Process Validation for Launching Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Windows operating systems lack effective validation of processes at execution time, making it easy for attackers to launch malicious applications by overwriting application code with reverse-engineered DLLs, which can exploit system confidentiality and security.
Innovation Solution
A method and system that monitor processes in a protected environment, verify their legitimacy by checking if they are child processes of previously verified processes and possess valid digital certificates, and take remedial action if validation checks fail, including preventing launch or termination of non-legitimate processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If process validation checks are implemented, then security is improved, but system complexity increases
Solution Approach 1:
The system performs validation checks before allowing process execution. By validating digital certificates and checking process relationships in advance, the system prevents malicious code from executing without requiring complex runtime intervention mechanisms.
Solution Approach 2:
The invention introduces a validation layer that acts as an intermediary between process launch requests and actual execution. This mediator checks digital certificates and process relationships, filtering out malicious processes before they reach the execution environment.
2Object-affected harmful factors
If process validation checks are performed, then harmful factors are reduced, but processing time increases
Solution Approach 1:
Validation checks are performed before process execution is allowed to start. By completing security verification in advance, the system avoids costly runtime validation and ensures that only verified processes reach the execution stage.
Solution Approach 2:
The system rapidly validates processes using efficient checks such as digital certificate verification and parent-child process relationship validation. Once a process passes validation, it is quickly allowed to execute without further interference, minimizing overall delay.
Data Source
AI summary
A method and/or system for processing an application for launch to determine whether it might be legitimate or non-legitimate, and if non-legitimate taking security action.