Context-Aware Program File Integrity Checks at Runtime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing integrity management systems for virtual computing environments, such as containers, fail to protect against unauthorized modifications and attacks during the runtime of programs, as they cannot effectively validate the integrity of program files after initial validation.
Innovation Solution
A runtime protection mechanism that intercepts program file invocations in virtual computing environments, computes context-specific measurements, and performs integrity checks using a security engine to validate the integrity of program files during execution, leveraging a trusted platform module (TPM) for secure anchoring of checksums.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If initial validation of program files is performed before execution, then integrity is ensured at startup, but runtime integrity cannot be validated
Solution Approach 1:
The patent pre-computes and stores contextual information (file paths, hashes, parent directory structures) during program setup and initialization phases. This preliminary action enables the integrity validation system to perform rapid runtime checks by comparing current program states against pre-established baselines, thus ensuring runtime integrity without significant performance penalty
Solution Approach 2:
The patent implements continuous integrity monitoring during program execution by establishing runtime validation mechanisms that continuously check program files against their contextual baselines. This continuous action ensures that integrity validation is not limited to pre-execution checks but extends throughout the entire runtime, maintaining security without requiring periodic restarts
2Reliability
If comprehensive integrity checks are performed on all program files, then security is enhanced, but system performance deteriorates
Solution Approach 1:
The patent applies integrity validation selectively based on contextual relevance. Instead of uniformly checking all program files, the system identifies and validates only those files that are contextually significant to the running program (e.g., files in the program's directory tree, files with matching hash patterns). This localized approach maintains high security for critical files while minimizing overhead on non-critical operations
Solution Approach 2:
The patent implements a tiered validation approach where critical program files undergo rigorous contextual integrity checks, while less critical files receive simplified validation. The system performs partial validation on commonly accessed files and more comprehensive checks on sensitive files, balancing security requirements with performance constraints through differentiated validation intensity
3Measurement precision
If context-specific validation is implemented, then precision of integrity checking is improved, but computational complexity increases
Solution Approach 1:
The patent segments the integrity validation system into distinct modular components: contextual information collection modules, hash computation modules, comparison modules, and enforcement modules. Each component handles a specific aspect of the validation process, making the overall complex system manageable through clear separation of concerns. This segmentation allows the system to achieve high measurement precision through specialized sub-components while maintaining operational simplicity through modular architecture
Data Source
AI summary
In some examples, during runtime of a virtual computing environment, a system intercepts a call for an invocation of a program file that relates to a program execution in the virtual computing environment, and obtains, for the program file prior to the invocation of the program file in response to the call, context information of the virtual computing environment. The context information includes an identifier of a program code image for the virtual computing environment. The system computes a measurement value based on the program file, and provides the measurement value and the context information of the virtual computing environment to an integrity checker to perform a context-specific validation of the program file.


