Granted Patent B1

US 12,346,430 · App. 17/688,878 · Granted Jul 1, 2025

Inventors: Henry Tumblin (Castine, ME); Gary Southwell (Leander, TX)

Assignee: CSP Inc.

G06F21/51G06F2221/033

Abstract

Claims (82)

1. A method performed at a computing device having memory and one or more processors, the method comprising:

executing a trust agent;

detecting, via the trust agent, upcoming execution of a program on the computing device;

in response to the detection, obtaining a trust binary for the program from a trust store in the memory;

confirming authenticity of the program by comparing executable code of the program with the obtained trust binary for the program;

allowing execution of the program in accordance with the confirmed authenticity of the program;

identifying upcoming execution of an executable function in the program by monitoring execution of the program;

in response to identifying the upcoming execution of the executable function, obtaining, from the trust binary, a function digest corresponding to the executable function, wherein the function digest comprises a hash of static portions of the executable function, omitting portions of the executable function that require dynamic linking when loaded into memory;

confirming authenticity of the executable function by comparing executable code of the executable function with the obtained function digest; and

allowing execution of the executable function in accordance with the confirmed authenticity of the executable function.

2. The method of claim 1 , wherein detecting upcoming execution of the program comprises identifying a memory request corresponding to the program.

3. The method of claim 1 , wherein identifying upcoming execution of the executable function of the program comprises intercepting a library function call made by the program.

4. The method of claim 1 , wherein the trust agent comprises a kernel-level driver.

5. The method of claim 1 , wherein the trust agent comprises a communications service, a file monitor, an installer, and a dashboard manager.

6. The method of claim 1 , further comprising:

detecting, via the trust agent, upcoming execution of a second program; determining that the trust store does not contain a trust binary corresponding to the second program; and

initiating a remedial action in accordance with the determination.

7. The method of claim 6 , wherein the remedial action comprises one or more of:

preventing the second program from executing on the computing device;

storing information about the second program in a forensic log; and

generating a provisional trust binary for the second program.

8. The method of claim 6 , wherein the remedial action comprises generating a provisional trust binary, and the method further comprises sending executable code for the second program to a trust center for validation.

9. The method of claim 6 , wherein the remedial action comprises applying one or more countermeasures.

10. The method of claim 6 , wherein the remedial action comprises sending a query to a trust center for a trust binary for the second program.

11. The method of claim 6 , further comprising obtaining a trust policy for the computing device, wherein the initiated remedial action is selected according to the trust policy.

12. The method of claim 1 , further comprising:

detecting, via the trust agent, upcoming execution of a second program;

in response to the detection, obtaining a second trust binary for the second program from the trust store;

identifying one or more changes in executable code of the second program based on a comparison with the second trust binary; and

initiating a remedial action in accordance with the identification of the one or more changes.

13. The method of claim 1 , further comprising:

while monitoring execution of the program, identifying upcoming execution of a second executable function of the program;

in response to identifying the upcoming execution of the second executable function, determining that the trust binary does not contain a function digest for the second executable function; and

initiating a remedial action in accordance with the determination.

14. The method of claim 13 , wherein the remedial action comprises one or more of:

preventing execution of the second executable function;

stopping execution of the program;

storing information about the second executable function in a forensic log; and

generating a provisional function digest for the second executable function.

15. The method of claim 1 , further comprising:

identifying upcoming execution of a second executable function of the program;

in response to identifying the upcoming execution of the second executable function, obtaining, from the trust binary, a second function digest corresponding to the second executable function;

identifying one or more changes in the second executable function based on a comparison with the second function digest; and

initiating a remedial action in accordance with the identification of the one or more changes in the second executable function.

16. The method of claim 1 , wherein comparing executable code of the executable function with the obtained function digest comprises comparing (1) a hash of static portions of the executable function with (2) the obtained function digest.

17. A computing device, comprising:

one or more processors;

memory;

a display; and

one or more programs stored in the memory and configured for execution by the one or more processors, the one or more programs comprising instructions for:

executing a trust agent;

detecting, via the trust agent, upcoming execution of a program on the computing device;

in response to the detection, obtaining a trust binary for the program from a trust store in the memory;

confirming authenticity of the program by comparing executable code of the program with the obtained trust binary for the program;

allowing execution of the program in accordance with the confirmed authenticity of the program;

identifying upcoming execution of an executable function in the program by monitoring execution of the program;

in response to identifying the upcoming execution of the executable function, obtaining, from the trust binary, a function digest corresponding to the executable function, wherein the function digest comprises a hash of static portions of the executable function, omitting portions of the executable function that require dynamic linking when loaded into memory;

confirming authenticity of the executable function by comparing executable code of the executable function with the obtained function digest; and

allowing execution of the executable function in accordance with the confirmed authenticity of the executable function.

18. The computing device of claim 17 , wherein the one or more programs further comprise instructions for:

detecting, via the trust agent, upcoming execution of a second program;

determining that the trust store does not contain a trust binary corresponding to the second program; and

initiating a remedial action in accordance with the determination.

19. The computing device of claim 17 , wherein the one or more programs further comprise instructions for:

detecting, via the trust agent, upcoming execution of a second program;

in response to the detection, obtaining a second trust binary for the second program from the trust store;

identifying one or more changes in executable code of the second program based on a comparison with the second trust binary; and

initiating a remedial action in accordance with the identification of the one or more changes.

20. A non-transitory computer-readable storage medium storing one or more programs configured for execution by a computing device having one or more processors, memory, and a display, the one or more programs comprising instructions for:

executing a trust agent;

detecting, via the trust agent, upcoming execution of a program on the computing device;

in response to the detection, obtaining a trust binary for the program from a trust store in the memory;

confirming authenticity of the program by comparing executable code of the program with the obtained trust binary for the program;

allowing execution of the program in accordance with the confirmed authenticity of the program;

identifying upcoming execution of an executable function in the program by monitoring execution of the program;

in response to identifying the upcoming execution of the executable function, obtaining, from the trust binary, a function digest corresponding to the executable function, wherein the function digest comprises a hash of static portions of the executable function, omitting portions of the executable function that require dynamic linking when loaded into memory;

confirming authenticity of the executable function by comparing executable code of the executable function with the obtained function digest; and

allowing execution of the executable function in accordance with the confirmed authenticity of the executable function.

21. The non-transitory computer-readable storage medium of claim 20 , wherein the one or more programs further comprise instructions for:

while monitoring execution of the program, identifying upcoming execution of a second executable function of the program;

in response to identifying the upcoming execution of the second executable function, determining that the trust binary does not contain a function digest for the second executable function; and

initiating a remedial action in accordance with the determination.

Continuity (1)

References Cited (68)