Method and Agent for the Protection Against the Unauthorized Use of Computer Resources

Abstract

Method and agent for preventing a hostile use of computer resources by an application running on a workstation. A list of services that are not allowed for access by unspecified applications is provided, and when such unspecified application runs on the workstation, the application is prevented from accessing any resource directly. Any direct or indirect request for access to specific services is analyzed, to determine whether such request is allowable according to the list. The workstation processes the request if it is allowable. The unspecified application is prevented from accessing the requested resource if the request is not allowable. The resource may be any local or remote resource, such as, memory allocation, files, directories, operations with files and directories, such as copy, delete or compress, or any other operation leading to a permanent change in the workstation or its periphery.

1 . (canceled) 
   
   
       2 . (canceled) 
   
   
       3 . (canceled) 
   
   
       4 . (canceled) 
   
   
       5 . (canceled) 
   
   
       6 . (canceled) 
   
   
       7 . (canceled) 
   
   
       8 . (canceled) 
   
   
       9 . A method for preventing hostile use of computer resources by an application running on a workstation, comprising:
 providing a filter on a workstation for receiving internal requests for computer resources resident on the workstation;   receiving at the filter a request for access from an application resident on the workstation, the request for access identifying a computer resource resident on the workstation,   determining if the request for access has exceeded a pre-set threshold identifying a limited number of processes that may be initiated by the application;   allowing access to the requested computer resource if the request for access has not exceeded the pre-set threshold; and   preventing access to the requested computer resource if the request for access has exceeded the pre-set threshold.   
   
   
       10 . The method of  claim 9 , wherein the application from which the request for access is received comprises an unspecified application downloaded to the workstation from a source external to the workstation, the unspecified application not identifiable in a pre-set list of hostile applications. 
   
   
       11 . The method of  claim 9 , wherein the requested computer resource is selected from the group consisting of a memory allocation, a file, and a directory. 
   
   
       12 . The method of  claim 9 , wherein the requested computer resource is selected from the group consisting of a copy command, a delete command, and a compress command. 
   
   
       13 . The method of  claim 9 , wherein the requested computer resource comprises an operation that when performed leads to a permanent change in the workstation. 
   
   
       14 . The method of  claim 9 , wherein receiving the request comprises receiving a direct request generated by the unspecified application. 
   
   
       15 . The method of  claim 9 , wherein receiving the request comprises receiving an indirect request generated by the unspecified application. 
   
   
       16 . A workstation for preventing hostile use of computer resources by an application running on the workstation, comprising:
 a memory operable to store one or more applications; and   a processor in communication with the memory and operable to:
 in response to a received request for access, determine if the request has exceeded a pre-set threshold identifying a limited number of processes that may be initiated by an application; 
 allow access to the requested computer resource if the request for access has not exceeded the pre-set threshold; and 
 prevent access to the requested computer resource if the request for access has exceeded the pre-set threshold. 
   
   
   
       17 . The workstation of  claim 16 , wherein at least one of the one or more applications comprise an unspecified application downloaded to the workstation from a source external to the workstation, the unspecified application not identifiable in a pre-set list of hostile applications. 
   
   
       18 . The workstation of  claim 16 , wherein the requested computer resource is selected from the group consisting of a memory allocation, a file, and a directory. 
   
   
       19 . The workstation of  claim 16 , wherein the requested computer resource is selected from the group consisting of a copy command, a delete command, and a compress command. 
   
   
       20 . The workstation of  claim 16 , wherein the requested computer resource comprises an operation that when performed leads to a permanent change in the workstation. 
   
   
       21 . The workstation of  claim 16 , wherein the request from the unspecified application comprises a direct request. 
   
   
       22 . The workstation of  claim 16 , wherein the request from the unspecified application comprises an indirect request. 
   
   
       23 . Logic for preventing hostile use of computer resources by an application running on a workstation, the logic encoded in media and operable when executed to:
 provide a filter on a workstation for receiving internal requests for computer resources resident on the workstation;   receive at the filter a request for access from an application resident on the workstation, the request for access identifying a computer resource resident on the workstation,   determine if the request for access has exceeded a pre-set threshold identifying a limited number of processes that may be initiated by the application;   allow access to the requested computer resource if the request for access has not exceeded the pre-set threshold; and   prevent access to the requested computer resource if the request for access has exceeded the pre-set threshold.   
   
   
       24 . The logic of  claim 23 , wherein the application from which the request for access is received comprises an unspecified application downloaded to the workstation from a source external to the workstation, the unspecified application not identifiable in a pre-set list of hostile applications. 
   
   
       25 . The logic of  claim 23 , wherein the requested computer resource is selected from the group consisting of a memory allocation, a file, and a directory. 
   
   
       26 . The logic of  claim 23 , wherein the requested computer resource is selected from the group consisting of a copy command, a delete command, and a compress command. 
   
   
       27 . The logic of  claim 23 , wherein the requested computer resource comprises an operation that when performed leads to a permanent change in the workstation. 
   
   
       28 . The logic of  claim 23 , wherein receiving the request comprises receiving a direct request generated by the unspecified application. 
   
   
       29 . The logic of  claim 23 , wherein receiving the request comprises receiving an indirect request generated by the unspecified application.