Late Binding Code Manager for Unauthorized DLL Loading Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer operating systems, such as 32-bit versions of Microsoft Windows, allow unknown and potentially malicious dynamic link libraries (DLLs) to be loaded into a process's address space, creating a security hole, and there is a need for methods to prevent unauthorized loading of late binding code.
Innovation Solution
A late binding code manager is implemented to detect and manage attempts to load late binding code into a process's address space, determining whether such attempts are permitted and executing steps to either permit, block, or modify the loading based on predefined criteria such as blacklists, whitelists, digital signatures, and trusted sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If late binding code loading is enabled in Windows, then code flexibility and adaptability are improved, but security deteriorates due to vulnerability to malicious DLL loading
Solution Approach 1:
The patent introduces a late binding code manager as an intermediary component between the existing Windows late binding mechanism and the loaded code. This manager intercepts and validates DLL loading attempts, acting as a mediator that enables flexible code loading while preventing malicious code execution by checking digital signatures and other security criteria before allowing loading to proceed.
Solution Approach 2:
The patent implements preliminary security checks before the actual code loading occurs. The late binding code manager performs validation of digital signatures, verification of code source, and other security determinations in advance, so that only permitted code is allowed to load into the process address space, thereby preventing malicious code execution while maintaining legitimate code flexibility.
2Ease of operation
If all late binding code loading attempts are permitted, then ease of operation is improved, but system security deteriorates due to unauthorized code execution
Solution Approach 1:
The late binding code manager implements self-service security validation by automatically checking digital signatures and verifying code authorization status without requiring manual intervention. The system autonomously determines whether to permit or block loading based on predefined security criteria, maintaining ease of operation while ensuring security through automated decision-making.
Solution Approach 2:
The patent incorporates feedback mechanisms where the late binding code manager continuously monitors loading attempts and provides feedback by either permitting or blocking based on security validation results. This feedback loop ensures that only authorized code executes while maintaining simple operation for legitimate use cases, as the security decisions are made automatically based on code properties.
3Object-affected harmful factors
If selective loading control is implemented, then security is improved, but device complexity increases due to additional management components
Solution Approach 1:
The late binding code manager is designed as a universal component that handles multiple functions: it intercepts loading attempts, validates digital signatures, checks authorization status, and executes loading decisions. By consolidating these multiple security-related functions into a single multi-functional manager, the patent improves security through comprehensive control while minimizing the increase in system complexity compared to having separate components for each function.
Data Source
AI summary
A late binding code manager prevents the unauthorized loading of late binding code into a process. The late binding code manager detects an attempt to load late binding code into a process's address space. Subsequently, the late binding code manager determines whether a detected attempt to load late binding code into a process's address space is permitted. Responsive to the results of a determination as to whether an attempt to load late binding code into a process's address space is permitted, the late binding code manager executes at least one additional step affecting the loading of the late binding code into the process's address space. Such a step can comprise permitting, blocking or modifying the attempt to load the late binding code.