The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Apr. 05, 2016

Filed:

Nov. 18, 2014
Applicant:

Fortinet, Inc., Sunnyvale, CA (US);

Inventors:

Andrew F. Fanton, Westminster, CO (US);

John J. Gandee, Loveland, CO (US);

William H. Lutton, Fort Collins, CO (US);

Edwin L. Harper, Platteville, CO (US);

Kurt E. Godwin, Loveland, CO (US);

Anthony A. Rozga, Wellington, CO (US);

Assignee:

Fortinet, Inc., Sunnyvale, CA (US);

Attorney:
Primary Examiner:
Int. Cl.
CPC ...
H04L 9/32 (2006.01); G06F 21/44 (2013.01); G06F 21/10 (2013.01); G06F 21/51 (2013.01); G06F 21/52 (2013.01); G06F 21/60 (2013.01); H04L 29/06 (2006.01); G06F 21/53 (2013.01);
U.S. Cl.
CPC ...
G06F 21/44 (2013.01); G06F 21/10 (2013.01); G06F 21/51 (2013.01); G06F 21/52 (2013.01); G06F 21/53 (2013.01); G06F 21/602 (2013.01); H04L 9/32 (2013.01); H04L 9/3239 (2013.01); H04L 63/08 (2013.01); H04L 63/0884 (2013.01); H04L 63/10 (2013.01); H04L 63/145 (2013.01); G06F 2221/033 (2013.01); G06F 2221/2141 (2013.01); Y10S 707/99934 (2013.01); Y10S 707/99943 (2013.01); Y10S 707/99944 (2013.01);
Abstract

Systems and methods for selective authorization of code modules are provided. According to one embodiment, a kernel mode driver monitors events occurring within a file system or an operating system. Responsive to observation of a trigger event performed by or initiated by an active process, in which the active process corresponds to a first code module within the file system and the event relates to a second code module within the file system, performing or bypassing a real-time authentication process on the second code module with reference to a whitelist containing content authenticators of approved code modules, which are known not to contain viruses or malicious code. The active process is allowed to load the second code module into memory when the real-time authentication process is bypassed or when it is performed and determines a content authenticator of the code module matches one of the content authenticators.


Find Patent Forward Citations

Loading…