Binary verification service

• US 8,074,205 B2
• Filed: 04/18/2007
• Issued: 12/06/2011
• Est. Priority Date: 04/18/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Shastry, Shankara M. C., Bendapudi, Perraju, Ganapathy, Narayanan, Levin, Vladimir A.
• Primary Examiner(s): Zhen, Li
• Assistant Examiner(s): Lee, Marina
• Application Number:
  US11/736,935
• Publication Number:
  US 20080258865A1
• Time in Patent Office: 1,693 Days
• Field of Search: None
• US Class Current: 717/126
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A binary is received at a binary verification service from a binary verification client agent. The binary verification service performs binary verification of the binary, wherein binary verification includes determining whether the binary is complicit with a set of usage rules. The binary verification service sends a binary verification result to the binary verification client agent.

Claims

1. A method, comprising:

receiving, at a binary verification service on a server, a binary sent over a network from a binary verification client agent on a computing device of a user;

performing, by the binary verification service, binary verification of the binary, wherein binary verification includes determining whether the binary is complicit with a set of usage rules applied to the binary;

storing, by the binary verification service, the binary and a binary verification result in a binary verification service database, the binary verification result indicating whether the binary follows all usage rules of the set of usage rules and including a grade indicating how closely the binary followed the set of usage rules when the binary does not follow all of the usage rules of the set of usage rules;

sending, by a binary verification service, the binary verification result over the network to the binary verification client agent for presenting the binary verification result to the user prior to installation of the binary on the computing device of the user;

receiving, at the binary verification service, a usage rule update including a revision to an existing rule of the set of usage rules or a new usage rule for the set of usage rules;

validating the usage rule update;

performing, by the binary verification service, re-verification of the binary using the usage rule update;

storing, by the binary verification service, an updated binary verification result for the binary in the binary verification service database; and

pushing, by the binary verification service, the updated verification result over the network to the binary verification client agent to automatically alert the user about the updated verification result for the binary.

2. The method of claim 1, further comprising:

receiving, by the binary verification service, binary identification information associated with the binary from the binary verification client agent.

3. The method of claim 1, further comprising:

receiving, at the binary verification service, binary identification information associated with the binary sent over the network from a second binary verification client agent;

looking up, by the binary verification service, the binary verification result for the binary in the binary verification service database using the binary identification information; and

sending, by the binary verification service, the binary verification result found in the binary verification service database that corresponds to the binary identification information over the network to the second binary verification client agent.

4. The method of claim 1, further comprising:

receiving, at the binary verification service, a new usage rule for the set of usage rules; and

updating, by the binary verification service, the set of usage rules with the new usage rule.

5. The method of claim 4, further comprising

performing, by the binary verification service, re-verification of a plurality of binaries stored in a binary verification service database using the new usage rule;

and

storing, by the binary verification service, updated binary verification results corresponding to the plurality of binaries stored in the binary verification service database.

6. The method of claim 5, further comprising:

notifying, by the binary verification service, a plurality of binary verification client agents of the updated verification results.

7. The method of claim 1, wherein the binary verification result includes a letter or number grade for the binary.

8. One or more computer readable storage media including computer readable instructions executed by the server to perform the method of claim 1.

9. A method, comprising:

sending, by a binary verification client agent on a computing device of a user, a binary over a network to a binary verification service on a server, the binary verification service configured to determine whether the binary is complicit with a set of usage rules applied to the binary;

receiving, at the binary verification client agent, a binary verification result for the binary over the network from the binary verification service;

presenting the verification result to the user prior to installation of the binary on the computing device of the user, the binary verification result indicating whether the binary follows all usage rules of the set of usage rules and including a grade indicating how closely the binary followed the set of usage rules when the binary does not follow all of the usage rules of the set of usage rules;

installing the binary on the computing device of the user; and

receiving an updated verification result sent by the binary verification service to the binary verification client agent over the network, the updated verification result pushed to the binary verification client agent in response to the binary verification service receiving a usage rule update including a revision to an existing rule of the set of usage rules or a new usage rule for the set of usage rules, validating the usage rule update, and re-verifying the binary using the usage rule update; and

automatically alerting the user about the updated verification result for the binary.

10. The method of claim 9, further comprising:

selecting, at the binary verification client agent, the binary for verification based at least in part on user input downloading the binary to the computing device.

11. The method of claim 9, further comprising:

sending, by the binary verification client agent, binary identification information associated with the binary to the binary verification service; and

receiving a request for the binary from the binary verification service in response to the binary verification service determining that the binary has not been previously verified.

12. The method of claim 9, further comprising:

presenting, by the binary verification client agent, binary verification updates to a plurality of previously verified binaries.

13. The method of claim 9, further comprising:

re-coding the binary according to a new rule based on the updated verification result which was sent by the binary verification service in response to the usage rule update.

14. One or more computer readable storage media including computer readable instructions executed by the computing device of the user to perform the method of claim 9.

15. A computer system, comprising:

a processing unit for executing computer readable instructions;

a binary verification service database; and

memory storing computer readable instructions for implementing a binary verification service configured to communicate over a network with a binary verification client agent on a computing device of a user, the binary verification service to;

receive a binary sent over the network from the binary verification client agent;

determine whether the binary is complicit with a set of usage rules applied to the binary;

store the binary and a binary verification result in the binary verification service database, the binary verification result indicating whether the binary follows all usage rules of the set of usage rules and including a grade indicating how closely the binary followed the set of usage rules when the binary does not follow all of the usage rules of the set of usage rules;

send the binary verification result for the binary over the network to the binary verification client agent for presenting the binary verification result to the user prior to installation of the binary on the computing device of the user;

receive a usage rule update including a revision to an existing rule of the set of usage rules or a new usage rule for the set of usage rules;

validate the usage rule update;

perform re-verification of the binary using the usage rule update;

store an updated binary verification result for the binary in the binary verification service database; and

push the updated verification result over the network to the binary verification client agent to automatically alert the user about the updated verification result for the binary.

16. The system of claim 15, wherein the binary verification service is further configured to:

receive binary identification information associated with the binary sent over the network from a second binary verification client agent;

look up the binary verification result for the binary from the binary verification service database using binary identification information; and

send the binary verification result found in the binary verification service database that corresponds to the binary identification information over the network to the second binary verification client agent.

17. The system of claim 15, wherein the binary verification service sends a request for the binary in response to the binary verification service determining that the binary has not been previously verified.

18. The system of claim 17, wherein the binary verification service receives binary identification information associated with the binary and searches for a stored binary verification result for the binary in the binary verification service database using the binary identification information.

19. The system of claim 15, wherein the binary verification service receives a new usage rule for the set of usage rules and updates the set of usage rules with the new usage rule.

20. The system of claim 19, wherein the binary verification service:

performs re-verification of a plurality of binaries stored in a binary verification service database using the new usage rule;

stores updated binary verification results corresponding to the plurality of binaries stored in the binary verification service database; and

notifies a plurality of binary verification client agents of the updated binary verification results.