Software Identifier Verification via Black-List and Phoenix-List
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for managing software in computing systems, while providing some security measures, lack comprehensive and timely protection against malicious software and security flaws, especially in offline situations and when dealing with software updates.
Innovation Solution
A system that utilizes a network-based information server to provide status information including black-list, white-list, and phoenix-list data, generating unique identifiers for software applications using digital certificates and hash values, and notifying users or preventing the execution of malicious software, while allowing for secure updates and offline protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software is signed with digital certificates and checked at install time, then software authenticity can be verified, but the system cannot detect malicious software that uses valid certificates or software with security flaws
Solution Approach 1:
The system performs preliminary actions by maintaining black-lists and phoenix-lists of known malicious and problematic software identifiers before software installation or execution. When software is launched, the runtime environment checks its identifier against these pre-maintained lists to detect malicious software that may have valid certificates. This preliminary detection mechanism addresses the limitation of certificate-based verification alone.
2Object-affected harmful factors
If anti-virus software scans files periodically, then viruses and Trojan horses can be identified, but the scanning is not timely enough to prevent execution of newly installed malicious software
Solution Approach 1:
The system implements continuous feedback by checking software identifiers against black-lists and phoenix-lists at the moment of software launch or execution, rather than relying on periodic scans. The runtime environment automatically queries the status of each software application and receives immediate feedback about its security status, enabling real-time detection and prevention of malicious software execution without time delays.
3Object-affected harmful factors
If a black-list of malicious software is maintained, then malicious applications can be blocked, but software with security flaws that needs updates cannot be distinguished
Solution Approach 1:
The system segments the security status classification into distinct categories: black-list for malicious software, phoenix-list for software with security flaws needing updates, and white-list for trusted software. This segmentation allows the system to differentiate between malicious software that should be blocked and vulnerable software that needs updates, enabling both malicious software blocking and proper update management simultaneously.
4Reliability
If certificates are revoked to prevent malicious software, then security can be improved, but legitimate software updates from the same publisher may also be blocked
Solution Approach 1:
Instead of revoking certificates which affects all software from a publisher, the system applies local quality by targeting specific software identifiers individually. The black-list and phoenix-list contain specific software identifiers rather than publisher-wide bans, allowing the system to block only the malicious or vulnerable specific applications while permitting legitimate updates from the same publisher that have different identifiers.
5Object-affected harmful factors
If comprehensive security checks are performed at software launch, then malicious software can be prevented from running, but system performance and user experience may be degraded
Solution Approach 1:
The system extracts the security checking function from the core software launch process by implementing it as a separate runtime environment layer. The identifier generation and black-list/phoenix-list checking are performed as independent operations that do not interfere with the main software execution path, minimizing performance impact while maintaining comprehensive security prevention.
Data Source
AI summary
In general, one aspect of the subject matter described in this specification can be embodied in a system that includes a network-based information server system; and a computer operable to interact with a user interface device and operable to perform operations including: receiving from the network-based information server system status information corresponding to software applications, the status information including black-list information and phoenix-list information; updating a local cache, retained by the computer, with the status information received from the network-based information server system; generating an identifier for a software application, using a digital certificate and a hash value, when the software application is launched on the computer; checking the identifier for the software application against the status information; and notifying a user of the computer when a match is found during the checking.