US 7,673,137 System and method for the managed security control of processes on a computer system

3 defendants · 3 suits · updated October 6, 2026

Also cited as U.S. Patent No. 7,673,137 · US7673137B2 · US 7,673,137 B2 · 7673137 · the '137 patent

Taasera Licensing LLC has filed 3 patent-infringement suits on US 7,673,137, "System and method for the managed security control of processes on a computer system" since May 11, 2026, 2 of them in the E.D. Tex., against 3 distinct defendants including Bitdefender Holding B.V., Arctic Wolf Networks, Inc. and Zoho Corporation Private Limited. The patent was granted March 2, 2010 on a priority date of January 4, 2002. Its abstract opens: "Managing and controlling the execution of software programs with a computing device to protect the computing device from malicious activities." The examiner cited 12 references during prosecution.

Assignee: Taasera Licensing LLC
Priority date: January 4, 2002
Granted: March 2, 2010
Expires: January 4, 2022
Status: Active
Claims: 29 (4 independent)
Inventors: Thomas James Satterlee, William Frank Hackenberger
Full text: Google Patents

The suits

3 cases · E.D. Tex. (2) · W.D. Tex. (1)

Filed	Defendant	Plaintiff	Court	Docket
2026-05-11	Bitdefender Holding B.V.	Taasera Licensing LLC	E.D. Tex.	2:26-cv-00391
2026-08-19	Arctic Wolf Networks, Inc.	Taasera Licensing LLC	W.D. Tex.	7:26-cv-00330
2026-09-15	Zoho Corporation Private Limited	Taasera Licensing LLC	E.D. Tex.	2:26-cv-00824

Docket links open the public record on CourtListener. Filing dates are the complaint's.

Independent claims

What is actually asserted, verbatim.

Claim 1

1. A system for managing security of a computing device comprising: a pre-execution module operable for receiving notice from the computing device's operating system that a new program is being loaded onto the computing device; a validation module coupled to the pre-execution monitor operable for determining whether the program is valid; a detection module coupled to the pre-execution monitor operable for intercepting a trigger from the computing device's operating system; and an execution module coupled to the detection module and operable for monitoring, at the operating system kernel of the computing device, the program in response to the trigger intercepted by the detection module.

Claim 6

6. A computer implemented method for implementing security for a computing device comprising the steps of: interrupting the loading of a new program for operation with the computing device; validating the new program; if the new program is validated, permitting the new program to continue loading and to execute in connection with the computing device; if the new program is not validated, monitoring the new program while it loads and executes in connection with the computing device, wherein the step of monitoring the new program while it executes is performed at the operating system kernel of the computing device.

Claim 14

14. A computer-implemented method for implementing security for a computing device, comprising the steps of: identifying an allowed program that is permitted to execute on the computing device; receiving a signal that a new program is going to be executed on the computing device; suspending the execution of the new program on the computing device; determining whether the new program is the same as the allowed program; if the new program is the same as the allowed program, permitting the new program to execute on the computing device; and if the new program is not the same as the allowed program, monitoring the new program while allowing it to execute on the computing device, wherein the step of monitoring the new program while allowing it to execute is performed at the operating system kernel of the computing device.

Claim 25

25. A computer-implemented method for performing security for a computer device during a pre-execution phrase comprising the steps of: identifying an allowed program that is permitted to execute with the computing device; receiving a signal that a new program is being loaded for execution with the computing device; suspending the loading of the new program; comparing the new program to the allowed program; and determining whether the new program is valid; if the new program is valid, permitting the new program to execute on the computing device; and if the new program is not valid, monitoring the new program while allowing it to execute on the computing device, wherein the step of monitoring the new program while allowing it to execute is performed at the operating system kernel of the computing device.

Art before the examiner

241 references of record, 12 cited by the examiner.

Everything listed here was before the Office and is what a challenge must go beyond. Art the examiner never saw is where an invalidity search starts.

Examiner-cited

US5272754A — Secure computer interface (Secure Computing Corporation)
US5359713A — Method and apparatus for enhancing synchronous I/O in a computer system with a non-volatile memory and using an acceleration device driver in a computer operating system (Legato Systems, Inc.)
US5948104A — System and method for automated anti-viral file update (Neuromedical Systems, Inc.)
US6128774A — Safe to execute verification of software (Necula; George C.)
US6334213B1 — Merging of separate executable computer programs to form a single executable computer program (Preview Systems)
US20020042886A1 — Software virus protection (Pasi Lahti)
US20020184520A1 — Method and apparatus for a secure virtual machine (Bush William R.)
US20030101381A1 — System and method for virus checking software (Nikolay Mateev)
US20030177394A1 — System and method of enforcing executable code identity verification over the network (Dmitri Dozortsev)
US6694434B1 — Method and apparatus for controlling program execution and program distribution (Entrust Technologies Limited)
US20050021994A1 — Pre-approval of computer files during a malware detection (Barton Christopher Andrew)
US7398532B1 — System and method for establishing a secure execution environment for a software process (Hewlett-Packard Development Company, L.P.)

Applicant-cited and other (229)

US4223380A — Distributed multiprocessor communication system
US4400769A — Virtual machine system
US4672609A — Memory system with operation error detection
US4773028A — Method and apparatus for improved monitoring and detection of improper device operation
US4819234A — Operating system debugger
US4975950A — System and method of protecting integrity of computer data and software
US5032979A — Distributed security auditing subsystem for an operating system
US5121345A — System and method for protecting integrity of computer data and software
US5204966A — System for controlling access to a secure system by verifying acceptability of proposed password by using hashing and group of unacceptable passwords
US5210704A — System for prognosis and diagnostics of failure and wearout monitoring and for prediction of life expectancy of helicopter gearboxes and other rotating equipment
US5274824A — Keyring metaphor for user's security keys on a distributed multiprocess data system
US5278901A — Pattern-oriented intrusion-detection system and method
US5309562A — Method and apparatus for establishing protocol spoofing from a modem
US5311593A — Security system for a network concentrator
US5345595A — Apparatus and method for detecting fraudulent telecommunication activity
US5347450A — Message routing in a multiprocessor computer system
US5353393A — Apparatus and method for manipulating scanned documents in a computer aided design system
US5359659A — Method for securing software against corruption by computer viruses
US5371852A — Method and apparatus for making a cluster of computers appear as a single host on a network
US5398196A — Method and apparatus for detection of computer viruses
US5414833A — Network security system and method using a parallel finite state machine adaptive active monitor and responder
US5440723A — Automatic immune system for computers and computer networks
US5452442A — Methods and apparatus for evaluating and extracting signatures of computer viruses and other undesirable software entities
US5454074A — Electronic checklist system
US5475839A — Method and structure for securing access to a computer system
US5511184A — Method and apparatus for protecting a computer system from computer viruses
US5515508A — Client server system and method of operation including a dynamically configurable protocol stack
US5522026A — System for creating a single electronic checklist in response to multiple faults
US5539659A — Network analysis method
US5557742A — Method and system for detecting intrusion into and misuse of a data processing system
US5586260A — Method and apparatus for authenticating a client to a server in computer systems which support different security mechanisms
US5590331A — Method and apparatus for generating platform-standard object files containing machine-independent code
US5606668A — System for securing inbound and outbound data packet flow in a computer network
US5623601A — Apparatus and method for providing a secure gateway for communication and data exchanges between networks
US5623600A — Virus detection and removal apparatus for computer networks
US5630061A — System for enabling first computer to communicate over switched network with second computer located within LAN by using media access control driver in different modes
US5649185A — Method and means for providing access to a library of digitized documents and images
US5649095A — Method and apparatus for detecting computer viruses through the use of a scan information cache
US5675711A — Adaptive statistical regression and classification of data strings, with application to the generic detection of computer viruses
US5696822A — Polymorphic virus detection module
US5696486A — Method and apparatus for policy-based alarm notification in a distributed network management environment
US5706210A — Network monitoring device
US5715395A — Method and apparatus for reducing network resource location traffic in a network
US5734697A — Method and apparatus for improving telecommunications system performance
US5745692A — Automated systems administration of remote computer servers
US5748098A — Event correlation
US5761504A — Method for updating a software code in a communication system
US5765030A — Processor emulator module having a variable pre-fetch queue size for program execution
US5764890A — Method and system for adding a secure network server to an existing computer network
US5764887A — System and method for supporting distributed computing mechanisms in a local area network server environment
US5774727A — Parallel processing system for virtual processor implementation of machine-language instructions
US5787177A — Integrated network security access control system
US5790799A — System for sampling network packets by only storing the network packet that its error check code matches with the reference error check code
US5796942A — Method and apparatus for automated network-wide surveillance and security breach intervention
US5798706A — Detecting unauthorized network communication
US5812763A — Expert system having a plurality of security inspectors for detecting security flaws in a computer system
US5815574A — Provision of secure access to external resources from a distributed computing environment
US5822517A — Method for detecting infection of software programs by memory resident software viruses
US5826013A — Polymorphic virus detection module
US5828833A — Method and system for allowing remote procedure calls through a network firewall
US5832211A — Propagating plain-text passwords from a main registry to a plurality of foreign registries
US5832208A — Anti-virus agent for use with databases and mail servers
US5835726A — System for securing the flow of and selectively modifying packets in a computer network
US5838903A — Configurable password integrity servers for use in a shared resource environment
US5842002A — Computer virus trap
US5845067A — Method and apparatus for document management utilizing a messaging system
US5848233A — Method and apparatus for dynamic packet filter assignment
US5854916A — State-based cache for antivirus software
US5857191A — Web application server with secure common gateway interface
US5864665A — Auditing login activity in a distributed computing environment
US5864803A — Signal processing and training by a neural network for phoneme recognition
US5872915A — Computer apparatus and method for providing security checking for software applications accessed via the World-Wide Web
US5872978A — Method and apparatus for improved translation of program data into machine code format
US5875296A — Distributed file system web server user authentication with cookies
US5878420A — Network monitoring and management system
US5881236A — System for installation of software on a remote computer system over a network using checksums and password protection
US5884033A — Internet filtering system for filtering data transferred over the internet utilizing immediate and deferred filtering actions
US5892903A — Method and apparatus for detecting and identifying security vulnerabilities in an open network computer communication system
US5899999A — Iterative convolution filter particularly suited for use in an image classification and retrieval system
US5905859A — Managed network device security method and apparatus
US5919257A — Networked workstation intrusion detection system
US5919258A — Security system and method for computers connected to network
US5922051A — System and method for traffic management in a network management system
US5925126A — Method for security shield implementation in computer system's software
US5931946A — Network system having external/internal audit system for computer security
US5940591A — Apparatus and method for providing network security
US5950012A — Single chip microprocessor circuits, systems, and methods for self-loading patch micro-operation codes and patch microinstruction codes
US5961644A — Method and apparatus for testing the integrity of computer security alarm systems
US5964839A — System and method for monitoring information flow and performing data collection
US5964889A — Method to analyze a program for presence of computer viruses by examining the opcode for faults before emulating instruction in emulator
US5974457A — Intelligent realtime monitoring of data traffic
US5974237A — Communications network monitoring
US5978917A — Detection and elimination of macro viruses
US5983270A — Method and apparatus for managing internetwork and intranetwork activity
US5983350A — Secure firewall supporting different levels of authentication based on address or encryption status
US5983348A — Computer network malicious code scanner
US5987611A — System and methodology for managing internet access on a per application basis for client computers connected to the internet
US5987606A — Method and system for content filtering information retrieved from an internet computer network
US5987610A — Computer virus screening methods and systems
US5991881A — Network surveillance system
US5991856A — System and method for computer operating system protection
US5999711A — Method and system for providing certificates holding authentication and authorization information for users/machines
US6003132A — Method and apparatus for isolating a computer system upon detection of viruses and similar data
US6006016A — Network fault correlation
US6009467A — System for checking status of supported functions of communication platforms at preselected intervals in order to allow hosts to obtain updated list of all supported functions
US6014645A — Real-time financial card application system
US6016553A — Method, software and apparatus for saving, using and recovering data
US6021510A — Antivirus accelerator
US6026442A — Method and apparatus for surveillance in communications networks
US6029256A — Method and system for allowing computer programs easy access to features of a virus scanning engine
US6035323A — Methods and apparatuses for distributing a collection of digital media over a network with automatic generation of presentable media
US6035423A — Method and system for providing automated updating and upgrading of antivirus applications using a computer network
US6041347A — Computer system and computer-implemented process for simultaneous configuration and monitoring of a computer network
US6052709A — Apparatus and method for controlling delivery of unsolicited electronic mail
US6061795A — Network desktop management security system and method
US6067410A — Emulation repair system
US6070244A — Computer network security management system
US6070190A — Client-based application availability and response monitoring and reporting for distributed computing environments
US6073172A — Initializing and reconfiguring a secure network interface
US6081894A — Method and apparatus for isolating an encrypted computer system upon detection of viruses and similar data
US6085224A — Method and system for responding to hidden data and programs in a datastream
US6088803A — System for virus-checking network data during download to a client device
US6088804A — Adaptive system and method for responding to computer network security attacks
US6092194A — System and method for protecting a computer and a network from hostile downloadables
US6094731A — Antivirus accelerator for computer networks
US6098173A — Method and system for enforcing a communication security policy
US6104783A — Method and apparatus for securing a site utilizing a security apparatus in cooperation with telephone systems
US6108799A — Automated sample creation of polymorphic and non-polymorphic marcro viruses
US6118940A — Method and apparatus for benchmarking byte code sequences
US6119234A — Method and apparatus for client-host communication over a computer network
US6119165A — Controlled distribution of application programs in a computer network
US6122738A — Computer file integrity verification
US6144961A — Method and system for non-intrusive measurement of transaction response times on a network
US6154844A — System and method for attaching a downloadable security profile to a downloadable
US6161109A — Accumulating changes in a database management system by copying the data object to the image copy if the data object identifier of the data object is greater than the image identifier of the image copy
US6173413B1 — Mechanism for maintaining constant permissions for multiple instances of a device within a cluster
US6185689B1 — Method for network self security assessment
US6199181B1 — Method and system for maintaining restricted operating environments for application programs or operating systems
US6205552B1 — Method and apparatus for checking security vulnerability of networked devices
US6220768B1 — Network asset survey tool for gathering data about node equipment
US6226372B1 — Tightly integrated cooperative telecommunications firewall and scanner with distributed capabilities
US6230288B1 — Method of treating whitespace during virus detection
US6266773B1 — Computer security system
US6266774B1 — Method and system for securing, managing or optimizing a personal computer
US6271840B1 — Graphical search engine visual index
US6275942B1 — System, method and computer program product for automatic response to computer system misuse using active response modules
US6275938B1 — Security enhancement for untrusted executable code
US6279113B1 — Dynamic signature inspection-based network intrusion detection
US6278886B1 — Device and method for inputting and transmitting messages in a predetermined sequence in a portable telephone
US6282546B1 — System and method for real-time insertion of data into a multi-dimensional database for network intrusion detection and vulnerability assessment
US6298445B1 — Computer security
US6301668B1 — Method and system for adaptive network security using network vulnerability assessment
US20010034847A1 — Internet/network security method and system for checking security of a client from a remote facility
US6314520B1 — Trusted workstation in a networked client/server computing system
US6314525B1 — Means for allowing two or more network interface controller cards to appear as one card to an operating system
US6321338B1 — Network surveillance
US6324656B1 — System and method for rules-driven multi-phase network vulnerability assessment
US6324647B1 — System, method and article of manufacture for security management in a development architecture framework
US6324627B1 — Virtual data storage (VDS) system
US6338141B1 — Method and apparatus for computer virus detection, analysis, and removal in real time
US6347374B1 — Event detection
US6353385B1 — Method and system for interfacing an intrusion detection system to a central alarm system
US6357008B1 — Dynamic heuristic method for detecting computer viruses using decryption exploration and evaluation phases
US20020032717A1 — Method and system for profiling network flows at a measurement point within a computer network
US20020032880A1 — Monitoring network traffic denial of service attacks
US6377994B1 — Method and apparatus for controlling server access to a resource in a client/server system
US6397245B1 — System and method for evaluating the operation of a computer over a computer network
US6396845B1 — Hierarchically interconnected routers for exclusively polling low activity network nodes to reduce polling traffic
US6397242B1 — Virtualization system including a virtual machine monitor for a computer with a segmented architecture
US6405364B1 — Building techniques in a development architecture framework
US6405318B1 — Intrusion detection system
US6408391B1 — Dynamic system defense for information warfare
US20020083331A1 — Methods and systems using PLD-based network communication protocols
US20020083334A1 — Detection of viral code using emulation of operating system functions
US6415321B1 — Domain mapping method and system
US6429952B1 — Browser interface to scanner
US6434615B1 — Method and apparatus for remote computer management using HTML in a web browser application and an internet server extension on an internet server API-compliant web server
US6438600B1 — Securely sharing log-in credentials among trusted browser-based applications
US6445822B1 — Search method and apparatus for locating digitally stored content, such as visual images, music and sounds, text, or software, in storage devices on a computer network
US6453346B1 — Method and apparatus for intelligent storage and reduction of network information
US6453345B2 — Network security and surveillance system
US20020138753A1 — Method and system for simplifying the structure of dynamic execution profiles
US6460141B1 — Security and access management system for web-enabled and non-web-enabled applications and content on a computer network
US20020144156A1 — Network port profiling
US6463426B1 — Information search and retrieval system
US6467002B1 — Single cycle modified round-robin arbitration with embedded priority
US6470449B1 — Time-stamped tamper-proof data storage
US6477585B1 — Filter mechanism for an event management service
US6477651B1 — Intrusion detection system and method having dynamically loaded signatures
US6487666B1 — Intrusion detection signature analysis using regular expressions and logical operators
US6493752B1 — Device and method for graphically displaying data movement in a secured network
US6499107B1 — Method and system for adaptive network security using intelligent packet analysis
US6510523B1 — Method and system for providing limited access privileges with an untrusted terminal
US6517587B2 — Networked architecture for enabling automated gathering of information from Web servers
US6519703B1 — Methods and apparatus for heuristic firewall
US6519647B1 — Methods and apparatus for synchronizing access control in a web server
US20030037136A1 — Method and system for monitoring control signal traffic over a computer network
US6530024B1 — Adaptive feedback security system and method
US6535227B1 — System and method for assessing the security posture of a network and having a graphical user interface
US6546493B1 — System, method and computer program product for risk assessment scanning based on detected anomalous events
US6563959B1 — Perceptual similarity image retrieval method
US6574737B1 — System for penetrating computer or computer network
US6578147B1 — Parallel intrusion detection sensors with load balancing for high speed networks
US6584454B1 — Method and apparatus for community management in remote system servicing
US6601190B1 — Automatic capture and reporting of computer configuration data
US6606744B1 — Providing collaborative installation management in a network-based supply chain environment
EP0985995B1 — Method and apparatus for intrusion detection in computers and computer networks
US6618501B1 — Object similarity calculation method and apparatus
US6628824B1 — Method and apparatus for image identification and comparison
US6647400B1 — System and method for analyzing filesystems to detect intrusions
US6647139B1 — Method of object recognition, apparatus of the same and recording medium therefor
US6661904B1 — Method and system for automated electronic conveyance of hidden data
US6668084B1 — Image recognition method
US6668082B1 — Image processing apparatus
US6681331B1 — Dynamic software system intrusion detection
US6691232B1 — Security architecture with environment sensitive credential sufficiency evaluation
US6711127B1 — System for intrusion detection and vulnerability analysis in a telecommunications signaling network
US6718383B1 — High availability networking with virtual IP address failover
US6721806B2 — Remote direct memory access enabled network interface controller switchover and switchback support
US6725378B1 — Network protection for denial of service attacks
US6725377B1 — Method and system for updating anti-intrusion software
US6775780B1 — Detecting malicious software by analyzing patterns of system calls generated during emulation
US6792144B1 — System and method for locating an object in an image using models
US6839850B1 — Method and system for detecting intrusion into and misuse of a data processing system
US6851057B1 — Data driven detection of viruses
US6871284B2 — Credential/condition assertion verification optimization
US6886102B1 — System and method for protecting a computer network against denial of service attacks
US6889168B2 — Method and apparatus for assessing the security of a computer system
US6912676B1 — Automated risk assessment tool for AIX-based computer systems

Classification

G06F21/552primary — Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
G06F21/51 — Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
G06F21/52 — Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
G06F21/53 — Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
G06F21/554 — Detecting local intrusion or implementing counter-measures involving event detection and direct action
G06F21/565 — Static detection by checking file integrity
G06F21/566 — Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
G06F21/629 — Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
G06F2221/2141 — Access rights, e.g. capability lists, access control lists, access tables, access matrices
G06F2221/2149 — Restricted operating environment

Family

US7673137B2 — B2 (2010)
US20070260880A1 — A1 (2007)
US20040025015A1 — A1 (2004)
US7565549B2 — B2 (2009)
2 foreign family members: AU2003202876A1, WO2003058451A1

Abstract

Managing and controlling the execution of software programs with a computing device to protect the computing device from malicious activities. A protector system implements a two-step process to ensure that software programs do not perform malicious activities which may damage the computing device or other computing resources to which the device is coupled. In the first phase, the protector system determines whether a software program has been previously approved and validates that the software program has not been altered. If the software program is validated during the first phase, this will minimize or eliminate security monitoring operations while the software program is executing during the second phase. If the software program cannot be validated, the protector system enters the second phase and detects and observes executing activities at the kernel level of the operating system so that suspicious actions can be anticipated and addressed before they are able to do harm to the computing device.

Also asserted by Taasera Licensing LLC

US 8,850,517 — Runtime risk detection based on user, application, and system action sequence correlation (3 defendants)

Named in one of these suits? A prior-art search is commissioned once and serves every defendant who shares it. The examiner's own search record is free on the tools page, and your first preliminary search is free — one claim, back within 24 hours — so you know whether there is art the Office never saw before anyone pays for more. Flat fees: $2,500$899 for the independent claims, $5,000$1,500 for every asserted claim.

Order a free preliminary search → How much prior art does an IPR petition need?

This page is assembled from public records — federal court dockets and the patent's own file — and is updated as the case list changes. It states what the record shows and is not an opinion on the validity or infringement of any claim. Patent data via Google Patents; docket data via CourtListener.