Cloud-Based Application Fingerprint Verification for Endpoint Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current white-listing systems are vulnerable to malware inclusion during endpoint scans, require complex trusted-change technologies, and struggle with updating applications due to varied update methods from software manufacturers, leading to labor-intensive efforts and unbounded problems in ensuring secure execution of applications.
Innovation Solution
A cloud-based application fingerprint database and trust-listing service that uses social media crowd-sourcing for just-in-time verification, allowing only authorized applications to execute by comparing fingerprints and enabling users to disable untrusted recommendations with a single click, along with IP Gap technology for protecting databases from unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white-listing systems perform endpoint scans to identify authorized applications, then security protection is provided, but the systems become vulnerable to malware inclusion and require complex trusted-change technologies
Solution Approach 1:
The patent extracts the fingerprint verification function from the endpoint system and relocates it to a cloud-based service. The endpoint only needs to query the cloud service for fingerprint verification, eliminating the need for complex local trusted-change technologies and malware scanning mechanisms while maintaining security protection.
Solution Approach 2:
The patent introduces a cloud-based fingerprint verification service as an intermediary between the endpoint and the application execution process. This mediator handles the complex verification logic centrally, allowing endpoints to remain simple while achieving reliable security protection through the intermediary's verification capabilities.
2Adaptability or versatility
If white-listing systems update application lists frequently to accommodate new software, then application compatibility is improved, but labor-intensive efforts increase due to varied update methods from software manufacturers
Solution Approach 1:
The patent uses cryptographic hashes (fingerprints) as copies of application identities for verification purposes. Instead of managing complex application metadata and update information, the system creates simple hash copies of application binaries that can be quickly generated and verified, enabling frequent updates without labor-intensive manual configuration.
Solution Approach 2:
The system enables automatic fingerprint generation and verification without requiring manual intervention. Software manufacturers can automatically generate fingerprints for their applications, and the cloud service automatically verifies them, eliminating the need for manual update management efforts while maintaining high adaptability to new applications.
3Device complexity
If cloud-based fingerprint verification is implemented, then the complexity of managing endpoint security is reduced, but real-time verification capability must be ensured
Solution Approach 1:
The system performs preliminary actions by pre-computing and storing cryptographic fingerprints of authorized applications in the cloud database before execution is needed. When an application needs to run, the endpoint simply queries whether its fingerprint exists in the pre-prepared database, enabling fast verification without complex real-time analysis or scanning operations.
Data Source
AI summary
Provided are techniques for controlling access to computing resources comprising generating a first fingerprint corresponding to a first executable file; storing the fingerprint in a non-transitory computer-readable storage medium; receiving a request to execute a second executable file on a computing system; generating a second fingerprint corresponding to the second executable file; determining whether or not the first fingerprint matches the second fingerprint; and, in response to determining that the first and second fingerprints match, executing the executable file on the computing system; and, in response to determining that the first and second fingerprints do not match, preventing the executable file from executing on the computing system.