Secure system for allowing the execution of authorized computer program code

1. A method comprising:

maintaining, by one or more servers of a trusted service provider, a cloud-based whitelist containing a plurality of cryptographic hash values, including those of code modules that are approved for loading into memory and execution on computer systems of a plurality of subscribers of the trusted service provider (“approved code modules”);

receiving via a public network from a computer system of a subscriber of the plurality of subscribers, by a server of the one or more servers, a code module information query relating to a code module, the code module information query including a cryptographic hash value of the code module;

determining, by the server, whether the cryptographic hash value matches one of the plurality of cryptographic hash values contained within the cloud-based whitelist;

if said determining produces an affirmative result and the code module is among the approved code modules, then responding to the code module information query, by the server, with an indication that the code module is authorized for execution; and

if said determining produces a negative result, then:

responding to the code module information query, by the server, with an indication that the code module is an unknown code module; and

causing, by the server, one or more behavior analysis techniques to be performed on the code module.

2. The method of claim 1 , wherein a behavior analysis technique of the one or more behavior analysis techniques comprises sandboxing.

3. The method of claim 2 , wherein the code module comprises an executable code module.

4. The method of claim 2 , wherein the code module comprises a dynamically-linked library file.

5. The method of claim 2 , wherein the code module comprises a Java applet.

6. The method of claim 2 , wherein the code module comprises JavaScript.

7. The method of claim 1 , wherein the plurality of cryptographic hash values comprise Message Digest #5 (MD-5) hash values.

8. The method of claim 1 , wherein the cryptographic hash values comprise Secure Hash Algorithm (SHA) hash values.

9. The method of claim 1 , wherein said code module information query is responsive to a set of monitored events occurring within one or more of a file system accessible by the computer system and an operating system that manages resources of the computer system.

10. The method of claim 9 , wherein the set of monitored events include one or more of operating system process creation and module load activity.

11. A non-transitory program storage device readable by one or more servers of a trusted service provider, tangibly embodying a program of instructions executable by one or more computer processors of the one or more servers to perform a method for authenticating code modules, the method comprising:

maintaining a cloud-based whitelist containing a plurality of cryptographic hash values, including those of code modules that are approved for loading into memory and execution on computer systems of a plurality of subscribers of the trusted service provider (“approved code modules”);

receiving via a public network from a computer system of a subscriber of the plurality of subscribers a code module information query relating to a code module, the code module information query including a cryptographic hash value of the code module;

determining whether the cryptographic hash value matches one of the plurality of cryptographic hash values contained within the cloud-based whitelist;

if said determining produces an affirmative result and the code module is among the approved code modules, then responding to the code module information query with an indication that the code module is authorized for execution; and

if said determining produces a negative result, then:

responding to the code module information query with an indication that the code module is an unknown code module; and

causing one or more behavior analysis techniques to be performed on the code module.

12. The non-transitory program storage device of claim 11 , wherein a behavior analysis technique of the one or more behavior analysis techniques comprises sandboxing.

13. The non-transitory program storage device of claim 12 , wherein the code module comprises an executable code module.

14. The non-transitory program storage device of claim 12 , wherein the code module comprises a dynamically-linked library file.

15. The non-transitory program storage device of claim 12 , wherein the code module comprises a Java applet.

16. The non-transitory program storage device of claim 12 , wherein the code module comprises JavaScript.

17. The non-transitory program storage device of claim 11 , wherein the plurality of cryptographic hash values comprise Message Digest #5 (MD-5) hash values.

18. The non-transitory program storage device of claim 1 , wherein the plurality of cryptographic hash values comprise Secure Hash Algorithm (SHA) hash values.

19. The non-transitory program storage device of claim 11 , wherein said code module information query is responsive to a set of monitored events occurring within one or more of a file system accessible by the computer system and an operating system that manages resources of the computer system.

20. The non-transitory program storage device of claim 19 , wherein the set of monitored events include one or more of operating system process creation and module load activity.