# US 12,111,958 B2 · Systems and methods for verifying the integrity of a software installation image > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,958 B2 - Document ID: US12111958B2 - Status: Granted - Kind: B2 - Application number: 17/453,463 - Filed: 2021-11-03 - Published: 2022-11-17 - Granted: 2024-10-08 - Earliest claimed: 2021-05-13 - Assignees: AO Kaspersky Lab - Applicants: AO Kaspersky Lab - Inventors: Vladimir S. Burenkov; Dmitry A. Kluagin - Web page: https://patentgrep.com/patent/US12111958B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F 8/63: {Image based installation; Cloning; Build to order} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for verifying the integrity of a software installation image before installing the software. Security of the software installation process is ensured by providing access to the software image from a security monitor using security policies. An installation system for protecting the installation of a software image includes instructions that, when executing on computing hardware, cause the computing hardware to implement: a verifier engine to verify the integrity of the software image, a security monitor engine to set an initial access state for the software image granting access to the verifier engine and to update the access state for the software image in accordance with at least one security policy, and an installer engine to install software contained in the software image according to the access state. ## Claims ### Claim 1 An installation system for protecting the installation of a software image, the installation system comprising: computing hardware of at least one processor and a memory operably coupled to the at least one processor; and instructions that, when executing on the computing hardware, cause the computing hardware to implement: a security monitor engine configured to set an initial access state for the software image granting access to a verifier engine and to update the access state for the software image in accordance with at least one security policy, the verifier engine configured to verify the integrity of the software image, and an installer engine configured to install software contained in the software image according to the access state, wherein the security monitor engine is further configured to: set a verifier integrity level for the verifier engine higher than a software image integrity level for the software image, and an installer integrity level for the installer engine higher than the software image integrity level for the software image, set a verifier access level for the verifier engine equal to the software image integrity level, set an installer engine access level equal to the installer integrity level, and set the at least one security policy to allow components of the verifier engine or the installer engine access to another component when the respective access level of a first component does not exceed the respective integrity level of a second component, wherein when the verifier engine successfully verifies the integrity of the software image, the security monitor engine is further configured to change the software image integrity level to be equal to the installer engine access level. ### Claim 2 (depends on 1) The installation system of claim 1, wherein after a determination by the verifier engine that the integrity of the software image is not compromised, the security monitor engine updates the access state to grant access to the installer engine. ### Claim 3 (depends on 2) The installation system of claim 2, wherein after a determination by the verifier engine that the integrity of the software image is not compromised, the security monitor engine updates the access state to deny access to the verifier engine. ### Claim 4 (depends on 1) The installation system of claim 1, wherein the initial access state for the software image further includes denying access to the installer engine, and wherein after a determination by the verifier engine that the integrity of the software image is compromised, the security monitor engine does not update the initial access state. ### Claim 5 (depends on 1) The installation system of claim 1, wherein the at least one security policy includes a finite state machine, wherein the finite state machine includes a state transition table utilizing the access state. ### Claim 6 (depends on 1) The installation of claim 1, wherein the at least one security policy includes temporal logic associated with events of a state of the software image. ### Claim 7 (depends on 1) The installation system of claim 1, wherein the software image includes a plurality of objects including at least one compromised object and at least one non-compromised object, and wherein the installer engine installs only the at least one non-compromised object. ### Claim 8 (depends on 1) The installation system of claim 1, wherein the verifier engine is configured to verify the integrity of the software image by determining that the software image is not modified or replaced. ### Claim 9 (depends on 8) The installation system of claim 8, wherein the verifier engine is configured to determine that the software image is not modified or replaced includes at least one of: checking a digital signature of the software image; receiving a confirmation from a user; using a message authentication code; checking whether a user role satisfies at least one user role requirement; and verifying predetermined attributes of the software image. ### Claim 10 A method for protecting the installation of a software image, comprising: setting an initial access state for the software image granting access to a verifier engine and to update the access state for the software image in accordance with at least one security policy; verifying, with the verifier engine, the integrity of the software image; installing, with an installer engine, software contained in the software image according to the access state; and by a security monitor engine, setting a verifier integrity level for a verifier engine higher than a software image integrity level for the software image, and an installer integrity level for an installer engine higher than the software image integrity level for the software image, wherein the verifier engine is configured to verify the integrity of the software image, and the installer engine is configured to install software contained in the software image, setting a verifier access level for the verifier engine equal to the software image integrity level, setting an installer engine access level equal to the installer integrity level, and setting at least one security policy to allow components of the verifier engine or the installer engine access to another component when the respective access level of a first component does not exceed the respective integrity level of a second component, wherein when the verifier engine successfully verifies the integrity of the software image, the security monitor engine is further configured to change the software image integrity level to be equal to the installer engine access level. ### Claim 11 (depends on 10) The method of claim 10, further comprising: after a determination that the integrity of the software image is not compromised, updating the access state to grant access to the installer engine. ### Claim 12 (depends on 11) The method of claim 11, further comprising: after a determination that the integrity of the software image is not compromised, updating the access state to deny access to the verifier engine. ### Claim 13 (depends on 10) The method of claim 10, wherein setting the initial access state for the software image further includes denying access to the installer engine, the method further comprising: after a determination that the integrity of the software image is compromised, not updating the initial access state. ### Claim 14 (depends on 10) The method of claim 10, wherein the at least one security policy includes a finite state machine, wherein the finite state machine includes a state transition table utilizing the access state. ### Claim 15 (depends on 10) The method of claim 10, wherein the at least one security policy includes temporal logic associated with events of a state of the software image. ### Claim 16 (depends on 10) The method of claim 10, wherein the software image includes a plurality of objects including at least one compromised object and at least one non-compromised object, and wherein the installer engine installs only the at least one non-compromised object. ### Claim 17 (depends on 10) The method of claim 10, wherein verifying the integrity of the software image includes determining that the software image is not modified or replaced. ### Claim 18 (depends on 17) The method of claim 17, wherein verifying the integrity of the software image includes determining that the software image is not modified or replaced includes at least one of: checking a digital signature of the software image; receiving a confirmation from a user; using a message authentication code; checking whether a user role satisfies at least one user role requirement; and verifying predetermined attributes of the software image. ### Claim 19 A system for protecting the installation of a software image, the system comprising: computing hardware of at least one processor and a memory operably coupled to the at least one processor; and instructions that, when executing on the computing hardware, cause the computing hardware to implement: a security monitor engine configured to: set a verifier integrity level for a verifier engine higher than a software image integrity level for the software image, and an installer integrity level for an installer engine higher than the software image integrity level for the software image, wherein the verifier engine is configured to verify the integrity of the software image, and the installer engine is configured to install software contained in the software image, set a verifier access level for the verifier engine equal to the software image integrity level, set an installer engine access level equal to the installer integrity level, and set at least one security policy to allow components of the verifier engine or the installer engine access to another component when the respective access level of a first component does not exceed the respective integrity level of a second component, wherein when the verifier engine successfully verifies the integrity of the software image, the security monitor engine is further configured to change the software image integrity level to be equal to the installer engine access level. ### Claim 20 (depends on 19) The sy stem of claim 19, wherein the security monitor engine is further configured to grant access to the software image of the verifier engine and the installer engine according to the at least one security policy.