On-line centralized and local authorization of executable files
View Patent ↗A system and system for controlling the execution of executable files. The executables are identified by either a cryptographic digest or a digital certificate. The cryptographic digest is computed from the binary image of the executable. An executable that is attempting to execute is intercepted by a protection module that consults a database of stored rules over a secure channel to determine whether or not the executable can be identified as a permitted executable and whether or not it has permission to execute on a particular computer system under certain specified conditions. If a stored permission is available, it is used to control the execution. Otherwise, the user is consulted for permission.
1. A method comprising:
(a) attempting to execute a first executable file on a first computer system associated with a first user;
(b) intercepting a system service in response to the attempting step (a);
(c) after the attempting step (a), determining whether to execute the first executable file, wherein the determining step comprises examining a set of global authorization rules;
(i) wherein at least some of the rules of the set of global authorization rules at least include a listing of:
(A) applicable users;
(B) applicable executable files;
(ii) wherein, when one located rule of the set of global authorization rules includes both (I) the first user in the listing of applicable users and (II) the first executable file in the listing of applicable executable files, the first computer system applies a stored permission associated with the one located rule to determine whether it is permissible to execute the first executable file;
(iii) wherein, when the set of global authorization rules is free of any one rule having both (A) the first user in the listing of applicable users and (B) the first executable file in the listing of applicable executable files, the first computer system examines a local authorization listing associated with the first user to determine whether there is a stored user input associated with the first executable file;
(A) wherein, when the local authorization listing associated with the first user includes a stored user input associated with the first executable file, the computer system applies the stored user input associated with the first executable file to determine whether it is permissible to execute the first executable file;
(B) wherein, when the local authorization listing is absent of a stored user input associated with the first executable file, the computer system obtains a user input from the first user to determine whether it is permissible to execute the first executable tile, and stores the user input in the local authorization listing relative to the first user and the first executable file; and
(d) after the examining step (c), invoking the system service when it is permissible to execute the first executable file.
2. The method of claim 1 , wherein the intercepting step (e) comprises identifying the first executable file via a cryptographic digest.
3. The method of claim 2 , wherein the identifying step comprises using a binary image of the first executable file.
4. The method of claim 3 , wherein the binary image is a full binary image.
5. The method of claim 3 , wherein the binary image is a partial binary image.
6. The method of claim 1 , comprising identifying at least some of the applicable executable files via a digital certificate of an executable file.