Patent ID: 8856933

Claim:
A method comprising: maintaining, by one or more servers of a trusted service provider, a cloud-based whitelist containing a plurality of cryptographic hash values, including those of code modules that are approved for loading into memory and execution on computer systems of a plurality of subscribers of the trusted service provider (“approved code modules”); receiving via a public network from a computer system of a subscriber of the plurality of subscribers, by a server of the one or more servers, a code module information query relating to a code module, the code module information query including a cryptographic hash value of the code module; determining, by the server, whether the cryptographic hash value matches one of the plurality of cryptographic hash values contained within the cloud-based whitelist; if said determining produces an affirmative result and the code module is among the approved code modules, then responding to the code module information query, by the server, with an indication that the code module is authorized for execution; and if said determining produces a negative result, then: responding to the code module information query, by the server, with an indication that the code module is an unknown code module; and causing, by the server, one or more behavior analysis techniques to be performed on the code module.