Cryptographic Software Enforcement for Malware Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems face challenges such as unmanageable administrative burdens, single points of failure, reactive nature, false positives, and inability to deter malware authors, with existing solutions relying on blacklist approaches that are slow to respond to new threats and lacking in real-time detection of infected applications.
Innovation Solution
A cryptographically assisted Security Enforcement System that enforces accountability and access policies by ensuring software authors unequivocally identify themselves through cryptographic certificates, granting full access only to compliant files and limiting rights to non-compliant ones, including dynamic link libraries and other executable objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a whitelist approach is used to authorize software before execution, then malware prevention efficiency is improved, but administrative burden becomes unmanageable
Solution Approach 1:
The system implements self-service by requiring software to automatically present cryptographic proof of authorization (signatures, certificates, hashes) upon execution requests. The security enforcement engine autonomously verifies these proofs without human intervention, eliminating the need for administrators to manually whitelist each software while maintaining strong prevention efficacy.
2Ease of operation
If a blacklist approach is used to block malware after detection, then ease of operation is improved, but response speed to new threats deteriorates
Solution Approach 1:
The system performs preliminary action by requiring software to present cryptographic authorization proofs before execution. This proactive verification prevents unknown malware from running in the first place, rather than reactively blocking detected threats. The authorization proofs are validated in real-time, enabling immediate response to any software regardless of whether it is in existing blacklists.
3Reliability
If cryptographic authorization is required for all software, then security reliability is improved, but device complexity increases
Solution Approach 1:
The system achieves universality by implementing a single security enforcement engine that handles all software authorization requests through a unified cryptographic verification process. This engine works across all software types (executables, scripts, dynamic link libraries) and integrates with the existing operating system execution model, providing comprehensive security without requiring separate complex systems for different software categories.
4Reliability
If software authors must provide cryptographic identification, then accountability and deterrence are improved, but ease of operation for users deteriorates
Solution Approach 1:
The system implements self-service by automatically handling cryptographic verification without requiring user input. Software authors embed their authorization proofs (signatures, certificates) within the software or provide them through automated channels. When software executes, the security enforcement engine autonomously retrieves and verifies these proofs, maintaining strong accountability while requiring zero user intervention.
Data Source
AI summary
The present invention provides a method and apparatus for a cryptographically assisted computer system designed to deter viruses and malware via enforced accountability and access policies. The Security Enforcement System (1000) comprises a security policies enforcement engine (400) configured to enforce security policies (200) to executable software files, based on their compliance with defined cryptographic policies (100). In a preferred embodiment, cryptographic policies (100) include the unequivocal identification of the software author or authors, and the security policies (200) are defined such that properly encrypted software files are given full access rights to the computer system resources (600, 700, 800, 900), whereas non-compliant files are given limited access rights to neuter potential malicious behavior goals. The security enforcement system engine (400) applies the security policies (200) to a software file and all its dependants, including spawn processes and threads as well as dynamic link libraries and other independent executable file objects.