Emulation Layer for COM Server DLL Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic link libraries (DLLs) often contain unwanted code such as spyware and browser helper objects that are difficult to remove without affecting application functionality or causing system crashes, as they are not easily freed from memory due to their integration with COM client applications.
Innovation Solution
An emulation layer is inserted between the COM server DLL and the COM client application to emulate interfaces exported by the DLL, allowing the DLL to be safely removed from memory without disrupting application operations by replacing COM pointers with proxy interfaces and managing reference counts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If the COM server DLL is freed from memory to remove unwanted code, then security threats are eliminated, but the COM client application crashes or becomes unstable
Solution Approach 1:
The patent introduces a proxy interface as an intermediary layer between the COM client application and the COM server DLL. This proxy maintains reference counts and manages the lifecycle of COM objects, allowing the DLL to be unloaded from memory while keeping the application stable. The proxy acts as a mediator that handles the complexity of COM object management, enabling safe removal of malicious DLLs without crashing the application.
Solution Approach 2:
The patent segments the COM interface functionality by creating a proxy interface that separates the reference counting and lifecycle management from the actual COM server DLL. This segmentation allows the DLL to be independently unloaded while the proxy remains in memory to maintain application stability, effectively dividing the system into manageable components with distinct responsibilities.
2Object-affected harmful factors
If the COM server DLL is forcibly removed from memory, then malicious code is eliminated, but reference counts become inconsistent and applications malfunction
Solution Approach 1:
The proxy interface serves as an intermediary that maintains accurate reference counts for COM objects even after the server DLL is unloaded. It tracks the number of active references and only allows DLL unloading when the reference count reaches zero, ensuring consistency and preventing corruption of the COM object lifecycle management.
3Ease of operation
If the BHO is allowed to remain in memory for easy access, then application functionality is maintained, but security vulnerabilities persist
Solution Approach 1:
The patent creates a proxy copy of the COM interface that replicates the necessary functionality for application access. This proxy interface provides the same operational capabilities as the original BHO interface while being free from malicious code, allowing applications to continue functioning normally while the dangerous original DLL can be safely removed or quarantined.
Data Source
AI summary
A system, method and computer program product are provided. In use, a COM server dynamic link library is identified. Further, an emulation layer is inserted in association with the COM server dynamic link library to emulate interfaces exported by the COM server dynamic link library. As an option, it may be determined whether the COM server DLL is loaded, and the emulation layer may be inserted in response to the determination.