Selective authorization of the loading of dependent code modules by running processes
US8464050B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Apr 3, 2012 |
| Grant date | Jun 11, 2013 |
| Priority date | — |
| Expiry date | Apr 3, 2032 |
Classification
- Technology area (CPC Y)Emerging Cross-Sectional Technologies
- CPC primaryY10S707/99944
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Systems and methods for selective authorization of dependent code modules are provided. According to one embodiment, a kernel mode driver of a computer system intercepts file system or operating system activity, by a running process, relating to a dependent code module. Loading of the dependent code module is selectively authorized by authenticating a cryptographic hash value of the dependent code module with reference to a multi-level whitelist. The multi-level whitelist includes a global whitelist database remote from the computer system, maintained by a trusted service provider and which contains cryptographic hash values of approved code modules known not to contain viruses or malicious code; and a local whitelist database that includes cryptographic hash values of a subset of the approved code modules. The running process is allowed to load the dependent code module when the cryptographic hash value matches one of the cryptographic hash values of the approved code modules.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.