On-line centralized and local authorization of executable files
View Patent ↗A system and method for controlling the execution of executable files. The executables are identified by either a cryptographic digest or a digital certificate. The crytographic digest is computed from the binary image of the executable. An executable that is attempting to execute is intercepted by a protection module that consults a database of stored rules over a secure channel to determine whether or not the executable can be identified as a permitted executable and whether or not it has permission to execute on a particular computer system under certain specified conditions. If a stored permission is available, it is used to control the execution. Otherwise, the user is consulted for permission.
1. A computer-implemented method, comprising:
(A) receiving at a microprocessor instructions of a first executable program;
(B) executing the instructions of the first executable program via the microprocessor, wherein the executing step comprises:
(1) receiving an identifier of a second executable program;
(2) determining from the identifier whether the second executable program is referenced by a pre-existing rule;
(3) if the second executable program is not referenced by the pre-existing rule:
(i) requesting a new provisional rule from a provisional rule-making authority;
(ii) receiving the new provisional rule;
(iii) determining whether the new provisional rule allows the second executable program to be executed by a computer;
(iv) allowing execution of the second executable program if the new provisional rule allows the second executable program to be executed by the computer; and
(v) disallowing execution of the second executable program if the new provisional rule disallows the second executable program to be executed by the computer.
2. The computer-implemented method of claim 1 , comprising:
using the identifier to determine whether the second executable program is referenced in a white-list;
(i) wherein the white-list includes identifiers of executable programs that are pre-determined to be allowed to be executed by the computer; and
allowing the computer to execute the second executable program, if the second executable program is referenced in the white-list.
3. The computer-implemented method of either claim 1 or 2 further comprising:
determining whether a white-list-only operational mode has been selected;
disallowing the computer to execute the second executable program if:
(i) the white-list-only operational mode has been selected; and
(ii) second executable program is not referenced in the white-list.
4. The computer-implemented method of either claim 1 or 2 , wherein:
(i) the computer is a first computer; and
(ii) the microprocessor is located on the first computer.
5. The computer-implemented method of either claim 1 or 2 , wherein:
(i) the computer is a first computer; and
(ii) the microprocessor is located on a second computer, different from the first computer.
6. The computer-implemented method of claim 3 , wherein:
(i) the computer is a first computer; and
(ii) the microprocessor is located on the first computer.
7. The computer-implemented method of claim 3 , wherein:
(i) the computer is a first computer; and
(ii) the microprocessor is located on a second computer, different from the first computer.