Parametric content control in a network security system

摘要

A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and social engineering attacks. The system can implement centralized policies that allow an administrator to approve, block, quarantine, or log file activities. The system can provide and update a security value that causes host computers to change security levels for a number of different policies. The policies are grouped into a master set of policies and options which are propagated to the hosts from a centralized server. The security value is stored on the hosts and the server, and changes of the value on the server are propagated to the hosts.

主权项

1. A method for use in a computer system having host computers for communicating with a server in a network, the method comprising:
receiving, by a host from the server, a master set of policies relating to file operations including policy options relating to whether operations are allowed or banned, and if operations are allowed, with what conditions such file operations are allowed; after receiving the master set, receiving a value indicating which subset of the master set of policies and policy options to implement on the host; the host implementing the file operation policies indicated by the value; the host maintaining state information associated with files, the state information being used to determine whether and how the file can be used, the states including allowed, banned, or pending, the allowed and banned states indicating that a desired use is allowed or banned, respectively, and a pending indicating that a state has not yet been determined as allowed or banned, the policy options including permitting execution and/or reading of files with a pending state, or banning execution and/or reading of files with a pending state; the host sending state information to the server and receiving state information from the server, the host maintaining state information separately and independently of the server; and responsive to information from the server, permitting execution and/or reading of files with a pending state.