File Execution Security via Server-Side Cryptographic Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing networked computing environments face challenges in securing data as devices intermittently connect to various networks, making it difficult to guarantee the security of files when reconnecting, especially without specialized hardware like TPMs, and ad-hoc risk assessments with whitelisting do not provide high confidence.
Innovation Solution
A system that uses a security server to generate and store cryptographic codes in metadata of executable files, allowing only files with valid cryptographic codes to execute by verifying them against a hash value, without requiring specialized hardware like TPMs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic security is implemented without specialized hardware like TPMs, then device compatibility and ease of operation are improved, but security reliability deteriorates
Solution Approach 1:
A security server acts as an intermediary between the computing device and the cryptographic verification process. The security server generates cryptographic codes, stores them in file metadata, and verifies them during file execution, eliminating the need for specialized hardware TPMs while maintaining security reliability through centralized cryptographic management
Solution Approach 2:
The system creates cryptographic copies of file integrity information by generating cryptographic codes from file hash values and embedding them in file metadata. These cryptographic copies enable verification of file integrity without requiring the original file to be present or modified, achieving secure verification through information replication
2Ease of operation
If ad-hoc risk assessment and whitelisting are used, then ease of operation is improved, but security reliability deteriorates
Solution Approach 1:
The system performs preliminary cryptographic verification by checking the cryptographic code in file metadata against the current file hash value before allowing file execution. This advance verification ensures that only files with valid cryptographic signatures can execute, providing high security confidence while maintaining ease of operation through automated verification
Solution Approach 2:
The system implements a feedback mechanism where the security server continuously monitors file execution requests, verifies cryptographic codes, and provides real-time security decisions. The system also updates file metadata with fresh cryptographic codes when files are modified, creating a closed-loop feedback system that maintains security confidence dynamically
3Productivity
If files are executed without cryptographic verification, then productivity is improved, but security reliability deteriorates
Solution Approach 1:
Cryptographic verification is performed as a preliminary action before file execution by checking the cryptographic code in metadata against the file hash value. This pre-execution verification ensures that security checks are completed beforehand, allowing files to execute immediately upon verification without delays during execution, thus maintaining productivity while ensuring data security
Solution Approach 2:
The system implements self-service cryptographic verification where the computing device itself performs the verification of cryptographic codes locally using the security server's public key. This eliminates the need for continuous network connectivity or centralized verification during execution, enabling fast local verification that maintains both productivity and security reliability
Data Source
AI summary
Methods and systems are described herein to restrict execution of files stored on a computing device. In an example a request to execute a file is intercepted by a security agent on the computing device. The security agent is arranged to determine if metadata stored with the with the file comprises a cryptographic code comprising a function of at least a private key of a security server in communication with the computing device and a first hash value the first hash value being an output of a hash function applied to data associated with the file at a first time. If the security agent determines that the metadata comprises the cryptographic code, it verifies the code with a public key of the security server, obtains a second hash value of the file at a second time and executes the file if the first hash value matches the second hash value.