Access Control Entry Lockout for Malicious Software Processes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems lack effective methods to universally control and prevent the execution of malicious, dangerous, and undesirable software processes, including those already running, without labor-intensive manual intervention or continuous resource expenditure.
Innovation Solution
A method involving the use of Access Control Entries (ACEs) in Access Control Lists (ACLs) to deny permissions to system objects required by such software, effectively disabling them and preventing future access or execution, applicable across various operating systems including Windows and others with ACL/ACE mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control entries are used to deny permissions to system objects, then malicious and dangerous software is disabled and prevented from executing, but legitimate software that requires those system objects may also be blocked
Solution Approach 1:
The patent applies local quality by creating specific access control entries that target only the malicious software processes while leaving legitimate software unaffected. Each ACE is configured with specific security identifiers (SIDs) and permission denials that are localized to the harmful processes identified through digital signature verification, ensuring that only the specific malicious entities are blocked while other processes retain their necessary access rights to system objects.
Solution Approach 2:
The patent segments the access control mechanism by creating individual access control entries for different malicious processes rather than applying a blanket denial. Each ACE is a separate, discrete unit that can be independently managed, allowing the system to selectively deny permissions to specific malicious processes while maintaining access for legitimate software through separate, unaffected ACEs.
2Reliability
If manual intervention is used to disable or remove malicious software, then control over dangerous processes is achieved, but labor-intensive tailoring of individual computer systems is required
Solution Approach 1:
The patent implements self-service by enabling the system to automatically identify, analyze, and disable malicious software processes without requiring manual intervention. The system autonomously verifies digital signatures of running processes, compares them against known malicious signatures, and applies appropriate access control denials automatically, eliminating the need for labor-intensive manual tailoring of individual computer systems.
Solution Approach 2:
The patent applies parameter changes by dynamically modifying access control list parameters (specifically ACE permissions) based on the analysis of process characteristics. When a malicious process is identified through digital signature verification, the system changes the permission parameters of the relevant system objects to deny access to that specific process, enabling automated response without manual configuration.
3Reliability
If access control entries are stored in access control lists for system objects, then future access or execution by malicious entities is prevented, but existing malicious processes that are already running may continue to operate
Solution Approach 1:
The patent applies preliminary action by proactively analyzing the digital signatures of processes before they can execute malicious code. The system continuously monitors and verifies process signatures in real-time, identifying malicious processes before they can fully operate or cause damage. This preliminary detection and response mechanism prevents malicious processes from establishing themselves, rather than merely blocking future access after the fact.
4Reliability
If comprehensive access control is applied to all system objects, then all malicious, dangerous, and undesirable processes are controlled, but legitimate processes that need those system objects are also restricted
Solution Approach 1:
The patent applies local quality by implementing differentiated access control policies for different processes based on their identity and behavior. Rather than applying uniform comprehensive control to all system objects, the system selectively applies denials only to malicious processes identified through digital signature verification, while legitimate processes maintain their normal access rights. This localized approach ensures comprehensive control over threats while preserving system versatility for legitimate operations.
Data Source
AI summary
A method for disabling a process in a computer, particularly including processes such as viruses, spyware, adware, and malware generally. A file object (file or folder) is identified in the computer that is required by the process. An access control entry (ACE) is then stored in an access control list (ACL) for the file object. The ACE specifies an entity (user or group) and a permission needed by that entity to access or execute the file object. The ACE further specifies that the entity is denied the permission it needs. This disables the process by denying the entity the future ability to access or execute the file object.