TECHNICAL FIELD

The disclosed implementations relate generally to cybersecurity and more specifically to systems and methods of using trusted binaries to implement cybersecurity.

BACKGROUND

Cybersecurity, the practice of protecting systems and networks from digital attacks, is increasingly important in the digital age. Digital attacks are becoming increasingly sophisticated and conventional endpoint detection and response (EDR) solutions are losing their effectiveness. Many conventional EDR solutions are designed to detect and stop known attacks. However, there may be a significant delay (e.g., days, weeks, or months) between the time that a new attack is deployed and the time that the EDR solution is updated to detect and stop the attack. Moreover, malware has increasingly become polymorphic, meaning it continuously changes its pattern of behavior. This polymorphic nature further increases the response time of conventional EDR solutions.

SUMMARY

A zero trust (ZT) system of the present disclosure protects a computer from unknown and unauthorized code. In order for code to run, it must first be loaded into memory. As an example, the ZT system has a trust agent (e.g., an OS-specific trust agent), which monitors each program as the program is loaded into memory and validates the program's code. The validation procedure in this example uses a trust binary, which is an alternate digital version of the original code. To execute code in this example, the ZT system requires a corresponding trust binary for the code. If the trust binary is missing or doesn't correlate, then the code is not allowed to execute on the system in this example.

In accordance with some implementations, trust binaries are used by the ZT system to confirm that the executable code has not been tampered with prior to its execution. For example, a trust binary is created for an executable file (e.g., an executable program) by first identifying the code segments of the file. Next the code segments are scanned and the executable functions within each are identified. In this example, for each identified function, a function digest is created based on a starting address of the function and its static parts. The function digests for the identified functions are combined into a trust binary for the file. In this example, a trust binary name is generated by hashing a header of the file and the trust binary is added to a trust database (e.g., a trust store), indexed by the trust binary name.

In accordance with some implementations, trust binaries are used to protect all running code in memory on a protected device. For example, the ZT protection is implemented as a kernel agent (e.g., a kernel-level device driver). In this example, the kernel agent runs at Ring-0 on the protected device, whereas application code runs at Ring-3. An example ZT protection procedure includes loading the kernel agent, where the agent loads its trust binary from a trust database and verifies that the code in memory matches the trust binary (e.g., it has not been tampered with). In this example, while the agent is running it performs spot validation when code attempts to perform certain system level operations, such as file I/O operations, registry I/O operations, thread start and stop operations, and image load and unload operations. As discussed in greater detail later, additional countermeasures may also be employed to protect against a wide range of attacks. In this example, if code doesn't match the trust binary or one of the countermeasures detects an attack, then either the process is stopped and forensics captured, or the process is allowed to continue but with forensics being captured (e.g., based on a device policy).

In various circumstances, the ZT system of the present disclosure has the following advantages over conventional cybersecurity systems. First, in accordance with some implementations, the ZT system is effective against new and emerging threats as the system blocks all untrusted binary files and thus there is no vulnerability period while the threats are being identified. Second, in accordance with some implementations, the ZT system has high efficacy as there is no dependency on past trends and no false negatives when identifying untrusted binaries. Third, in accordance with some implementations, because the ZT system monitors memory, it protects against attacks that start in memory via legitimate processes and applications. Fourth, the ZT system can operate on off-network (e.g., air gapped) systems as it can maintain and validate its trust store without requiring network access.

In accordance with some implementations, a method is performed at a computing device having memory and one or more processors. The method includes: (i) obtaining executable code for a program; (ii) identifying a plurality of executable functions from the executable code; (iii) for each executable function of the plurality of executable functions, generating a respective function digest based on one or more static parts of the respective executable function; (iv) constructing a respective trust binary comprising the respective digest for each executable function of the plurality of executable functions; (v) generating a trust binary name by applying a hash function to a header of the executable code; and (vi) indexing the trust binary in a trust database utilizing the trust binary name.

In accordance with some implementations, a method is performed at a computing device having memory and one or more processors. The method includes: (i) executing a trust agent; (ii) detecting, via the trust agent, upcoming execution of a program on the computing device; (iii) in response to the detection, obtaining a trust binary for the program from a trust store in the memory; (iv) confirming authenticity of the program by comparing executable code of the program with the obtained trust binary for the program; (v) allowing execution of the program in accordance with the confirmed authenticity of the program; (vi) identifying upcoming execution of an executable function in the program by monitoring execution of the program; (vii) in response to identifying the upcoming execution of the executable function, obtaining, from the trust binary, a function digest corresponding to the executable function; (viii) confirming authenticity of the executable function by comparing executable code of the executable function with the obtained function digest; and (ix) allowing execution of the executable function in accordance with the confirmed authenticity of the executable function.

In accordance with some implementations, a computer-readable storage medium includes a trust database storing a plurality of trust binaries, each trust binary corresponding to a respective executable program. Each trust binary of the plurality of trust binaries includes: (i) a respective trust binary name generated by applying a hash function to a respective header of a respective executable program; and (ii) a respective function digest for each executable function identified in the respective executable program, wherein the respective function digest is generated based on a respective starting address and one or more respective static parts of the respective executable function. The plurality of trust binaries are indexed in the trust database using their respective trust binary names.

In accordance with some implementations, a method is performed at a computing device having memory and one or more processors. The method includes: (i) accessing a trust store for the computing device, including obtaining a blockchain for the trust store; (ii) identifying a first change to the trust store; (iii) in response to identifying the first change, generating a first block and inserting the first block into the blockchain, where the first block includes a first encrypted digest for the first change; (iv) identifying a second change to the trust store; and (v) in response to identifying the second change, generating a second block and inserting the second block into the blockchain, where the second block includes a second encrypted digest for the second change and the first encrypted digest.

In some implementations, a computing device includes one or more processors, memory, a display, and one or more programs stored in the memory. The programs are configured for execution by the one or more processors. The one or more programs include instructions for performing any of the methods described herein.

In some implementations, a non-transitory computer-readable storage medium stores one or more programs configured for execution by a computing device having one or more processors, memory, and a display. The one or more programs include instructions for performing any of the methods described herein.

Thus, methods and systems are disclosed for creating and using trust binaries and blockchains for cybersecurity. Such methods and systems may complement or replace conventional methods and systems of cybersecurity.

