uses multipurpose internet mail exchange (MIME) type information. Security restrictions are imposed on downloading and executing a file based on an authentication of its reported MIME type. The reported MIME type is evaluated to identify inconsistent, corrupt, or otherwise un-trusted data. Data with a reported MIME type that is un-trusted is given a revised file extension that corresponds to a reduced security exposure such that a dangerous security risk is averted.
An example operating environment for the present invention is illustrated in
The example operating environment is described in the context of client and server computing devices that communicate content (e.g., web pages) over a communication medium such as an internet, intranet, or some other network connection topology. The terms “client” and “server” refer to one instance of the method. However, the same device may play both a “client” and a “server” role in different instances. Generally speaking, any machine can be arranged to enforce the security model that is described herein.
Content that is provided to the machine may contain an executable that may pose an undesirable security risk. Before allowing the download, storage, and/or execution of questionable data (content), a security manager on the local machine (client 130) applies a series of security metrics to verify the data's integrity. The content (data) is initially cached by a protocol layer in the client device. A MIME sniffer (133) is arranged to evaluate the cached content, the file name associated with the cached content, and a reported MIME type (132) to identify a sniffed MIME type (134). Reconciliation logic (135) compares the reported MIME type (132) and the sniffed MIME type (134) to identify inconsistencies. The file name (or file type) can be updated based on any identified inconsistencies. The security model employed by the machine (client 130) can be utilized to verify executable file types (both shell execute and hosted executables) and to prevent undesirable files from accessing the machine.
Computing device 200 may also have additional features or functionality. For example, computing device 200 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in
Computing device 200 also contains communications connection(s) 216 that allow the device to communicate with other computing devices 218, such as over a network. Communications connection(s) 216 is an example of communication media. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, microwave, satellite, infrared and other wireless media. The term computer readable media as used herein includes both storage media and communication media.
Various procedures and interfaces may be implemented in one or more application programs that reside in system memory 204. In one example, the application program includes a MIME security manager in a local computing device (e.g., a client device) that is arranged to apply security restrictions to limit access to the machine for downloading files, opening files, executing programs, or otherwise compromising security of the machine. Example application programs that may employ a MIME security manager in memory 204 include: a web browser application, an email manager application, a contact manager application, a calendar manager application, a word processing application, a spreadsheet application, as well as others.
MIME Security System
Each device or machine is arranged to operate with an application program that includes a security manager. The security manager can be a single application program, or a set of modular programs that are arranged to cooperate with one another.
Example protocol layers that can be employed include an HTTP protocol layer, a TCP/IP protocol layer, an FTP protocol layer, and a WAP protocol layer, to name a few. In one example, data (or an object) is received by the protocol layer and cached as data with a specified filename. For this example, the cache filename (CFN) associated with the cached data has an associated file type, which typically is identified with a particular cache file extension (CFE). An example file extension is a “exe” file extension that is typically associated with a binary executable.
When necessary, an optional decompressor can be employed to decompress any compressed data (content) such as data that is encrypted or archived (ARC, ZIP, etc). The protocol layer extracts a MIME type out of the received data and reports it to a MIME sniffer, along with the content (the data) and the cache file type (CFE). In one example, the protocol layer is an HTTP protocol layer and the MIME file type is extracted out of an HTTP tag.
The MIME sniffer is arranged to evaluate the data, the cache file type, and the reported MIME type to identify inconsistencies. When all of the sources (the reported MIME type, the cache file type, or the actual data) agree with one another, the reported MIME type and the sniffed MIME type are identical. However, the sniffed MIME type can be different from the reported MIME type when inconsistencies are found. For example, a reported MIME type that is tested as binary executable yields a sniffed MIME type of “executable” instead of “text”.
The reconciliation logic receives the sniffed MIME type and the reported cache file type (e.g., CFE). The reported CFE is optionally replaced with an updated cache file extension (CFE′) to minimize security risk when a reported MIME type does not match the sniffed MIME type and the CFE. The changed cache file type (through changing the cache file extension) can be used to prevent the execution of un-trusted data.
A class ID sniffer receives the content, the updated cache file type, and the reconciled MIME type, and is arranged to determine an appropriate class identifier (Class ID). The class ID and the updated cache file type is used by the security logic to build a security matrix that can be used in further processing the data.
The cache file is not necessarily created in every instance. When the cache file does not exist, the data may be directly evaluated by each relevant system component as required. For example, the MIME sniffer may evaluate the data (or buffered data) without consideration of the reported CFE since the cache file is non-existent. Similarly, the reconciliation logic may evaluate the data (or buffered data) to determine if the data conforms with the reported sniffed MIME type without considering the reported CFE. Also, the class ID sniffer may compare the reported reconciled MIME type to the data without consideration of the CFE. The absence of a cache file does not impact the creation or application of the security matrix. A null entry can be created in the security matrix for the CFE when a cache file is not created.
At block 401, the updated cache file extension (or cache file type) is correlated with registered types on the machine. In one example, a registration procedure is employed by each application program on the machine such that every file type associated with that application program has a corresponding registered file type. The file types that are registered with the various application programs are compared to the cache file extension (or cache file type).
Processing continues from block 401 to decision block 402. At decision block 402, the machine evaluates whether or not the cache file extension (CFE′) is matched to a known file extension. Processing flows from decision block 402 to block 403 when a known file extension is not found (CFE_type unregistered). Alternatively, processing flows from decision block 402 to block 404 when a known file extension is found (CFE_type registered).
Processing continues from blocks 403 and 404 to block 405. At block 405, the sniffed class ID is compared to the CFE_type that was identified based on the file extension. At decision block 406, the machine evaluates whether or not the cache file extension (CFE′) is matched to a sniffed class ID. Processing flows from decision block 406 to block 407 when the CFE type matches the sniffed class ID (CFE_type matched). Alternatively, processing flows from decision block 406 to block 408 when the CFE type matches the sniffed class ID (CFE_type matched).
As described previously, the cache file may not created in each and every instance. Whenever the cache file is not created, the correlation of registered types and the related matching procedures described in
The above described determinations are arranged in a matrix as illustrated in
Each designated class identifier may correspond to an executable file type, or some other file type. In one example, the class identifier associated with the data or object corresponds to a data type that should be hosted within a browser window (referred to as “dochost”). For this example, the “Doc Host” column of the security matrix has a “Y” entry to indicate that “YES” the designated type should be hosted in a window. In another example, the class identifier associated with the data or object corresponds to a data type that should be directed to an executable shell outside of the current browser window (referred to as “shell execute”). For this example, the “Doc Host” column of the security matrix has an “N” entry to indicate that “NO” the designated type should not be hosted in a window and should instead by directed to a separately executable shell.
The registered types for the identified class ID (DC) and the cache file extension (CFE) may not match as illustrated by the fourth and fifth columns. For example, the class ID type and the CFE type are matched as designated by T1 for the class IDs identified as D1 and D2. However, the class ID type does not match the CFE type (i.e., T5 vs. T9) for the class ID identified by D3. This situation may occur when a CFE has two different registered types, or when a type is improperly registered.
An optional set of user interface (UI) definitions can be mapped to the security level assessment based on the DC, CFE, and registration types. In one example, the UI definitions include a field to indicate whether an open/save dialog box should appear. In another example, the UI definitions include a field to indicate a danger level associated with the data. In still another example, the UI definitions include a field to indicate whether or not the user's selections for the given DC/CFE/types should have persistence or not. Additional UI/security definitions can be employed without departing from the spirit of the invention.
An optional user interface trap (UI Trap) is illustrated by block 501, where the UI can prompt the user based on the dochost class ID (DC) and the updated cache file extension (CFE′). The prompts provided to the user through the UI can be a dynamically configured such as that described by a security matrix (e.g.,
Continuing to block 503, the security matrix is referenced to determine whether or not doc-hosting should be employed. In one example, the security matrix is evaluated based on the doc-host class ID (DC). In another example, the security matrix is evaluated based on the cache file extension (CFE). In still another example, the security matrix is evaluated based on the updated cache file extension (CFE′).
Processing continues from decision block 504 to block 505 when the security matrix indicates that hosting is required. Alternatively, processing flows from block 504 to block 509 when the security matrix indicates that hosting is not required.
At block 505, an object is created in the browser using data from the cache file (or buffered data that is not from the cache file, when the cache file is unavailable). In some instances, the data from the cache file is insufficient to satisfy the instantiation of the request object and processing flows from decision block 506 to block 507. In another example, the object is successfully created and processing flows from decision block 506 to block 511.
At block 507, another optional UI trap is employed to prompt the user for assistance in determining what action to take for the unsuccessful object creation. The prompts provided to the user are again dynamically configured such as that described by a security matrix (e.g.,
At block 509, the data from the cache file (or buffered data that is not from the cache file, when the cache file is unavailable) is provided as a shell execute. The shell execute can once again provide an optional UI trap (not shown). After the shell execute is complete, processing is concluded at block 511.
Each of the described UI trap routines is arranged to request user authorization when necessary prior to proceeding. In one example, persistence from a prior user decision is employed such that the dialog box for the UI need not be provided. In another example, the dialog box for the UI provides a detailed warning message based on the danger level. Potential dangers include invalid data, malicious data, misregistered file types, as well as bad or corrupted information that is extracted from the MIME header of an HTTP file. Although the security matrix is described with reference to a UI Definition, the security matrix (or table) can be used by various program modules that are unrelated to a UI.
The above specification, examples and data provide a complete description of the manufacture and use of the composition of the invention. Since many embodiments of the invention can be made without departing from the spirit and scope of the invention, the invention resides in the claims hereinafter appended.
| Number | Name | Date | Kind |
|---|---|---|---|
| 5911776 | Guck | Jun 1999 | A |
| 6901519 | Stewart et al. | May 2005 | B1 |
| 7228307 | Dettinger et al. | Jun 2007 | B2 |
| 7263561 | Green et al. | Aug 2007 | B1 |
| 20010056444 | Ide et al. | Dec 2001 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20060010241 A1 | Jan 2006 | US |
