Local Reputation Checker Using File Origin Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional local reputation checkers for cybersecurity systems rely on application whitelists, which are challenging to maintain and secure, and may not be applicable across different operating systems or after system upgrades, leading to potential false security and vulnerability to attackers.
Innovation Solution
Implementing a file origin analysis-based local reputation checker that uses digital signature keys to determine the safety of executable files, eliminating the need for an application whitelist database and reducing reliance on cloud-based services to mitigate security risks and scalability issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a local reputation checker uses an application whitelist database to detect system breach, then the system can determine whether an application is safe with minimal cloud reputation lookup, but the system must create the reference application whitelist database before connecting to any other computer or network, which is difficult to maintain and secure
Solution Approach 1:
The patent extracts the core verification mechanism from the whitelist database concept and implements it through digital signature validation. Instead of maintaining a comprehensive whitelist database that requires manual updates and secure storage, the system extracts only the essential verification capability by checking digital signatures against a small set of trusted publisher keys stored in the hypervisor. This eliminates the complexity of whitelist maintenance while preserving application safety determination.
Solution Approach 2:
The patent introduces digital signatures as an intermediary mechanism between the application and the reputation checker. Rather than directly comparing applications against a whitelist database, the system uses digital signatures from trusted publishers as a mediator to verify application authenticity. This intermediary approach shifts the burden from maintaining application-level whitelists to maintaining publisher-level trust anchors, significantly simplifying the system.
2Loss of energy
If the reference application whitelist database is stored locally to reduce network traffic and cost, then cloud lookup frequency decreases, but the database must be kept away from attackers' reach to prevent system compromise
Solution Approach 1:
The patent moves the trust verification from the application layer to the hypervisor layer, effectively changing the dimensional level at which security is enforced. By storing trusted publisher keys in the hypervisor rather than in the guest operating system's whitelist database, the system elevates the security boundary to a lower, more protected layer. This dimensional shift allows the keys to be stored locally without exposing them to application-level attacks.
Solution Approach 2:
The system performs preliminary verification by checking digital signatures before allowing application execution. This preliminary anti-action prevents malicious applications from executing in the first place, eliminating the need for continuous whitelist updates and reducing the security burden on the local database. The trusted publisher keys in the hypervisor provide pre-established trust that prevents attackers from compromising the system through whitelist manipulation.
3Reliability
If cloud-based reputation lookup is used to determine application safety, then the system can access updated reputation information, but application execution stall time increases and network traffic and cost increase
Solution Approach 1:
The patent performs preliminary action by pre-establishing trust relationships through digital signatures from trusted publishers during system initialization. Instead of performing cloud lookups for every application execution, the system pre-loads trusted publisher keys into the hypervisor and uses these for rapid local verification. This preliminary action eliminates the need for repeated cloud consultations, reducing execution stall time while maintaining reliable reputation determination.
Solution Approach 2:
The system implements self-service by enabling local verification of application reputations using digitally signed metadata and trusted publisher keys stored in the hypervisor. Each application carries its own verification credentials (digital signatures), allowing the system to independently verify its safety without external cloud services. This self-service capability eliminates network dependencies and execution delays while maintaining accurate reputation assessment.
Data Source
AI summary
System and method for checking reputations of executable files in an endpoint device use an integrity verification on an executable file being scanned to determine whether the executable file has been unaltered since being installed in the endpoint device. When the executable file has been determined to be unaltered since being installed in the endpoint device, a file origin analysis is executed on the executable file based on a vendor identifier for the executable file to determine whether the executable file is from an approved source. When the executable file is determined to be from an approved source, an output is produced that indicates that the executable file has an approved reputation.