A Lightweight Binary Authentication System for Windows

Abstract

The problem of malware is greatly reduced if we can ensure that only software from trusted providers is executed. In this paper, we have built a prototype system on Windows which performs authentication of all binaries in Windows to on Windows are made more complex because there are many kinds of binaries besides executables, e.g. DLLs, drivers, ActiveX controls, etc. We combine this with a simple software ID scheme for software management and vulnerability assessment which leverages on trusted infrastructure such as DNS and Certificate Authorities. Our prototype is lightweight and does not need to rely on PKI infrastructure; it does however take advantage of binaries with existing digital signatures. We provide a detailed security analysis of our authentication scheme. We demonstrate that our prototype has low overhead, around 2%, even when all binary code is authenticated.

Simple and Practical Integrity Models for Binaries and Files

“…The T (f ) signature verification in BInt+tr is cached so that multiple loadings only need a single verification unless the binary is modified. This caching optimization is similar to that in [13] which has been shown to be efficient with negligible overhead for real applications. File writing, renaming and deletion are monitored through the ZwCreateFile and ZwDeleteFile kernel APIs.…”

“…Signed binaries only allow signed binaries to be loaded or executed [9,13] However, signing is primarily about establishing trust relationships. It only ensures that the signed binaries are from a party having the key.…”

“…For unmonitorable b-valid files, their signatures are updated immediately after the file is modified. For binaries that just come online, we verify the signatures once for each binary and cache the result [13]. We optimize the signature verification with a lazy way of updating signatures to reduce the overhead of signature verification.…”

“…Many security models and mechanisms [10,11,13,15,16,21] have been proposed to protect against binary attacks. They may not be practical in a Windows context and mostly not designed for a dynamic and closed-source binary lifecycle.…”

Enhancing host security using external environment sensors

“…If we consider a computer host to include the host, the user channel, and the network channel, then host security can be divided into: (i) software security, which ensures the software running in the host, is authentic, e.g., antivirus [17], system call filtering [18], and binary authentication [19]; (ii) user security, which ensures the user, is authentic, e.g., password/biometric authentication, physical perimeters, and surveillance camera monitoring; and (iii) network security,which ensures the network communication, is authentic, e.g., personal firewalls [20]. Our approach to enhance host security is substantially different from the existing designs in three aspects.…”