Patent ID: 6934857
Filing Date: 2005-08-23
Classification: G06F

Abstract:
1. A method for detecting potentially harmful actions on a handheld computer, the method comprising: monitoring calls to applications resident on the handheld computer; identifying a code associated with a program initiating said call; wherein identifying a code comprises identifying a creator code on a handheld computer operating system; and at least temporarily preventing an action requested by said call from being executed if the identified creator code does not match a creator code associated with data said action is to be performed upon; wherein the creator code is used to prevent malicious behavior; wherein at least one of the applications is identified as a trusted application; wherein the trusted application is not prevented from performing actions even if the creator code associated with the trusted application does not match the creator code associated with the data said action is to be performed upon; wherein the creator code is a 4-byte value used to tie together a plurality of databases related to an application, at least one database is maintained on the handheld computer using a first creator code that is the same as a second creator code associated with a plurality of patches, the at least one database contains a list of a plurality of the creator codes resident on the handheld computer, and at least one creator code is used to prevent a program from modifying one of the databases with a different creator code.