ActiveX Control Authentication via Digital Signature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security solutions, such as white-listing, are inflexible and delay the execution of newly released software or vulnerability patches, as they require manual addition to the white-list, and are ineffective against new malware until it is identified and listed, posing a challenge in managing and protecting computer networks from untrusted ActiveX controls.
Innovation Solution
A system and method for day-zero authentication of ActiveX controls using a digital signature verification process, where an authentication engine downloads, verifies, and authorizes executable files by checking digital certificates and hashes, allowing trusted files to be automatically added to the white-list and enabling trust propagation for seamless installation and execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white-listing is used to ensure network security, then security reliability is improved, but software execution speed and flexibility deteriorate due to manual addition requirements
Solution Approach 1:
The system performs preliminary verification of digital signatures and certificates before execution, allowing software to be pre-authenticated by trusted authorities. This preliminary action enables automatic trust establishment without manual white-listing, resolving the contradiction between security reliability and execution speed.
Solution Approach 2:
The authentication engine automatically verifies digital signatures and manages trust relationships without requiring manual administrator intervention. The system self-services by autonomously evaluating cryptographic proofs and making execution decisions, eliminating the manual white-listing bottleneck while maintaining security.
2Reliability
If manual white-listing is required for security, then control over executable files is improved, but time consumption and operational complexity increase
Solution Approach 1:
The authentication engine autonomously verifies digital signatures against stored certificate authorities and automatically determines trust relationships. This self-service mechanism eliminates manual administrator time for white-listing while maintaining strict execution control through cryptographic verification.
Solution Approach 2:
The manual mechanical process of administrator review and white-listing is replaced with an automated cryptographic verification system. The authentication engine uses digital signature algorithms and certificate validation to mechanically verify trust, substituting human time with automated computational processes.
3Reliability
If traditional security measures are used, then protection from known malware is improved, but effectiveness against new malware deteriorates until identification and listing
Solution Approach 1:
The system establishes trust relationships in advance through digital signature verification against known certificate authorities. By performing preliminary cryptographic validation, the system can safely execute new software from trusted sources before traditional malware identification processes can analyze and whitelist the software, improving adaptability to new legitimate software while maintaining protection.
4Extent of automation
If digital signature verification is implemented, then automatic authentication capability is improved, but system complexity increases
Solution Approach 1:
The authentication engine serves multiple functions: verifying digital signatures, validating certificates, managing trust relationships, and making execution decisions. By consolidating these diverse functions into a single multi-functional component, the system achieves high automation without proportionally increasing overall system complexity.
Data Source
Figure 1~4
Figure 2
Figure 3
AI summary
A system and method in one embodiment includes modules for verifying a digital signature of a Microsoft® ActiveX® control, identifying an executable file of the ActiveX control, authorizing the executable file as an updater configured to enable trust propagation, if the digital signature is from an authorized issuer, and installing the ActiveX control. More specific embodiments include hooking an exported function in the executable file and marking a thread calling the exported function as an updater. Hooking the exported function includes patching the executable function so that when the exported function is called during execution of the executable file, a second function is executed before the exported function is executed. Other embodiments include extracting a cabinet file wrapping the ActiveX control, parsing an information file in the cabinet file, and downloading additional components for installing the ActiveX control.