# US 2021/0279326 A1 · Preventing untrusted script execution

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0279326 A1
- Document ID: US20210279326A1
- Status: Published application
- Kind: A1
- Application number: 16/808,590
- Filed: 2020-03-04
- Published: 2021-09-09
- Earliest claimed: 2020-03-04
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Constantin Mircea Adam; Richard Jay Cohen; Jeffrey Edward Lammers; Cheng Yi Lee; Brian Peterson; Maja Vukovic; Xiongfei Wei
- Web page: https://patentgrep.com/patent/US20210279326A1

## CPC

- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Using a first key, an encrypted file fingerprint is decrypted, the decrypting resulting in a decrypted file fingerprint. Using a hash function on a script file, a script file fingerprint is computed, the script file intended to be executed by an interpreter. Responsive to the script file fingerprint matching the decrypted file fingerprint, the script file is executed.

## Claims

### Claim 1

A computer-implemented method comprising:
decrypting, using a first key, an encrypted file fingerprint, the decrypting resulting in a decrypted file fingerprint;
computing, using a hash function on a script file, a script file fingerprint, the script file intended to be executed by an interpreter; and
executing, responsive to the script file fingerprint matching the decrypted file fingerprint, the script file.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising:
preventing, responsive to the script file fingerprint not matching the decrypted file fingerprint, the script file from executing.

### Claim 3 (depends on 3)

The computer-implemented method of claim 3, wherein the encrypted fingerprint file is encrypted using a second key, the first key comprising a public key of a public-private key pair, the second key comprising a private key of the public-private key pair.

### Claim 4 (depends on 3)

The computer-implemented method of claim 3, wherein the encrypted fingerprint file and the second key are received as part of a deployment package, the deployment package further comprising a file corresponding to the encrypted fingerprint file.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein the decrypted file fingerprint comprises a result computed using the hash function on a trusted file.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein the decrypted file fingerprint is stored in a repository of file fingerprints.

### Claim 7

A computer program product for preventing untrusted script execution, the computer program product comprising:
one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to decrypt, using a first key, an encrypted file fingerprint, the decrypting resulting in a decrypted file fingerprint;
program instructions to compute, using a hash function on a script file, a script file fingerprint, the script file intended to be executed by an interpreter; and
program instructions to execute, responsive to the script file fingerprint matching the decrypted file fingerprint, the script file.

### Claim 8 (depends on 7)

The computer program product of claim 7, further comprising:
program instructions to prevent, responsive to the script file fingerprint not matching the decrypted file fingerprint, the script file from executing.

### Claim 9 (depends on 7)

The computer program product of claim 7, wherein the encrypted fingerprint file is encrypted using a second key, the first key comprising a public key of a public-private key pair, the second key comprising a private key of the public-private key pair.

### Claim 10 (depends on 9)

The computer program product of claim 9, wherein the encrypted fingerprint file and the second key are received as part of a deployment package, the deployment package further comprising a file corresponding to the encrypted fingerprint file.

### Claim 11 (depends on 7)

The computer program product of claim 7, wherein the decrypted file fingerprint comprises a result computed using the hash function on a trusted file.

### Claim 12 (depends on 7)

The computer program product of claim 7, wherein the decrypted file fingerprint is stored in a repository of file fingerprints.

### Claim 13 (depends on 7)

The computer program product of claim 7, wherein the stored program instructions are stored in the at least one of the one or more storage media of a local data processing system, and wherein the stored program instructions are transferred over a network from a remote data processing system.

### Claim 14 (depends on 7)

The computer program product of claim 7, wherein the stored program instructions are stored in the at least one of the one or more storage media of a server data processing system, and wherein the stored program instructions are downloaded over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system.

### Claim 15

A computer system comprising one or more processors, one or more computer-readable memories, and one or more computer-readable storage media, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:
program instructions to decrypt, using a first key, an encrypted file fingerprint, the decrypting resulting in a decrypted file fingerprint;
program instructions to compute, using a hash function on a script file, a script file fingerprint, the script file intended to be executed by an interpreter; and
program instructions to execute, responsive to the script file fingerprint matching the decrypted file fingerprint, the script file.

### Claim 16 (depends on 15)

The computer system of claim 15, further comprising:
program instructions to prevent, responsive to the script file fingerprint not matching the decrypted file fingerprint, the script file from executing.

### Claim 17 (depends on 15)

The computer system of claim 15, wherein the encrypted fingerprint file is encrypted using a second key, the first key comprising a public key of a public-private key pair, the second key comprising a private key of the public-private key pair.

### Claim 18 (depends on 17)

The computer system of claim 17, wherein the encrypted fingerprint file and the second key are received as part of a deployment package, the deployment package further comprising a file corresponding to the encrypted fingerprint file.

### Claim 19 (depends on 15)

The computer system of claim 15, wherein the decrypted file fingerprint comprises a result computed using the hash function on a trusted file.

### Claim 20 (depends on 15)

The computer system of claim 15, wherein the decrypted file fingerprint is stored in a repository of file fingerprints.