Context-Aware Program File Integrity Checks at Runtime

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing integrity management systems for virtual computing environments, such as containers, fail to protect against unauthorized modifications and attacks during the runtime of programs, as they cannot effectively validate the integrity of program files after initial validation.

Innovation Solution

A runtime protection mechanism that intercepts program file invocations in virtual computing environments, computes context-specific measurements, and performs integrity checks using a security engine to validate the integrity of program files during execution, leveraging a trusted platform module (TPM) for secure anchoring of checksums.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If initial validation of program files is performed before execution, then integrity is ensured at startup, but runtime integrity cannot be validated

Engineering Contradiction:
Improveintegrity validation coverageVSAvoidruntime validation delay
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent pre-computes and stores contextual information (file paths, hashes, parent directory structures) during program setup and initialization phases. This preliminary action enables the integrity validation system to perform rapid runtime checks by comparing current program states against pre-established baselines, thus ensuring runtime integrity without significant performance penalty

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent implements continuous integrity monitoring during program execution by establishing runtime validation mechanisms that continuously check program files against their contextual baselines. This continuous action ensures that integrity validation is not limited to pre-execution checks but extends throughout the entire runtime, maintaining security without requiring periodic restarts

Inventive Principle:
Principle #20Continuity of useful action

2Reliability

If comprehensive integrity checks are performed on all program files, then security is enhanced, but system performance deteriorates

Engineering Contradiction:
Improveintegrity validation accuracyVSAvoidprogram execution speed
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent applies integrity validation selectively based on contextual relevance. Instead of uniformly checking all program files, the system identifies and validates only those files that are contextually significant to the running program (e.g., files in the program's directory tree, files with matching hash patterns). This localized approach maintains high security for critical files while minimizing overhead on non-critical operations

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The patent implements a tiered validation approach where critical program files undergo rigorous contextual integrity checks, while less critical files receive simplified validation. The system performs partial validation on commonly accessed files and more comprehensive checks on sensitive files, balancing security requirements with performance constraints through differentiated validation intensity

Inventive Principle:
Principle #16Partial or excessive action

3Measurement precision

If context-specific validation is implemented, then precision of integrity checking is improved, but computational complexity increases

Engineering Contradiction:
Improveintegrity check accuracyVSAvoidvalidation system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the integrity validation system into distinct modular components: contextual information collection modules, hash computation modules, comparison modules, and enforcement modules. Each component handles a specific aspect of the validation process, making the overall complex system manageable through clear separation of concerns. This segmentation allows the system to achieve high measurement precision through specialized sub-components while maintaining operational simplicity through modular architecture

Inventive Principle:
Principle #1Segmentation

Data Source

PatentUS12423413B2Program file measurements for context-specific validation
Publication Date: 2025.09.23 HEWLETT PACKARD BRASIL
  • US12423413B2 patent drawing
  • US12423413B2 patent drawing
  • US12423413B2 patent drawing

AI summary

In some examples, during runtime of a virtual computing environment, a system intercepts a call for an invocation of a program file that relates to a program execution in the virtual computing environment, and obtains, for the program file prior to the invocation of the program file in response to the call, context information of the virtual computing environment. The context information includes an identifier of a program code image for the virtual computing environment. The system computes a measurement value based on the program file, and provides the measurement value and the context information of the virtual computing environment to an integrity checker to perform a context-specific validation of the program file.