Application Whitelist System for Selective Execution Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for blocking execution of program files on a computer system are limited in their ability to selectively prevent execution without prior knowledge of the files, are cumbersome to administer, and are ineffective against newly released viruses or executables on network storage and email attachments.
Innovation Solution
A system and method that tracks executed program files to create a historical database, allowing users to specify allowed or blocked applications through a user interface, and evaluates candidate program files against this database to determine if they should continue execution, enabling selective blocking without a priori knowledge of the files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software is used to block execution of program files, then execution of infected files can be prevented, but the system cannot block uninfected files that should be restricted and requires up-to-date virus signature definitions
Solution Approach 1:
The patent inverts the traditional anti-virus approach by implementing a whitelist system where only approved applications are permitted to execute. Instead of trying to identify and block all malicious files, the system allows execution only for files explicitly added to the approved list, effectively blocking all other files regardless of their infection status. This reversal fundamentally changes the blocking mechanism from signature-based detection to permission-based control.
Solution Approach 2:
The system performs preliminary action by requiring applications to be pre-approved and added to the whitelist before they can execute. The evaluation mechanism checks whether a file exists in the approved list before permitting execution, preventing unauthorized files from running. This preliminary approval process ensures that only verified, safe applications are allowed, addressing both the reliability of blocking infected files and the adaptability of restricting uninfected but unauthorized files.
2Adaptability or versatility
If license metering programs with stubs are used to suppress execution, then control over copied software can be achieved, but the approach does not work on all executable files and requires disruptive changes to applications
Solution Approach 1:
The patent introduces an intermediary evaluation mechanism that operates between the user and the application execution process. This intermediary component monitors and evaluates files attempting to execute, checking them against the approved list without requiring modifications to the applications themselves. The mechanism acts as a gatekeeper, allowing legitimate files to pass through while blocking unauthorized ones, thereby achieving software copy control without the complexity and disruptions of stub-based metering programs.
3Ease of operation
If Domain Policy rules or file-level permissions are used to block programs, then execution control can be established, but a priori knowledge of file names and locations is required which is tedious and ineffective for network files
Solution Approach 1:
The system implements self-service by automatically tracking and recording executed files in a historical database, then using this information to automatically build and update the approved list. Users simply need to allow the system to run and collect data; the mechanism automatically learns which files should be approved based on actual usage patterns. This eliminates the tedious manual configuration of Domain Policy rules and file-level permissions, as the system self-configures based on observed behavior, reducing both the time and effort required to establish execution control.
4Reliability
If file permissions are manipulated to block executables, then local file execution can be restricted, but the approach is ineffective for executables on network storage and email attachments
Solution Approach 1:
The patent implements a universal evaluation mechanism that operates across multiple file sources and execution contexts. The system monitors and evaluates files regardless of their origin—whether from local storage, network attachments, email, or other sources—by checking them against the approved list at the point of execution. This multi-functional approach replaces the source-specific file permission mechanisms with a single, unified evaluation system that provides consistent blocking capability across all executable sources, thereby achieving both reliability for local files and adaptability for network and email executables.
Data Source
AI summary
The system for selectively blocking execution of applications on a computer system includes an interface that allows an administrator to set configuration settings and which includes tools that assist the administrator in establishing an application list. The application list specifies zero or more applications that are to be either blocked or that are to be allowed to run (i.e., all others to be blocked), depending on the selected configuration settings. The tools include a mechanism that automatically creates a historical database of applications that have been executed in the past on the computer system. The interface allows easy selection of applications from the historical database for inclusion on the application list.