Method and system for preventing the downloading and execution of executable objects
View Patent ↗A method for selectively preventing the downloading and execution of undesired Executable Objects in a computer. The method comprises when an Executable Object is detected at a gateway, analyzing the header of the Executable Object, determining the resources of the computer that the Executable Object needs to utilize, comparing the resources of the computer that the Executable Object needs to utilize with a Security Policy and if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy, preventing the Executable Object from passing through the gateway, thereby preventing it from reaching the computer which has initiated its downloading.
1. A method for preventing the downloading and execution of undesired Executable Objects in a computer, comprising:
providing one or more Control Centers, each connected to one or more gateways located between an internal network and an external network;
detecting Executable Objects reaching said gateway to determine the resources of the computer that the Executable Object needs to utilize;
storing a Security Policy for one or more users representing resources the Executable Object is allowed to utilize wherein the Security Policy is received from and/or stored in each of said one or more Control Centers;
comparing the resources of the computer that the Executable Object needs to utilize with the Security Policy and;
preventing the Executable Object from passing through the gateway when the resources that the Executable Object needs to utilize are not included in the list of resources allowed for use by the Security Policy.
2. The method according to claim 1 , further comprising:
alerting Security Officers that a given type of Executable Object has entered the gateway; and
storing information pertaining to a given Executable Object according to the Security Policy.
3. The method according to claim 1 , wherein the Executable Object is selected from DLLs or any type or transmittable executable object.
4. The method according to any one of claims 1 to 3 , further comprising:
when an undesirable Executable Object is detected at a gateway, providing an identifying value therefrom, and notifying all gateways thereof; and
providing memory means and suitable identity verification means, coupled to each gateway, to identify undesirable Executable Objects already analyzed by another gateway, and from preventing it from passing the gateway.
5. The method according to any one of claims 1 to 3 , further comprising:
when an undesirable Executable Object is detected at a gateway, calculating a checksum to identify the undesirable Executable Object, and notifying all gateways thereof; and
identifying undesirable Executable Objects already analyzed by another gateway, and from preventing the identified undesirable Executable Objects from passing the gateway.
6. The method according to claim 1 , wherein when more than one Control Centers are provided, Security Policies are disseminated from one main Control Center to the remaining Control Centers, and wherein each Control Center, in turn, controls the operation of the gateways connected to it.
7. The method according to claim 1 or 6 , wherein each Control Center and each group of gateways is provided with its own individual Security Policy, which may be the same or different from the Security Policy received from the main Control Center.
8. The method according to claim 1 or 6 , wherein each Control Center and each group of gateways is provided with its own individual Security Policy, which may be the same or different from the Security Policy received from the main Control Center, wherein each subordinate Control Center may add additional limitations to the Security Policy received from the main Control Center, by the addition of resources to the list of those the use of which is not allowed, but it may not remove limitations from the list of limited resources contained in the Security Policy distributed by the main Control Center.
9. The method of claim 1 , wherein said internal network is a LAN.
10. The method of claim 1 , wherein said external network is the Internet.
11. The method of claim 1 , wherein said Security Policy additionally comprises a list of unacceptable Executable Objects and said unacceptable Executable Objects are always prevented from passing through the gateway.
12. The method of claim 1 , wherein said Security Policy additionally comprises a list of acceptable Executable Objects and said acceptable Executable Objects are always allowed through the gateway.
13. The method of claim 1 wherein said undesired Executable Objects comprise unauthorized retrieval of information.
14. A computer system comprising one or more LANs, each LAN being connected to an outside computer or computer network through one or more gateways, comprising:
one or more Control Centers, each Control Centers being connected to one or more gateways located between an internal network and an external network;
means to each of said gateways, to detect Executable Objects reaching said gateway to determine the resources of the computer that the Executable Object needs to utilize;
means to each of said gateways, to store a Security Policy for one or more users representing resources the Executable Object is allowed to utilize wherein, the Security Policy is received from and/or stored in each of said one or more Control Centers;
to compare the resources of the computer that the Executable Object needs to utilize with the Security Policy and;
means for preventing the Executable Object from passing through the gateway when the resources that the Executable Object needs to utilize are not included in the list of resources allowed for use by the Security Policy.
15. The computer system according to claim 14 , further comprising:
means for alerting Security Officers that a given type of Executable Object has entered the gateway; and
means for storing information pertaining to a given Executable Object according to the Security Policy.
16. The computer system of claim 14 , wherein said internal network is a LAN.
17. The computer system of claim 14 , wherein said external network is the Internet.
18. The computer system of claim 14 , wherein said Security Policy additionally comprises a list of unacceptable Executable Objects and said unacceptable Executable Objects are always prevented from passing through the gateway.
19. The computer system of claim 14 , wherein said Security Policy additionally comprises a list of acceptable Executable Objects and said acceptable Executable Objects are always allowed through the gateway.
20. The computer system of claim 14 wherein said undesired Executable Objects comprise unauthorized retrieval of information.
21. A system for preventing the downloading and execution of undesired Executable Objects in a computer, comprising:
one or more Control Centers, each connected to one or more gateways located between an internal network and an network;
detection means provided to each of said gateways, to detect Executable Objects reaching said gateway to determine the resources of the computer that the Executable Object needs to utilize;
storage means provided to each of said gateways, to store a Security Policy for one or more users representing resources the Executable Object is allowed to utilize, wherein the Security Policy is received from and/or stored in each of said one or more Control Centers;
comparing means for comparing the resources of the computer that the Executable Object needs to utilize with the Security Policy; and
preventing the Executable Object from passing through the gateway when the resources that the Executable Object needs to utilize are not included in the list of resources allowed for use by the Security Policy.
22. The system according to claim 21 , further comprising:
alerting means for alerting Security Officers that a given type of Executable Object has entered the gateway; and
storing means for storing information pertaining to a given Executable Object according to the Security Policy.
23. The system according to claim 21 , wherein the Executable Object is selected from DLLs or any type or transmittable executable object.
24. The system according to any one of claims 21 to 23 , further comprising:
an identifying-value-providing means for when an undesirable Executable Object is detected at a gateway, providing an identifying value therefrom, and notifying all gateways thereof; and
memory means and suitable identity verification means, coupled to each gateway, to identify undesirable Executable Objects already analyzed by another gateway, and from preventing it from passing the gateway.
25. The system according to any one of claims 21 to 23 , further comprising:
a checksum calculating means for when an undesirable Executable Object is detected at a gateway, calculating a checksum to identify the undesirable Executable Object, and notifying all gateways thereof; and
memory means and suitable identity verification means, coupled to each gateway, to identify undesirable Executable Objects already analyzed by another gateway, and from preventing it from passing the gateway.
26. The system according to claim 21 , wherein when more than one Control Centers are provided, Security Policies are disseminated from one main Control Center to the remaining Control Centers, and wherein each Control Center, in turn, controls the operation of the gateways connected to it.
27. The system according to claim 21 or 26 , wherein each Control Center and each group of gateways is provided with its own individual Security Policy, which may be the same or different from the Security Policy received from the main Control Center.
28. The system according to claim 21 or 26 , wherein each Control Center and each group of gateways is provided with its own individual Security Policy, which may be the same or different from the Security Policy received from the main Control Center, wherein each subordinate Control Center may add additional limitations to the Security Policy received from the main Control Center, by the addition of resources to the list of those the use of which is not allowed, but it may not remove limitations from the list of limited resources contained in the Security Policy distributed by the main Control Center.
29. The system of claim 21 , wherein said internal network is a LAN.
30. The system of claim 21 , wherein said external network is the Internet.
31. The system of claim 21 , wherein said Security Policy additionally comprises a list of unacceptable Executable Objects and said unacceptable Executable Objects are always prevented from passing through the gateway.
32. The system of claim 21 , wherein said Security Policy additionally comprises a list of acceptable Executable Objects and said acceptable Executable Objects are always allowed through the gateway.
33. The system of claim 21 , wherein said undesired Executable Objects comprise unauthorized retrieval of information.