Patent ID: 8464050

Claim:
A method comprising: intercepting, by a kernel mode driver of a computer system, file system or operating system activity relating to a first code module initiated by a running process associated with a second code module; selectively authorizing, by the kernel mode driver, loading of the first code module by the running process by authenticating a cryptographic hash value of the first code module with reference to a multi-level whitelist, the multi-level whitelist comprising (i) a global whitelist database remote from the computer system and maintained by a trusted service provider, the global whitelist database containing cryptographic hash values of approved code modules, which are known not to contain viruses or malicious code and (ii) a local whitelist database containing cryptographic hash values of at least a subset of the approved code modules; allowing the running process to load the first code module when the cryptographic hash value matches one of the cryptographic hash values of approved code modules within the multi-level whitelist; and wherein the kernel mode driver is implemented in one or more processors and one or more computer-readable storage media associated with the computer system, the one or more computer-readable storage media having instructions tangibly embodied therein representing the kernel mode driver that are executable by the one or more processors.