Software Whitelisting via Runtime Integrity Measurement

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Root-kits and other malware can evade detection by security software, making it difficult to ensure the integrity and authenticity of software components on a computing platform.

Innovation Solution

Implementing a whitelisting system that collects runtime information about software components, compares it with validated data, and uses an integrity measurement manager to verify the components' integrity, ensuring they have not been tampered with or compromised by malware.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional security software is used to detect malware, then detection capability is provided, but root-kits can evade detection and compromise software integrity

Engineering Contradiction:

Improvesoftware integrity assuranceVSAvoidmalware evasion capability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

Instead of trying to detect malware directly, the system inverts the approach by measuring and validating legitimate software components first, creating a baseline of expected behavior. Any deviation from this baseline indicates potential compromise, allowing the system to detect root-kits and malware by what they are not rather than what they are.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system performs preliminary measurement and validation of software components before they are fully executed or before malicious activity can occur. By establishing integrity baselines in advance and continuously measuring components against these baselines, the system prevents malware from establishing itself without detection.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If software components are monitored and validated, then integrity assurance is improved, but system complexity increases

Engineering Contradiction:

Improvecomponent integrity verificationVSAvoidvalidation system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a measurement module and validation module as intermediaries between the software components and the security system. These modules act as mediators that handle the complex tasks of measurement, comparison, and validation, isolating the complexity from the core software components while providing simplified integrity assurance.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system creates copies of software component measurements and integrity data for validation purposes. By measuring components and storing these measurements for later comparison, the system avoids the need for complex real-time analysis of every component operation, simplifying the validation process while maintaining thorough integrity checking.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS8099718B2Method and system for whitelisting software components

Publication Date: 2012.01.17 INTEL CORP

AI summary

A method and system for whitelisting software components is disclosed. In a first operating environment, runtime information may be collected about a first loaded and executing software component. The collected information may be communicated to a second software component operating in a second operating environment that is isolated from the first operating environment. The collect runtime information may be compared with a validated set of information about the first software component. Other embodiments are described and claimed.