Initiating execution of a computer program from an encrypted version of a computer program

• US 7,346,781 B2
• Filed: 12/06/2001
• Issued: 03/18/2008
• Est. Priority Date: 12/06/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Wolff, Daniel Joseph, Muttik, Igor Garrievich, Cowie, Neil Andrew
• Primary Examiner(s): ZIA, SYED
• Application Number:
  US10/003,322
• Publication Number:
  US 20030110387A1
• Time in Patent Office: 2,294 Days
• Field of Search: 713/189, 726 22- 26
• US Class Current: 713/189
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

When a user commands execution of a computer program to commence, a loader program 2 is first started. This loader program 2 reads an encrypted version of the computer program 6 and decrypts it using a public key. This generates an executable version of the computer program 9 which is written directly to the computer memory 8. When the loader program 2 has decrypted the whole of the computer program 9 it starts execution of the computer program 9 it has written into the computer memory 8 and terminates itself or is terminated by the computer program it started. The computer program 9 written into the computer memory 8 will be written into its own memory space and will have its own execution thread. The encryption used may be public key/private key encryption.

Claims

1. A computer program product embodied on a tangible computer readable medium for controlling a computer to execute a computer program within said computer memory, said computer program product comprising:

(a) a loader program; and

(b) an encrypted version of said computer program;

wherein said loader program is operable to;

(i) read said encrypted version of said computer program stored in a program store;

(ii) decrypt said encrypted version of said computer program to form said computer program in an executable form;

(iii) load said computer program directly into said computer memory; and

(iv) trigger execution of said computer program as loaded into said computer memory by said loader program;

wherein said computer program that is decrypted, loaded, and executed includes a malware scanning computer program;

wherein said malware scanning computer program is operable such that once executed, said malware scanning computer program scans said loader program for malware;

wherein, if said loader program is detected as being infected with said malware, then said malware scanning computer program is operable to repair said loader program or replace said loader program with a clean copy of said loader program;

wherein said malware scanning computer program is operable to scan for said malware including one or more of a computer virus, a worm, a Trojan, a banned computer file, a banned word and a banned image.

2. A computer program product as claimed in claim 1, wherein said encrypted version of said computer program is encrypted with a private encryption key and said loader program is operable to decrypt said encrypted version of said computer program with a corresponding public key.

3. A computer program product as claimed in claim 1, wherein said encrypted Version of said computer program and said loader program are stored as separate computer files within a computer file store.

4. A computer program product as claimed in claim 1, wherein said loader program is associated with initialisation data specifying one or more of:

a storage location of said encrypted version of said computer program;

a key to be used in decrypting said encrypted version of said computer program; and

parameters specifying how said computer program should be loaded into said computer memory for execution.

5. A computer program product as claimed in claim 1, wherein said loader program is operable to terminate after triggering execution of said computer program.

6. A computer program product as claimed in claim 1, wherein said computer program is operable to terminate said loader program when said computer program is triggered to execute by said loader program.

7. A computer program product as claimed in claim 1, wherein said loader program is operable to load said computer program into a memory space within said computer memory separate from a memory space used by said loader program.

8. A computer program product as claimed in claim 1, wherein said loader program is operable to load said computer program into an execution stream separate from an execution stream used by said loader program.

25. A computer program product as claimed in claim 1, wherein, as a first task, said malware scanning computer program scans said loader program for said malware.

26. A computer program product as claimed in claim 1, wherein, if said loader program is detected as being infected with said malware, ten said malware scanning computer program is operable to replace said loader program with a clean copy of said loader program.

27. A computer program product as claimed in claim 1, wherein, if said loader program is detected as being infected with said malware, ten said malware scanning computer program is operable to repair said loader program.

9. A method of executing of a computer program embodied on a tangible computer readable medium, within a computer memory, said method comprising tile steps of:

(a) executing a loader program, said loader program operating to;

(i) read an encrypted version of said computer program stored in a program store;

(ii.) decrypt said encrypted version of said computer program to form said computer program in an executable form;

(iii) load said computer program directly into said computer memory; and

(iv) trigger execution of said computer program; and

(b) executing said computer program, as loaded into said computer memory by said loader program;

wherein said computer program that is decrypted, loaded, and executed includes a malware scanning computer program;

wherein said malware scanning computer program is operable such that once executed, said malware scanning computer program scans said loader program for malware;

wherein, if said loader program is detected as being infected with said malware, then said malware scanning computer program is operable to repair said loader program or replace said loader program with a dean copy of said loader program;

wherein said malware scanning computer program is operable to scan for said malware including one or more of a computer virus, a worm, a Trojan, a banned computer file, a banned word and a banned image.

10. A method as claimed in claim 9, wherein said encrypted version of said computer program is encrypted with a private encryption key and said loader program decrypts said encrypted version of said computer program with a corresponding public key.

11. A method as claimed in claim 9, wherein said encrypted version of said computer program and said loader program are stored as separate computer files within a computer file store.

12. A method as claimed in claim 9, wherein said loader program is associated with initialisation data specifying one or more of:

a storage location of said encrypted version of said computer program;

a key to be used in decrypting said encrypted version of said computer program; and

parameters specifying how said computer program should be loaded into said computer memory for execution.

13. A method as claimed in claim 9, wherein said loader program tenninates after triggering execution of said computer programs.

14. A method as claimed in claim 9, wherein said computer program terminates said loader program when said computer program is triggered to execute by said loader program.

15. A method as claimed in claim 9, wherein said loader program loads said computer program into a memory space within said computer memory separate from a memory space used by said loader program.

16. A method as claimed in claim 9, wherein said loader program loads said computer program into an execution stream separate from an execution stream used by said loader program.

17. Apparatus for executing a computer program embodied on a tangible computer readable medium, within a computer memory, said apparatus comprising:

(a) loader program logic; and

(b) a program store operable to store an encrypted version of said computer program;

wherein said loader program logic is operable to;

(i) read said encrypted version of said computer program stored in said program store;

(ii) decrypt said encrypted version of said computer program to form said computer program in an executable form;

(iii) load said computer program directly into said computer memory; and

(iv) trigger execution of said computer program as loaded into said computer memory by said loader program;

wherein said computer program that is decrypted, loaded, and executed includes a malware scanning computer program;

wherein said malware scanning computer program is operable such that once executed, said malware scanning computer program scans said loader program for malware;

wherein if said loader program is detected as belong infected with said malware, then said malware scanning computer program is operable to repair said loader program or replace said loader program with a clean copy of said loader program;

wherein said malware scanning computer program is operable to scan for said malware including one or more of a computer virus, a worm, a Trojan, a banned computer file, a banned word and a brained image.

18. Apparatus as claimed in claim 17, wherein said encrypted version of said computer program is encrypted with a private encryption key and said loader program logic is operable to decrypt said encrypted version of said computer program with a corresponding public key.

19. Apparatus as claimed in claim 17, wherein said encrypted version of said computer program and said loader program are stored as separate computer files within a computer file store.

20. Apparatus as claimed in claim 17, wherein said loader program logic is associated with initialisation data specifying one or more of:

a storage location of said encrypted version of said computer program;

a key to be used in decrypting said encrypted version of said computer program; and

parameters specifying how said computer program should be loaded into said computer memory for execution.

21. Apparatus as claimed in claim 17, wherein said loader program logic is operable to terminate after triggering execution of said computer programs.

22. Apparatus as claimed in claim 17, wherein said computer program logic is operable to tenninate said loader program when said computer program is triggered to execute by said loader program.

23. Apparatus as claimed in claim 17, wherein said loader program logic is operable to load said computer program into a memory space within said computer memory separate from a memory space used by said loader program logic.

24. Apparatus as claimed in claim 17, wherein said loader program logic is operable to load said computer program into an execution stream separate from an execution stream used by said loader program logic.