Selective authorization of the loading of dependent code modules by running processes

1. A method comprising:

intercepting, by a kernel mode driver of a computer system, file system or operating system activity relating to a first code module initiated by a running process associated with a second code module;

selectively authorizing, by the kernel mode driver, loading of the first code module by the running process by authenticating a cryptographic hash value of the first code module with reference to a multi-level whitelist, the multi-level whitelist comprising (i) a global whitelist database remote from the computer system and maintained by a trusted service provider, the global whitelist database containing cryptographic hash values of approved code modules, which are known not to contain viruses or malicious code and (ii) a local whitelist database containing cryptographic hash values of at least a subset of the approved code modules;

allowing the running process to load the first code module when the cryptographic hash value matches one of the cryptographic hash values of approved code modules within the multi-level whitelist; and

wherein the kernel mode driver is implemented in one or more processors and one or more computer-readable storage media associated with the computer system, the one or more computer-readable storage media having instructions tangibly embodied therein representing the kernel mode driver that are executable by the one or more processors.

2. The method of claim 1 , wherein the first code module comprises an executable code module.

3. The method of claim 2 , wherein the first code module comprises a dynamically-linked library file.

4. The method of claim 1 , wherein the first code module comprises a Java applet.

5. The method of claim 1 , wherein the first code module comprises JavaScript.

6. The method of claim 1 , wherein the cryptographic hash value is computed using Message Digest #5 (MD-5).

7. The method of claim 1 , wherein the cryptographic hash value is computed using a Secure Hash Algorithm (SHA).

8. The method of claim 7 , wherein the cryptographic hash value is computed using SHA-1.

9. The method of claim 7 , wherein the cryptographic hash value is computed using SHA-256.

10. The method of claim 1 , wherein said intercepting file system or operating system activity relating to a first code module comprises monitoring operating system process creation or module load activity.

11. The method of claim 10 , wherein the kernel mode driver is configured for operation within a Microsoft Windows operating system.

12. The method of claim 11 , wherein said intercepting file system or operating system activity relating to a first code module comprises an operating system module load activity monitor intercepting module load activity by running processes within the computer system by hooking to a Windows CreateSection API call and temporarily turning control over to the kernel mode driver.

13. A non-transitory program storage device readable by a computer system, tangibly embodying a program of instructions executable by one or more computer processors of the computer system to perform method steps for authenticating dependent code modules requested to be loaded by processes running on the computer system comprising:

intercepting, by a kernel mode driver of the computer system, file system or operating system activity relating to a first code module initiated by a running process associated with a second code module;

selectively authorizing, by the kernel mode driver, loading of the first code module by the running process by authenticating a cryptographic hash value of the first code module with reference to a multi-level whitelist, the multi-level whitelist comprising (i) a global whitelist database remote from the computer system and maintained by a trusted service provider, the global whitelist database containing cryptographic hash values of approved code modules, which are known not to contain viruses or malicious code and (ii) a local whitelist database containing cryptographic hash values of at least a subset of the approved code modules; and

allowing the running process to load the first code module when the cryptographic hash value matches one of the cryptographic hash values of approved code modules within the multi-level whitelist.

14. The program storage device of claim 13 , wherein the first code module comprises an executable code module.

15. The program storage device of claim 14 , wherein the first code module comprises a dynamically-linked library file.

16. The program storage device storage device of claim 13 , wherein the first code module comprises a Java applet.

17. The program storage device of claim 13 , wherein the first code module comprises JavaScript.

18. The program storage device of claim 13 , wherein the cryptographic hash value is computed using Message Digest #5 (MD-5).

19. The program storage device of claim 13 , wherein the cryptographic hash value is computed using a Secure Hash Algorithm (SHA).

20. The program storage device of claim 19 , wherein the cryptographic hash value is computed using SHA-1.

21. The program storage device of claim 19 , wherein the cryptographic hash value is computed using SHA-256.

22. The program storage device of claim 13 , wherein said intercepting file system or operating system activity relating to a first code module comprises monitoring operating system process creation or module load activity.

23. The program storage device of claim 22 , wherein the kernel mode driver is configured for operation within a Microsoft Windows operating system.

24. The program storage device of claim 23 , wherein said intercepting file system or operating system activity relating to a first code module comprises an operating system module load activity monitor intercepting module load activity by running processes within the computer system by hooking to a Windows CreateSection API call and temporarily turning control over to the kernel mode driver.