Security Policy Server for User-Created Object Trust
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software often incorrectly identifies organization-specific user-created objects as threats, leading to false positives and productivity losses, as it struggles to accurately determine the trustworthiness of unique objects within an organization's computer systems.
Innovation Solution
A method and system that involve detecting accessed objects, determining if an exception occurred, and requesting a security policy from a server based on the object's identifier, allowing access only if the object was created by a user device associated with the same organization, thereby implementing a security policy that matches the object's attributes to determine its trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software scans and analyzes user-created objects to determine security threats, then security protection is improved, but false positive detections increase leading to productivity loss
Solution Approach 1:
The system performs preliminary actions by creating a reputation profile for each user-created object before it is fully scanned or executed. This profile includes metadata such as file type, creator information, and organizational context, allowing the security system to make preliminary risk assessments and reduce false positives before detailed scanning occurs.
Solution Approach 2:
The patent introduces an intermediary reputation server that acts as a mediator between the security software and user-created objects. Instead of directly blocking or allowing objects, the security software queries the reputation server for reputation information, which then provides risk assessments and guidance decisions, reducing false positives while maintaining security.
2Object-affected harmful factors
If security software blocks user-created objects deemed as threats, then security threats are prevented, but organization-specific objects are falsely blocked causing productivity loss
Solution Approach 1:
The system implements feedback mechanisms where the reputation server continuously updates reputation profiles based on scanning results, user interactions, and organizational context. This feedback loop allows the system to learn from false positives and improve its blocking decisions, preventing genuine threats while allowing legitimate organization-specific objects to pass through.
Solution Approach 2:
The patent changes the parameters used for security decisions from simple binary threat/non-threat classifications to multi-dimensional reputation scores that consider file metadata, creator credibility, organizational context, and historical behavior. This parameter transformation enables more nuanced decisions that reduce false blocking of legitimate objects.
3Measurement precision
If security software performs detailed scanning of all user-created objects, then detection accuracy is improved, but processing time and system resources increase
Solution Approach 1:
The system applies partial scanning actions by performing reputation checks on all user-created objects while reserving detailed scanning only for objects with ambiguous or low reputation scores. High-reputation objects from trusted organizational sources receive minimal processing, significantly reducing overall processing time while maintaining detection accuracy for suspicious objects.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Methods, systems, and media for protecting computer systems from user-created objects are provided. In some embodiments, the method comprises: detecting, at a second user device, that an object has been accessed on the second user device; determining whether an exception has occurred by scanning the object on the second user device; in response to determining that the exception has occurred, transmitting, from the second user device to a server, a request for a security policy to be applied by the second user device in connection with the object, wherein the request includes an identifier of the object; receiving, from the server, the security policy; determining, based on the security policy, that the object was created by a first user device associated with an organization the second user device is also associated with; determining whether to allow the object to be accessed by the second user device based on the security policy; and in response to determining that the object is allowed to be accessed, allowing the object to be accessed on the second user device.