Cryptography DLL Identification via Plugin Logging and Blacklist Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software app development faces challenges in accurately identifying and monitoring cryptographic algorithms due to poor understanding or improper use, leading to security issues such as inadequate encryption strength, use of fixed initial vectors, and non-random keys, with conventional monitoring solutions posing higher security risks and being difficult to implement.
Innovation Solution
A method and system that scans dynamic-link libraries for filename information, compares it against a cryptography library list, links to a plugin-stored encryption algorithm, and creates a log file to identify and monitor encryption algorithms, including a comparison with a blacklist to flag insecure algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a monitoring program is installed in high-privilege mode to monitor cryptographic algorithms, then monitoring capability is improved, but information security risk increases
Solution Approach 1:
The patent introduces a log file as an intermediary mechanism between the cryptographic library and the monitoring system. Instead of directly monitoring in high-privilege mode, the system logs encryption algorithm information to a file that can be safely read and analyzed by the monitoring program, thereby reducing the security risk while maintaining monitoring capability
Solution Approach 2:
The patent creates a copy of the encryption algorithm information in the log file before actual monitoring occurs. This log file serves as a static record that can be examined without requiring continuous high-privilege access, allowing the monitoring program to analyze past encryption operations without actively interfering with or exposing itself to security risks during real-time operation
2Reliability
If conventional monitoring programs are used to monitor cryptographic algorithms, then monitoring function is provided, but device complexity increases
Solution Approach 1:
The patent extracts the monitoring function from the complex high-privilege program and separates it into a simple log file reading mechanism. The cryptographic library simply writes to a log file, and the monitoring program independently reads and analyzes this file, dividing the system into simple, independent components rather than a complex integrated monitoring program
Solution Approach 2:
The cryptographic library performs self-service by automatically logging its own encryption algorithm information to the log file without requiring external monitoring programs to actively query or intercept its operations. This passive logging approach simplifies the overall system architecture by eliminating the need for complex active monitoring mechanisms
3Speed
If cryptographic algorithms are monitored in real-time, then security response is improved, but measurement precision decreases due to system environment dependencies
Solution Approach 1:
The patent performs preliminary action by pre-defining the log file format and encryption algorithm identification criteria before actual monitoring occurs. The log file structure is established in advance with clear fields for algorithm name, key length, and other identifying characteristics, ensuring that real-time analysis can quickly and accurately match observed data against known patterns without environmental interference
Data Source
AI summary
Provided are security encryption algorithm identification method and system, including: an electronic device having a software app, a downloadable storage unit for storing a dynamic-link library (DLL), and a scanning module for scanning the DLL to obtain DLL filename information; a cryptography DLL list, with the scanning module comparing the DLL filename information according to the cryptography DLL list to generate security encryption algorithm library (SEAL) filename information and being linked to a SEAL corresponding to the SEAL filename information to retrieve SEAL version information from a metadata of the SEAL; a specified SEAL storage unit having a plugin-equipped SEAL downloadable by the scanning module from the specified SEAL storage unit according to the SEAL filename information and version information and dedicated to replacing the SEAL; and a specified storage unit disposed in the electronic device to store log files created when the software app calls the plugin-equipped SEAL.