SECURE SYSTEM FOR ALLOWING THE EXECUTION OF AUTHORIZED COMPUTER PROGRAM CODE

摘要

Systems and methods for selective authorization of code modules are provided. According to one embodiment, a kernel mode driver monitors events occurring within a file system or an operating system. Responsive to observation of a trigger event performed by or initiated by an active process, in which the active process corresponds to a first code module within the file system and the event relates to a second code module within the file system, performing or bypassing a real-time authentication process on the second code module with reference to a whitelist containing content authenticators of approved code modules, which are known not to contain viruses or malicious code. The active process is allowed to load the second code module into memory when the real-time authentication process is bypassed or when it is performed and determines a content authenticator of the code module matches one of the content authenticators.

主权项

1. A method comprising:
monitoring, by a kernel mode driver of a computer system, a set of events occurring within one or more of a file system accessible by the computer system and an operating system that manages resources of the computer system; responsive to observation, by the kernel mode driver, of an event of the set of events performed by or initiated by an active process running on the computer system, wherein the active process corresponds to a first code module stored within the file system and the event relates to a second code module stored within the file system, performing or bypassing a real-time authentication process on the second code module with reference to a whitelist containing content authenticators of approved code modules, which are known not to contain viruses or malicious code; and allowing the active process to load the second code module into a memory of the computer system (i) when the real-time authentication process is bypassed or (ii) when the real-time authentication process is performed and determines a content authenticator of the code module matches one of the content authenticators of approved code modules within the whitelist.