System and method for verifying digital signature for file

Abstract

To provide a system and a method for verifying a digital signature (DS) for a file.SOLUTION: In a system including a data transfer apparatus and a certificate database, a check tool of the data transfer apparatus is configure to: determine whether a DS certificate is valid by checking whether the DS certificate has the required integrity and by authenticating issuing center data; determine whether a DS is valid by checking whether a file has proper integrity and the DS certificate is valid; if the DS certificate is valid, determine whether the DS certificate can be trusted by retrieving credential data associated with DS certificate data; and if the digital signature is valid and the DS certificate is trusted, classify at least one file as trusted.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This application is filed on Dec. 28, 2018, which is incorporated herein by reference in its entirety. This application claims the benefit of Russian Federal Patent Application No. 2018147246 filed on 23 December 2018. , filed September 6, 2017, which is also incorporated herein by reference in its entirety. "System and method for resilience against attacks in verifying digital signatures of files" System and Method for Attack Resiliency in Verifying Digital Signatures This application is related to U.S. patent application Ser. No. 16 / 563,207, entitled "Polymer-Based Fluorescence Imaging System."

[0002] (Technical field) The embodiments relate generally to computerized digital signatures, and more particularly to digital signatures. and regarding checking digital signature file certificates. [Background technology]

[0003] (background) Malicious applications have become more common, increasing the risk of unauthorized access and use. Improved antivirus software aimed at protecting user data and user devices from malicious use. Antivirus technology is needed. In the never-ending race, developers are especially focused on two areas of malicious file detection: We are faced with the important task of reducing type I errors (false positives). A type II error is when a malicious file is identified as malicious. The problem is the failure to identify certain files as malicious.

[0004] To reduce the number of type I errors, developers of antivirus applications should, for example, Remove files identified as malicious using heuristic analysis. They use a variety of techniques to ensure that users are not removed or quarantined. One such technique is the use of credit facilities. Such checks include checking files against a database of known files. The check is performed on files that have been identified as malicious in the database of trusted files. ID (e.g. MD5 or SHA-1 checksum) and if the same ID is found there, The decision to classify the file as malicious is cancelled. To reduce Type I errors Another method is to use an electronic digital signature ("DS" or simply ".ds") of a file that is identified as malicious. This is a check of the "digital signature" (the

[0005] To check the digital signature, antivirus applications use the CryptoAPI Use the DS checking tool built into your operating system ("OS"), such as For example, U.S. Patent Application Publication No. 2017 / 0257361A1 states that An approach for executable code verification based on the results of DS checks is described. However, this approach has the drawbacks of being relatively slow in performing DS checks and being vulnerable to criminal activity. It has some drawbacks, such as being vulnerable to attacks. You need to deal with attacks against it.

[0006] Therefore, the effectiveness of digital signatures is important in reducing type I and type II errors. Or there is a need to check reliability reliably and efficiently. Summary of the Invention [Means for solving the problem]

[0007] (overview) The embodiments of the present application substantially fulfill the above-mentioned needs of the industry. The embodiment verifies the validity and authenticity of the digital signature and the digital signature certificate in an existing system. The present invention provides a system and method for more efficient and accurate evaluation.

[0008] In one embodiment, a system for verifying a digital signature of at least one file includes: A certificate database configured to store multiple certificates; a credential database configured to store: Computer hardware of at least one processor and the at least one processor a memory operatively connected to said data transfer device; and instructions, said instructions being When executed on a computer platform, the computer platform: A digital signature including a DS certificate having transaction center data and DS certificate data Retrieve at least one file and check whether the DS certificate has the required DS certificate integrity. and authenticating the issuing center certificate in the certificate database. Determine whether the DS certificate is valid and whether the at least one file is a required file. The digital signature is verified by checking that the digital signature is valid and that the digital signature is consistent. If the DS certificate is valid, the DS certificate data is determining whether the DS certificate can be trusted by searching the associated credential data; If the digital signature is valid and the DS certificate is trusted, then at least Implements a checking tool that is configured to classify a single file as trusted. do.

[0009] In one embodiment, a method for verifying a digital signature of at least one file comprises: A small number of digital signatures including a DS certificate having issuing center data and DS certificate data obtaining at least one file; determining whether the DS certificate has the required DS certificate integrity; and by authenticating the issuing center certificate. determining whether the DS certificate is valid; determining whether the at least one file is a required file; The digital signature is verified by checking that the digital signature is valid and that the digital signature is consistent. determining whether the DS certificate is valid; if the DS certificate is valid, By searching the credential database for credential data related to the data determining whether the DS certificate can be trusted; and determining whether the digital signature is valid and If the DS certificate is trusted, the at least one file is classified as a trusted file. The method includes the step of:

[0010] In one embodiment, the computing device includes at least one processor and a memory operatively connected to the processor; and instructions, the instructions being transmitted to the processor; When executed, the processor: Obtain at least one file with a digital signature that contains a DS certificate. By checking whether the Issuing Center Certificate has a valid DS certificate integrity, determining whether the DS certificate is valid by authenticating the at least one file; by checking that the file has the required file integrity and that the DS certificate is valid. If the DS certificate is valid, by searching a credential database for credential data related to the certificate data Determine whether the DS certificate is trustworthy and verify that the digital signature is valid and the DS certificate is If the certificate is trusted, classify the at least one file as trusted. Implement the checking tools configured in.

[0011] The above summary does not encompass each illustrated embodiment or every implementation of the present subject matter. The drawings and the detailed description that follow are not intended to illustrate, but are not to be construed as limiting the present invention. A more specific example will be given.

[0012] BRIEF DESCRIPTION OF THE DRAWINGS The subject matter of the present invention will become more readily apparent from the following detailed description of various embodiments when considered in conjunction with the accompanying drawings, in which: would be more fully understood. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram of a system for verifying a digital signature of a file, according to one embodiment. [Diagram 2] FIG. 2 is a block diagram of a system for verifying a digital signature of a file according to another embodiment. [Diagram 3] FIG. 3 is a flowchart of a method for verifying a digital signature of a file according to one embodiment. [Figure 4]FIG. 4 is a flowchart of a method for combating attacks on a computing device, according to one embodiment. [Diagram 5] FIG. 5 is a block diagram of a computer system configured to implement an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] While the various embodiments are susceptible to various modifications and alternative forms, details thereof will be described by way of example only. Although shown in the drawings and described in detail, certain embodiments which set forth the claimed invention are It should be understood that the present invention is not intended to be limited to the embodiments disclosed herein. Rather, the present invention is limited to the embodiments disclosed herein. All modifications, equivalents, and alternatives falling within the spirit and scope of the subject matter defined in the claim. is intended to include.

[0015] Detailed Description of the Drawings The following definitions and concepts are used throughout the description of specific embodiments.

[0016] For example, in one embodiment, a malicious application is a computer or It has the ability to cause damage to user data of a computer (in other words, the computer system). applications that exploit the The damage can be for the purpose of theft, as well as for example unauthorized storage or Computer programs, including data stored on the computer, for the purpose of exploiting resources such as performing calculations This could consist of unauthorized access to computer resources.

[0017] In one embodiment, a trusted application is an application that is designed to prevent harm to a computer or its user. An application can be any application that is not trusted. If the data is developed by a trusted source (e.g., a trusted site), If it is downloaded from a site included in the database, or if the application ID ( or other data that allows for the precise identification of the application - e.g. The hash value of the application file is stored in the trusted application database. If the product has a manufacturer ID such as a digital certificate, it can be considered trustworthy. The credit application may be stored in a database.

[0018] In one embodiment, an untrusted application is an application that is not trusted but may be malicious. For example, it may refer to applications that are not trusted or malicious. The presence of a virus can be assessed by an antivirus application. The application is identified as malicious after using an antivirus check, for example. It can be certified.

[0019] In one embodiment, a malicious file is a component of a malicious application. and includes files that contain program code (e.g. executable or interpreted code). It could be.

[0020] In one embodiment, an untrusted file is a component of an untrusted application. A file that contains program code (e.g., executable code or interpreted code). obtain.

[0021] In one embodiment, a trust file is a file that is a component of a trust application. It could be that.

[0022] In one embodiment, checking the DS of a file is done if the very file being checked is It is specified to check whether the DS is signed by the owner of the certificate attached to the DS. The first step of the check is to check the decrypted file from the DS of the file. The checksum is obtained by using the algorithm specified in the DS certificate. The checksum from the DS file is compared with the public key specified in the DS certificate. If the checksums match, the file integrity is confirmed. The next step is to verify the validity of the DS certificate, which is done in the same way: The embodiment is a method for verifying the integrity of a DS certificate for a file and the identity of the person who issued the DS certificate for the file. Check the validity of the certification center's certificate (this process continues up to the root certificate) The certificate is issued if its integrity is verified and if the certification center that issued it has verified its integrity. If the certificate is valid, it is considered valid. If not, the certificate is invalid. If the DS certificate is considered valid and the file is considered to have the required integrity, In other embodiments, a DS certificate is considered valid if If the file has not been modified since it was signed, the DS is considered valid. If not, the DS is considered invalid. In a particular embodiment, the DS certificate is The certificate attached to the DS of the file that allows checking the validity of the DS of the file (see In a specific embodiment, the certificate is a certificate conforming to the X.509 standard. This means a statement.

[0023] In one embodiment, a tool of the system for checking the DS of a file in the present invention is an application specific integrated circuit (ASIC) or field programmable gate array. Using hardware such as FPGAs, or integrated with a microprocessor system, A combination of software and hardware, such as a series of program instructions, and a neurosynthesis system Actual devices, systems, components, and groups of components designed as optical chips The functionality of the above-mentioned system tools may be provided solely by hardware or by a The functionality of the system tools is partly software and partly hardware. In some embodiments, the combination of 5. A part or all of the data may be transferred to a processor of a computerized device (e.g., The components of the system may be implemented using a single computer. The design can be performed locally on one computer or distributed across several linked computers.

[0024] In one embodiment, the DS checking system includes a checking tool and a certificate database. In another embodiment, the system includes a security tool.

[0025] Referring to FIG. 1, a system for verifying a digital signature of a file, according to one embodiment, is shown. In one embodiment, the system includes a check tool and In one embodiment, the checking tool 120 collects data (e.g., For example, data received from a network may be configured to be sent to the user computer 140. In one embodiment, the user The data sent to the computer 140 may be a file 110. The may be a router or any other computing device such as a proxy server. In an embodiment, data transfer device 135 is designed to store data for later distribution. For example, the data transfer device 135 may be a computer device that is later transferred to an employee's computer. Update files for multiple computers in a company network to transfer files to the The update server may include an update server for receiving the update.

[0026] In one embodiment, the system further includes a security tool 125. As such, the security tool 125 is also resident in the data transfer device 135 .

[0027] In one embodiment, the system includes a certificate database 130 and a credential database 131. 31, each of which is adapted to be operatively connected to a checking tool 120. The databases 130 and 131 are configured as follows: It may reside on a remote server connected (eg, via a network) to the device 135 .

[0028] File 110 may include a file with a DS. For example, file 110 may be an executable file. In another embodiment, the executable file may be a Windows or script file. It supports operating systems from the Unix family, especially Windows OS, Ubuntu Linux OS, MacOS, etc. It is an executable file for the operating system.

[0029] Referring to FIG. 2, a system for verifying a digital signature of a file according to another embodiment is shown. Specifically, FIG. 2 shows an alternative implementation of the check system. In the embodiment shown, a security tool 125 and a checking tool 120 are 140. Also, the certificate database 130 and the trust database 140 are connected to the check tool 120. The certificate database 131 is connected to a computer device 140 or to the computer using a network. The information may reside on a remote server connected to computer device 140.

[0030] Referring again to both FIG. 1 and FIG. 2, the certificate database 130 is configured to store certificates. In one embodiment, the certificate database 130 also stores information about whether a certificate has been revoked. In a particular embodiment, the method stores information about each certificate indicating whether the certificate has been The document database 130 is compatible with Windows and Unix families, e.g. Windows, Ubuntu Linux, or multiple (at least two) operating system certificates, such as MacOS (so Thus, the certificate database 130 stores various operations, The rating system certificate can be stored for each operating system. The system's DS check system tool is used separately as in the conventional system In addition, in one embodiment, the certificate database 130 stores the root certificate Only the certificate and the Certification Center's certificate will be stored.

[0031] The credentials database 131 is configured to store credentials. In one embodiment, the credential database 131 does not store the certificates themselves, but rather In one particular embodiment, the certificate data is Similar to database 130, credential database 131 stores information about certificates for multiple operating systems. The method is configured to store the information.

[0032] In the context of this disclosure, an "OS Certificate" (or simply an "OS Certificate") is a certificate issued by an OS (or may be present in the system store of certificates for one OS family, but not for another OS family. This situation can occur for several reasons: It is possible.

[0033] For example, an OS developer may choose to exclude encryption algorithms that the developer considers cryptographically weak. In one particular example, Windows O S developers use the SHA-1 encryption algorithm when checking the validity of DS in the Windows 10 OS. (and therefore will stop using certificates that specify this algorithm).

[0034] Another example is the use of a cryptographically strong encryption algorithm to check the validity of the DS. Support for system storage of certificates with The Windows 7 OS provides one such example, which initially Only the SHA-1 encryption algorithm was supported, but only SP1 was updated. Added A-256 support.

[0035] In another example, an OS developer may issue a set of specifications to software developers related to a particular subsystem. The certificates stored in the system storage device do not need to be added. For example, the certificates stored in the Windows 8 OS only need to be added to the system storage device. The root certificate used to check the DS for Metro applications is the Windows 7 OS certificate. not present in the system storage device.

[0036] In another example, a MacOS developer might use it to check the DS of a Windows executable. Do not add any certificates (especially root certificates) that have been installed to the Mac system storage (and vice versa) In other words, the system storage of one OS checks the executables of other OSes. It is not necessary for the RFC1122 to include the certificates used to authenticate the FTP server (especially the root certificate).

[0037] Similar to the examples provided herein, a certificate from an existing system storage (e.g., There are numerous other reasons for the exclusion of a strict stricture (root certificate), including but not limited to:

[0038] As discussed above, in certain embodiments, the system store of certificates includes The database may include a database including a check of a DS, such as a file DS. This is used by the DS check system tool for the above example. The meaning includes the contents of the system storage of certificates, and the use of the system storage of certificates to DS (In particular, the methods used to check the validity of DS and certificates In addition, the specific implementation of the encryption algorithm may include an information technology expert. So, the data stored in databases 130 and 131 is processed by such information technology professionals. The contents of the JP1 / ITA Agreement may be added, modified, or deleted.

[0039] 1 and 2, the checking tool 120 checks whether the DS is valid. to check the DS of file 110 and if the certificate is valid and trusted It is designed to check the certificate in file DS110 to verify the validity of the DS. The validity is checked in two stages, which are carried out simultaneously and independently of each other. can be done.

[0040] The first step is to check the integrity of the file 110. To this end, a tool 120 The decryption checksum of file 110 from the DS of file 110 is performed using the algorithm specified in the certificate of the DS. The checksum of the file 110 is compared with the checksum obtained using the checksum from the DS of the file 110. Check the checksum with the public key specified in the DS certificate. If the checksum is the same, If so, the check tool 120 checks the integrity of the file, i.e., the file 110 Determine whether or not has changed.

[0041] The second stage of the DS check of the file 110 checks the validity of the DS certificate. In this manner, the checking tool 120 may, for example, select a certificate from the certificates available in the certificate database 130. Checks the validity of a certificate by building a certificate chain up to a root certificate. The DS certificate of file 110 (and any other certificates) is Proper integrity (checking certificate integrity is similar to checking file integrity above) If the DS certificate in file 110 is issued by the certification center, the DS certificate in file 110 must be issued by the certification center. In one embodiment, the DS certificate of the file 110 is also considered valid. All certificates used to check the certificates are stored in the certificate database 130. An incremental check of the validity of a certificate involves building a certificate chain. For example, when the check tool 120 checks the certificate of the DS of the file 110, You can create a certificate chain up to the root certificate stored in the database 130. If the certificates in the certificate chain have proper integrity and the If the last certificate in the chain is a root certificate, the DS certificate in the file 110 is valid. If not, the DS certificate in file 110 is deemed valid. In one embodiment, the DS of the file 110 is not recognized (e.g., is recognized as invalid). If the certificate is invalid, the checking tool 120 identifies the file as an untrusted file. Determine.

[0042] If the DS certificate of the file 110 is valid, the checking tool 120 checks whether the following conditions are met: If so, the DS certificate of the file 110 can be recognized as trustworthy: DS certificate (or the ID of such a certificate - e.g., a SHA-1 or SHA-256 checksum, or A vector value that positively identifies the certificate is present in the credential database 131 or the certificate is The certificate of the issuing certification center is trusted. In one embodiment, it is certified as trusted. For a DS certificate to be valid, further conditions must be met. In particular, the certificate data The database 130 must not contain information that a certificate has been revoked. In embodiments, additional conditions must be met for a DS certificate to be considered trustworthy. In particular, DS certificates must not be expired (there is a The indicated period has not ended.

[0043] In one embodiment, for a certificate to be recognized as valid, the certificate database 131 It is sufficient to include information about the certificate (e.g., the certificate ID). In this case, Certification of the S certificate is not done as a separate step. Rather, it is a matter of whether the DS certificate can be trusted. This is verified at the stage of checking the validity of the DS certificate of the file 110.

[0044] In one embodiment, the checking tool 120 is also configured to determine the category of the file 110. (Or to classify files into a category; in other words, to classify files into a category The tool 120 is configured to verify that the file's DS is valid. If the DS certificate is trusted, the file 110 is recognized as trustworthy (file 1. Determine that the file 110 belongs to the category of trusted files, in other words, file categories).

[0045] DS-CHECK is used to check the validity of the DS certificate and therefore the validity of the DS of file 110. By using database 130 instead of the check system tool, the check tool 1 20 has advantages over conventional systems. For example, The system registers certificates, which store the certificates used to sign only certain types of files. storage device (e.g., the system storage device for certificates in Windows OS is the executable file in Unix-type systems) Unlike the DS check of the file, which does not store the certificate including the root certificate, The database 130 is used to sign files for any operating system. In one embodiment, if the file is an executable file for the OS, the The file is OS-compatible. This allows the DS certificate of file 110 to be recognized as valid. The decision to determine whether the DS of the file 110 is valid and therefore the decision to determine whether the DS of the file 110 is valid. The category of the file 110 determined based on checking the DS and the DS certificate is correct. This ensures accuracy, especially the reduction of type I errors.

[0046] The security tool 125 is configured to protect the device 140 from untrusted files. In one embodiment, protection includes prohibiting the execution of non-trusted files or blocking such files. In yet another embodiment, the security tool The security rule 125 prevents the transfer of untrusted files to the computing device 140. The blocking tool 125 may block the transfer of the file 110 to the computing device 140 . In another embodiment, the security tool 125 may: The untrusted files never reach the computing device 140 .

[0047] In one embodiment, the security tool 125 performs a DS-check on the user computing device 140. It is further configured to detect attacks made against the system tools. The system tools provided with the operating system and are used to verify the DS certificate and / or Or it could be a software tool designed to check the DS itself. For example, The ntrust.dll library serves the functions of such tools in the Windows OS, while Keychain or the GateKeeper software component is not compatible with such MacOS operating system. In one embodiment, the attack against the DS-Check system tool includes: Modify or replace one or more system program modules that check DS certificates. In this case, the detection of an attack against the DS certificate checking tool could lead to a security breach. The assurance tool 125 is one or more system programs that check whether a DS certificate is malicious. The device is also configured to determine a RAM module.

[0048] As described herein and as already pointed out, the system tools can be used to check the DS certificate. The specific ability to check is based on the limited certificates available to the DS Certificate-Checking System tool. A set of certificates (for example, in the Windows certificate store or the MacOS Keychain certificate store) A limited set of certificates may be used to authenticate users.

[0049] Referring to FIG. 3, a method for verifying a digital signature of a file, according to one embodiment. A flow chart of the method of FIG. 3 is shown, for example, in the system of FIG. It is possible.

[0050] At 301, the checking tool 120 checks the file 110, etc., to be further transferred. In this case, the file 110 is a data file that contains a checking tool 120. The data is then transferred by the data transfer device 135 over the network to the user computer device 140. In an embodiment, intercepting the file 110 may include intercepting data from the file 110 or intercepting data from the file 110. In another embodiment, the method includes receiving data related to the For example, the file 110 cannot be intercepted until the file 110 is recognized as a trusted file. , interrupting (using security tool 125) the transfer of file 110 to computing device 140 The present invention further includes:

[0051] Next, the file DS is checked. In particular, at 302, the checking tool 120 checks the file The DS certificate of the file 110 is checked to see if it has the proper integrity. If the DS certificate is issued by a certification center that has issued the DS certificate, the DS certificate is valid. The validity of the certificate is checked using the certificate database 130. The certificate database 130 may include a set of certificates with an indication of whether each certificate is trustworthy. Thus, the credentials from the certificate database 130 may include the certificate of the authentication center. The process of checking the validity of a certificate chain is It may continue up to the first credential in the certificate chain or up to the root certificate.

[0052] At 303, the checking tool 120 determines if the DS certificate is valid and if the file 110 is in proper If the file is consistent, the file's DS is determined to be valid. The S certificate is generated if the certificate is valid and if the certificate database 130 determines that the DS certificate is trustworthy. If the DS Certificate contains information that indicates that the certificate issued by the certification center is trustworthy, If it is possible, it is certified as trustworthy. The execution of 303 and 304 is independent of each other, This can be done in any order.

[0053] If the DS certificate is trusted and the DS is valid, then in 305 the file 110 is In other words, the file 110 is classified - the file is identified as a trusted file. If not, then in 306 the file 110 is determined to belong to the category of untrusted files. It is classified as a file for use.

[0054] If the file 110 is not recognized as a trusted file according to the classification, the security tool The file 11 is then deleted, causing the file manager 125 to stop all further transfers to the user computing device 140. Delete all data associated with 0 (e.g., residing in data transfer device 135); or The file 110 may be quarantined.

[0055] The method implemented by the system includes a system tool based certificate checking solution. For example, the certificate database 130 can be used for various operations. In accordance with the present invention, an embodiment may include a single operating system certificate. Compared to a similar system that checks only certificates from the same family, the number of certificates in file 110 is Less erroneous responses when determining categories. More specifically, the valid (and trusted) Executable files with certificates can be trusted using only the Windows OS certificate store. Therefore, the embodiment solves this problem; i.e., Type I error when determining the category of a file by storing the certificate of its family The importance of this solution is that the check tool 120 An enterprise may have many user computing devices 140 each having a different operating system. This is evident when the router or proxy server of the corporate network is In the network, the data transfer device 135 transfers DS certificates belonging to different operating systems. The file 110 containing the certificate is transferred to the server. The check tool 120 and the security tool 125 "Filter" files downloaded from the network (e.g., corporate networks) (blocking the transfer of files to a computing device 140 included in the network) do.

[0056] In yet another embodiment, tools 120 and 125 reside on a user computing device. The method allows a user to control a device 140 having an OS different from the OS controlling the device 140. DS signed files that will be launched on a virtual machine installed on This allows for a reduction in the number of incorrect responses when determining the 110 categories. Since sources 130 and 131 contain information about certificates for various operating systems, The check tool checks the executable files of an OS different from the OS that controls the user computer device 140. This is achieved by the fact that the certificate of the file can be checked accurately.

[0057] Referring to FIG. 4, in accordance with one embodiment, a method for combating attacks against a computer device is provided. 4 is a flow chart of a method for performing a method of the present invention, for example, by the system of FIG. It can be implemented.

[0058] At 400, the security tool 125 generates one or more systems for checking the DS of the file. Detect attacks against user computing devices 140 that target system tools. At 01, a security tool 125 searches for an unclassified file 110. For example, The analysis tool 125 searches for the ID of the file 110 (e.g., SH The file database is configured to search for the A-1 or MD5 checksum. The file 110 belongs to a category of files, e.g., trusted files or non-trusted files. The security tool 125 may include data indicating that the file is to be If the category of the file 110 cannot be determined using the provided request, the following process will be used: In this case, the file 110 is accessed by any new For example, a file may be downloaded from a network. downloaded, created on a computing device, or already present on the computing device 140 A new file obtained by modifying an existing file or a modified file It can be yl.

[0059] Next, a DS check is performed on the file. At 402, the check tool 120 checks the file 110 The DS certificate is checked. If the DS certificate has the proper integrity, If the certificate of the certification center that issued the DS certificate is valid, the DS certificate is considered valid. The validity of the certificate can be checked using the certificate database 130. The certificate database 130 includes a certificate center that has an indication of whether each certificate can be trusted. Therefore, the credentials from the certificate database 130 are valid. The process of checking the validity of a certificate chain is The procedure may continue up to the first valid certificate in the application or up to the root certificate.

[0060] At 403, the checking tool 120 checks if the DS certificate is valid and if the file 110 is needed. If so, the file's DS is deemed valid. If the DS certificate of the file is valid, and the certificate database 130 does not If the certificate contains information that the DS Certificate is trustworthy, or if the certificate of the certification center that issued the DS Certificate is If the authentication is trustworthy, it is determined to be trustworthy. In an embodiment, 403 and 404 are mutually independent. These steps are separate and can be performed in any order.

[0061] If the DS certificate is trusted and the DS is valid, then in 405 the file 110 is In other words, the file 110 is classified - the file is identified as a trusted file. If not, the file 110 is determined to belong to the category of untrusted files at 406. It is classified as a file for use.

[0062] If the file 110 is not recognized as a trusted file according to the classification, the security tool The file 125 retrieves data (e.g., For example, the data of the file may be deleted or the file 110 may be quarantined.

[0063] The method shown in Figure 4 is a countermeasure to system tool-based certificate checking solutions. For example, attacks against DS check system tools can be performed using the Components of the check system tool may be substituted or damaged, resulting in inaccurate To function, the DS check system tool accurately checks the certificate of the file DS. This makes it impossible to determine whether the DS is valid and whether the certificate can be trusted. This makes it impossible to accurately determine the category of a DS-signed file based on whether it is One example of such an attack is the substitution of components of the DS Check System tool. Therefore, security tools, especially antivirus applications, must be aware of the weakened DS checks. Based on the information on DS validity and DS certificate validity provided by the network system tool By determining their category based on the The embodiments described herein detect attacks against the DS check system tool. If such an attack is detected, the certificate may be revoked or revoked if it is deemed valid and trustworthy. Determine the category of the file 110 using the certificate database 130, which provides all the authentic information This solves the above problem.

[0064] In one embodiment, the attack against the DS checking system tool is a more sophisticated attack; e.g. , may be part of a persistent targeted attack. In this case, the security tool 125 It is extremely important to protect the computer device 140 from attacks. The tool 125 checks all firewalls that appear on the device 140 during an attack on the DS check system tool. For example, the duration can be determined by the attack type. The time of the attack may be within 24 hours of the date and time of the attack (not from the date and time the attack was detected). For example, this can be determined by the date and time of the change of the component in the DS Check System Tool. In this case, the check can be performed as part of a check initiated by the security assurance tool 125. Files that have not been identified as trusted files using tool 120 are deleted by tool 125. Such files are identified as potentially malicious by, for example, a classification algorithm. or for more detailed analysis using neuronal networks, or for information security It can be sent to a remote server for expert analysis. The tool 125 receives a decision from the remote server to authorize all files and determine whether the files are malicious. If a malicious program is detected, the security assurance tool 125 will detect the persistent targeted attack and Take necessary steps (e.g., delete or quarantine) with respect to files identified as having cormorant.

[0065] In another embodiment, the systems and methods described herein include a DS check system tool Not only when the DS check system tool is under attack, but also when the components of the DS check system tool are before it is loaded into RAM (for example, when the Windows OS starts and Wintrust.dll is not yet loaded into RAM). If you are unable to use the DS Check System Tool at all for any reason, such as when the DS Check System Tool is not installed, It also has advantages when this is not possible.

[0066] The use of the checking tool 120 to check the validity of the DS of the file 110 has the advantages mentioned above. (The system storage device does not have a valid DS because it does not have a certificate for multiple OS files. In addition to having the advantage of reducing the number of Type I errors when a test is deemed valid, Also increase the speed.

[0067] One of the reasons why DS validity checks using Tool 120 are faster is because the DS check system System tools (especially Windows OS tools) are used to check the validity of the certificate. To load a list of revoked certificates and determine if a certificate has been revoked In these conventional methods, the entire list of revoked certificates is checked. In contrast, the checking tool 120 checks each certificate for the presence of Simply call the certificate database 130 which can mark it as revoked This checks whether the certificate has been revoked. The tool 120 checks the validity of the DS of the file 110 faster than the DS check system tool. .

[0068] Another reason for the faster speed of DS validity checking using the check tool 120 is that the database This is because the server 130 does not store copies of certificates. For example, in the conventional DS check system tool, In tools such as Windows OS tools, a copy of the certificate is added to the Windows certificate store. When a certificate is reissued, the certificate is reissued with the same public key. In contrast, a single DS in file 110 The creation and checking of multiple certificate chains for a certificate is prevented.

[0069] Another reason for the faster speed of DS validity checking using the checking tool 120 is that the This is because the system tools can be extensible. For example, in the Windows OS, An external application that complements the logic of the DS certificate validity by performing a check on allows the use of the CryptoAPI interface, which provides a means to verify the validity of the DS. The speed of judgment in the event of a collision is slower.

[0070] Referring to FIG. 5, aspects of the invention described herein may be implemented in accordance with various embodiments. 5, a more detailed illustration of a computer system 500 capable of performing the above-described steps is shown.

[0071] The computer system 500 includes one or more processing units 521, system memory 522, and a processor 524. A computer device such as a personal computer 520 including a network 522 and a system bus 523. The system bus 523 may include one or more processing units 521. Various system components, including associated memory, may be included. In various embodiments, The processing unit 521 is a multimedia device capable of processing information stored in a computer-readable medium. The system bus 523 may include any bus structure known in the art. The system bus 523 is implemented as a bus memory or a bus memory controller, a peripheral bus The system includes a local bus that can interact with the system bus, and any other bus structure. The memory may be a non-volatile memory such as a read only memory (ROM) 524 or a random access memory. The system may include a volatile memory such as RAM 525. A basic input / output system (BIOS) 526 may include, for example, During boot of an operating system using the OM524, the personal computer 520 It contains basic procedures that ensure the transfer of information between elements.

[0072] The personal computer 520 then connects to a hard drive 5 for reading and writing data. 27, a magnetic disk drive 5 for reading and writing to a removable magnetic disk 529 28, and for removable optical disks such as CD-ROMs, DVD-ROMs, and other optical media 531. The hard drive 527 and the magnetic drive 528 are connected to the optical drive 530 for reading and writing data. 528 and optical drive 530 are respectively connected to a hard drive interface 532, a magnetic drive and an optical drive interface 534. 523. These drives and corresponding computer information media are Computer instructions, data structures, program modules, and other data for use in a personal computer This provides an energy independent means for storing data in the data buffer 520.

[0073] The system shown includes a hard drive 527, a removable magnetic drive 529, and a removable A removable optical disk 530 is included, which is connected to the system bus 523 via a controller 555. , other types of computer media capable of storing data in computer-readable form (e.g. Solid state drives, flash memory cards, digital disks, random access memory It should be appreciated that a RAM or other memory may also be used.

[0074] The computer 520 includes a file system in which a recorded operating system 535 is stored. system 536, as well as additional program applications 537 and other program engines 538. , and program data 539. The user can input the program using input devices (keyboard 540, mouse 542) can be used to enter commands and information into the personal computer 520. Input devices (not shown), such as a microphone, joystick, game console, scanner, etc. Such input devices are typically connected to the system bus. Serial port 546 connects to computer system 520. Type, e.g., parallel port, game port, or universal serial bus (USB) A monitor 547 or other type of display device may also be connected using A video adapter 548 or other interface is connected to the system bus 523. In addition to the input / output terminal 547, the personal computer 520 may also include other peripheral outputs such as speakers and a printer. A device (not shown) may be provided.

[0075] The personal computer 520 may operate in a network environment; in this case, 549. The personal computer(s) 549 may be used to access the contents of the personal computer 520 shown in FIG. A similar personal computer having most or all of the above elements mentioned in the description. A computer or server. A computer network also includes routers, network stages, other network nodes, such as a peering device, The device may also include a

[0076] Network connections include Local Area Network (LAN) 550 and World Area Network (WLAN) 550. Such a network can be used to connect corporate computers to a WAN. Used in data networks or corporate intranets, usually with access to the Internet In a LAN or WAN network, the personal computer 520 A local area network 550 via an adapter or network interface 551 When using a network, the personal computer 520 is connected to a modem 554. or other means for connection to a world area network such as the Internet. The modem 554 may be an internal or external device and may be connected to the serial port 546. These network connections are merely examples. It does not necessarily reflect the actual network configuration; Obviously, there are other ways to establish a connection using technical communication means between the data subjects. cormorant.

[0077] Various implementations of systems, devices, and methods have been described herein. The embodiments are presented by way of example only and are not intended to limit the scope of the claimed invention. Moreover, the various features of the previously described embodiments may be combined in various ways to produce multiple It is understood that further embodiments may be made. Additionally, various materials, sizes, shapes, Although the configuration, location, and other aspects of the disclosed embodiment have been described for use, In addition, others may be utilized without departing from the scope of the claimed invention. .

[0078] Those skilled in the art will appreciate that the subject matter of the present invention may be realized by any of the features exemplified in any of the individual embodiments described above. It will be understood that the embodiments described herein may include fewer features than those described above. is meant to provide a comprehensive presentation of the ways in which the various features of the subject matter can be combined. Thus, embodiments are not limited to mutually exclusive combinations of features; rather , various embodiments may be selected from different individual embodiments, as will be appreciated by those skilled in the art. In addition, elements described in relation to one embodiment may be combined in any combination. Unless otherwise specified, other embodiments may be used even if not described in such an embodiment. It can be implemented in various ways.

[0079] A dependent claim is a claim that is intended to be combined with one or more other claims in a specific manner. Although the present invention may refer to a combination of the subject matter of the dependent claims, other embodiments may refer to a combination of the subject matter of the dependent claims with the subject matter of each of the other dependent claims. or a combination of one or more features with other dependent or independent claims. Such combinations are not contemplated unless expressly stated to be the case. Unless otherwise suggested herein.

[0080] Any incorporation by reference of the above documents is hereby expressly incorporated by reference in its entirety for any purpose whatsoever. All incorporation by reference of the above documents is expressly permitted without limitation.

[0023] The present application is further limited as to not incorporating by reference any claims therein. All incorporations by reference of the above documents are expressly incorporated herein by reference. Furthermore, any definitions provided in the literature are not to be incorporated herein by reference. Limited to.

[0081] For purposes of claim interpretation, a claim may contain "means for" or "means for Unless the specific term "step" is used, the provisions of 35 U.S.C. § 112(f) are applicable. It is expressly intended that this does not apply.

Claims

1. A system and method for verifying a digital signature of a file.

2. 1. A system for verifying a digital signature of at least one file, comprising: a certificate database configured to store a plurality of certificates; a credential database configured to store credential data; and 1. A data transfer device comprising: At least one processor of computer hardware and at least one processor a memory operatively connected to the processor; and the data transfer device including instructions; When the instructions are executed on a computer platform, the computer platform The room is: A digital signature including a DS certificate that contains issuing center data and DS certificate data. Get at least one file that By checking whether the DS certificate has the required DS certificate integrity, and The DS certificate is validated by authenticating the issuing center certificate with the certificate database. Determine whether there is At least one of the files has the required file integrity and the DS certificate is valid determining whether the digital signature is valid by checking whether If the DS certificate is valid, verify the credential data associated with the DS certificate data. Determine whether the DS certificate can be trusted by searching for the If the digital signature is valid and the DS certificate is trusted, then Implement a checking tool that is configured to classify a file as a trusted file. The system.

3. The checking tool determines that the digital signature is invalid or that the DS certificate is invalid. If the at least one file is untrusted or untrusted, the at least one file is treated as an untrusted file. and further configured to classify the The data transfer device further includes instructions, the instructions being adapted to transmit the data to the computer platform. When executed, the computer platform If the file is classified as untrusted by the checking tool, the user computer device a security mechanism configured to restrict access to the at least one file of the device; 3. The system of claim 2, further comprising a fault detection tool.

4. The plurality of certificates in the certificate database are associated with a first operating system. a first certificate for a first operating system and a second certificate for a second operating system, 3. The method of claim 2, wherein the operating system and the second operating system are different. system.

5. The credential data in the credential database is stored in at least two operating systems.

3. The system of claim 2, comprising data for a rating system.

6. The checking tool determines, using a first processor process, that the digital signature is valid. and determining whether the DS certificate is valid using a second processor process. is configured to determine whether the first processor process is valid, 3. The system of claim 2, wherein the processor process is executed concurrently and independently.

7. The security tool: Prohibiting the transfer of said at least one file to said user computing device. 、 prohibiting the at least one file from being executed on the user computing device; prohibiting the at least one file from being opened on the user computing device; deleting the at least one file; or At least one of isolating the at least one file from the user computer.

4. The system of claim 3, configured to restrict access to the file on a computer device. Stem.

8. When the checking tool obtains the at least one file, the security tool The at least one file is classified as a trusted file or a non-trusted file. and suspending the transfer of the at least one file to the user computing device until the at least one file is 8. The system of claim 7, further configured to:

9. Checking whether said at least one file has said required file integrity. That is: obtaining a decrypted digital signature checksum from the digital signature; deriving the checksum algorithm from the DS Certificate; performing a file check of the at least one file using the checksum algorithm; Calculating the sum; The digital signature checksum is compared with the file checksum using the public key of the DS certificate. To compare; and If the digital signature checksum matches the file checksum, then determining that another file has the required file integrity. system.

10. authenticating the issuing center certificate: creating a certificate chain from the plurality of certificates; Whether each of the multiple certificates in the certificate chain has the required certificate integrity Check the following: One of the certificates in the certificate chain is associated with the issuing center data. Check that the Checking whether the root certificate is the last certificate in the certificate chain; and Each of the plurality of certificates in the certificate chain has the required certificate integrity. one of the certificates in the certificate chain is associated with the issuing center data; and If the root certificate is the last certificate in the certificate chain, the issuing center data 3. The system of claim 2, further comprising: determining that the data is valid.

11. Retrieving credential data associated with the DS certificate data includes: The credential data includes the DS certificate, the identity of the DS certificate, or a certificate identifying the DS certificate. identifying the DS certificate data including at least one of the vector values ​​that distinguishes the In the credential data, a certificate from the certification center that issued the DS certificate The system of claim 2, further comprising: identifying a certificate.

12. The certificate database is configured to store revocation data for the plurality of certificates. and determining whether the DS certificate can be trusted: Compare the DS certificate with the revocation data to determine whether the DS certificate has expired.

12. The system of claim 11, further comprising:

13. The plurality of certificates stored in the certificate database include a root certificate and a certification center certificate.

3. The system of claim 2, further comprising only the certificate of the server.

14. The credential data includes a plurality of credentials or an identification of the plurality of credentials. Item 2. The system according to item 2.

15. 1. A method for verifying a digital signature of at least one file, comprising: A digital signature including a DS certificate having issuing center data and DS certificate data obtaining at least one file; By checking whether the DS certificate has the required DS certificate integrity and determining whether the DS certificate is valid by authenticating the bank center certificate; ； At least one of the files has the required file integrity and the DS certificate is valid. determining whether the digital signature is valid by checking whether the digital signature is valid; If the DS certificate is valid, the credential data associated with the DS certificate data is trusted. determining whether the DS certificate can be trusted by searching it in a certificate database; P; and If the digital signature is valid and the DS certificate is trusted, then at least one classifying said file as a trusted file.

16. The digital signature is invalid or the DS certificate is invalid or untrusted. if not, classifying the at least one file as an untrusted file; and If at least one of the files is classified as an untrusted file, the user computer The method further comprises the step of restricting access to the at least one file on the data device. The method of claim 15.

17. The step of restricting access to files on the user computing device comprises: a step of prohibiting the transfer of the at least one file to the user computing device; Top, prohibiting execution of the at least one file on the user computing device. 、 prohibiting the at least one file from being opened on the user computing device. P, deleting the at least one file; or 20. The method of claim 16, further comprising at least one of: quarantining the at least one file. How to.

18. Upon obtaining the at least one file, the at least one file is added to a trust file. The user of the at least one file until the at least one file is classified as a trusted file or an untrusted file.

20. The method of claim 16, further comprising the step of interrupting the transfer to the computing device.

19. At least one processor; and a memory; and A computing device including instructions that, when executed by a processor, cause the processor to The sessa: A digital signature including a DS certificate that contains issuing center data and DS certificate data. Get at least one file that By checking whether the DS certificate has the required DS certificate integrity, and determining whether the DS certificate is valid by authenticating the issuing center certificate; At least one of the files has the required file integrity and the DS certificate is valid determining whether the digital signature is valid by checking whether If the DS Certificate is valid, the credential data associated with the DS Certificate data is trusted. Determine whether the DS certificate can be trusted by searching it against a database of trusted certificates; hand If the digital signature is valid and the DS certificate is trusted, then Implement a checking tool that is configured to classify a file as a trusted file. The computer device.

20. The checking tool determines that the digital signature is invalid or that the DS certificate is invalid. If the at least one file is untrusted or untrusted, the at least one file is treated as an untrusted file. and further configured to classify the The computing device further includes instructions that, when executed by the processor, The processor determines whether the at least one file is an untrusted file by the checking tool. If the file is classified as a file, the at least one file on the user's computer device is 20. The method of claim 19, further comprising: of computer equipment.

21. A computer device operating system (OS); and The computer further includes instructions that, when executed by the processor, cause the processor to: and implementing a virtual machine including a virtual machine OS different from the computer device OS, 20. The computing device of claim 19, wherein a file is executable only on said virtual machine OS.

Images