Secure system for allowing the execution of authorized computer program code

1. A method comprising:

intercepting, by a kernel mode driver of a computer system, file system or operating system activity relating to a code module;

selectively authorizing, by the kernel mode driver, the code module by authenticating a content authenticator of the code module with reference to a multi-level whitelist, the multi-level whitelist comprising (i) a global whitelist database remote from the computer system, the global whitelist database containing content authenticators of approved code modules that are known not to contain viruses or malicious code and (ii) a local whitelist database containing content authenticators of at least a subset of the approved code modules;

allowing the file system or operating system activity relating to the code module when the content authenticator matches one of the content authenticators of approved code modules within the multi-level whitelist; and

blocking the file system or operating system activity relating to the code module when the content authenticator does not match any of the content authenticators of approved code modules within the multi-level whitelist.

2. The method of claim 1 , wherein the code module comprises any one of an executable code module, a dynamically-linked library file, a Java applet and a JavaScript.

3. The method of claim 1 wherein the content authenticator comprises a cryptographic hash value.

4. The method of claim 3 wherein the cryptographic hash value is computed using any one of Message Digest #5 (MD-5), Secure Hash Algorithm (SHA), SHA-1 and SHA-256.

5. The method of claim 1 , wherein said intercepting file system or operating system activity relating to a code module comprises monitoring operating system process creation or module load activity.

6. The method of claim 5 , wherein the kernel mode driver is configured for operation within a Microsoft Windows operating system.

7. The method of claim 6 , wherein said intercepting file system or operating system activity relating to a code module comprises an operating system module load activity monitor intercepting module load activity by running processes within the computer system by hooking to a Windows CreateSection API call and temporarily turning control over to the kernel mode driver.

8. The method of claim 1 , wherein the multi-level whitelist further comprises an in-memory whitelist containing content authenticators of at least a subset of the approved code modules.

9. The method of claim 1 , wherein the file system or operating system activity relating to the code module comprises creating a process for the code module.

10. The method of claim 1 , wherein the file system or operating system activity relating to the code module comprises loading the code module by a running process.

11. A non-transitory program storage device readable by a computer system, tangibly embodying a program of instructions executable by one or more computer processors of the computer system to perform method steps for authenticating dependent code modules comprising:

intercepting, by a kernel mode driver of the computer system, file system or operating system activity relating to a code module;

selectively authorizing, by the kernel mode driver, the code module by authenticating a content authenticator of the code module with reference to a multi-level whitelist, the multi-level whitelist comprising (i) a global whitelist database remote from the computer system and maintained by a trusted service provider, the global whitelist database containing content authenticators of approved code modules that are known not to contain viruses or malicious code and (ii) a local whitelist database containing content authenticators of at least a subset of the approved code modules;

allowing the file system or operating system activity relating to the code module when the content authenticator matches one of the content authenticators of approved code modules within the multi-level whitelist; and

blocking the file system or operating system activity relating to the code module when the content authenticator does not match any of the content authenticators of approved code modules within the multi-level whitelist.

12. The program storage device of claim 11 , wherein the code module comprises any one of an executable code module, a dynamically-linked library file, a Java applet and a JavaScript.

13. The program storage device of claim 11 , wherein the content authenticator comprises a cryptographic hash value.

14. The program storage device of claim 13 , wherein the cryptographic hash value is computed using any one of Message Digest #5 (MD-5), Secure Hash Algorithm (SHA), SHA-1, SHA-256.

15. The program storage device of claim 11 , wherein said intercepting file system or operating system activity relating to a code module comprises monitoring operating system process creation or module load activity.

16. The program storage device of claim 15 , wherein the kernel mode driver is configured for operation within a Microsoft Windows operating system.

17. The program storage device of claim 16 , wherein said intercepting file system or operating system activity relating to a code module comprises an operating system module load activity monitor intercepting module load activity by running processes within the computer system by hooking to a Windows CreateSection API call and temporarily turning control over to the kernel mode driver.

18. The program storage device of claim 11 , wherein the multi-level whitelist further comprises an in-memory whitelist containing content authenticators of at least a subset of the approved code modules.

19. The program storage device of claim 11 , wherein the file system or operating system activity relating to the code module comprises creating a process for the code module.

20. The program storage device of claim 11 , wherein the file system or operating system activity relating to the code module comprises loading the code module by a running process.