Out-of-Band Application Integrity Verification for Compromised Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software applications on client devices are vulnerable to unauthorized access and modification, posing a security threat to both the client device and network, as conventional verification methods like cryptographic signatures are inadequate for files without such signatures and can be intercepted by malicious actors.
Innovation Solution
An integrity analysis is performed out-of-band on network appliances to verify the integrity of installed program files by comparing them against vendor-provided hash maps, classifying unauthorized or compromised files, and remediating them through factory resets or replacement with compliant files, ensuring the analysis remains undetected by malicious actors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional verification methods like cryptographic signatures are used, then file authenticity can be verified, but files without signatures remain vulnerable and the verification process can be intercepted by malicious actors
Solution Approach 1:
The patent introduces a third-party verification service that acts as an intermediary between the client device and the file verification process. This external service computes hash values of program files and transmits them to the network appliance for comparison, eliminating the need for files to have embedded cryptographic signatures while preventing interception by malicious actors through out-of-band verification.
Solution Approach 2:
The patent replaces the traditional cryptographic signature mechanism with a hash-based verification system. Instead of relying on digital signatures that can be intercepted or forged, the system uses hash maps containing pre-computed hash values of authorized files, comparing actual file hashes against these stored values to determine integrity without requiring signature validation.
2Reliability
If integrity analysis is performed to verify program files, then security vulnerabilities can be identified, but the analysis may be detected by malicious actors
Solution Approach 1:
The patent performs integrity verification before any potential malicious activity can be detected or reported. By continuously monitoring program files and comparing their hash values against authorized hashes in advance, the system identifies compromised files before malicious actors can leverage them, making the analysis itself undetectable since it occurs transparently in the background.
Solution Approach 2:
The network appliance autonomously performs integrity verification without requiring user intervention or awareness. The system self-monitors program file integrity, automatically compares hashes, and can trigger remediation actions without alerting users or malicious actors, effectively making the verification process invisible while maintaining continuous security monitoring.
3Reliability
If program files are monitored continuously, then integrity can be verified in real-time, but system resources are consumed
Solution Approach 1:
The patent implements selective monitoring by only verifying program files that are actually executed or accessed, rather than continuously monitoring all possible files. The system triggers hash computation and comparison only when files are loaded into memory or executed, reducing computational overhead while maintaining real-time integrity verification capability for active files.
Solution Approach 2:
The system pre-computes and stores hash values of authorized program files in hash maps before they are needed. This preliminary action eliminates the need for real-time hash computation during normal operation, as the verification process only requires comparing pre-computed hashes of actual file contents against the stored authorized hashes, significantly reducing processing resources required during runtime.
Data Source
AI summary
A method of application integrity verification and remediation includes scanning an appliance to identify installed program files associated with an application under analysis deployed at the appliance. The method includes computing a hash value of a first installed file of the installed program files. The method includes determining whether the first installed file exists in vendor program files of the application that are maintained separate from the installed program files. The method includes fetching a hash value of a first vendor file of the vendor program files. The first vendor file corresponds to the first installed file. Responsive to the fetched hash value differing from the computed hash value, the method includes classifying the first installed program file as a compromised file and remediating the compromised file at the network appliance.