Air-Gapped Anti-Virus Device for Industrial USB Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems face significant malware threats due to the limitations of existing two-layered scanning methods, where corporate IT systems, often infected, re-infect USB media, and conventional anti-malware solutions are ineffective in isolated environments.
Innovation Solution
An air-gapped anti-malware device using a single board computer with a Linux-based operating system and distinct anti-virus software, physically isolating and scanning USB media independently, providing an additional layer of protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If corporate IT systems are used to scan USB media, then malware detection is performed, but the systems may be infected and re-infect the USB media
Solution Approach 1:
The patent divides the anti-malware scanning function into separate isolated systems. Each USB media item is scanned in isolation using disposable virtual machine instances, preventing cross-contamination between scanning operations and eliminating the re-infection risk present in shared corporate IT systems.
Solution Approach 2:
The patent introduces an intermediary layer - a isolated scanning system with disposable virtual machines - between the USB media and the corporate network. This intermediary performs the scanning function without allowing direct connection to corporate resources, thus preventing re-infection while maintaining detection capability.
2Ease of operation
If conventional anti-malware software is used in isolated environments, then scanning capability is provided, but the software is ineffective against air-gapped threats
Solution Approach 1:
The patent employs dynamic, disposable virtual machine instances that are created fresh for each scanning operation and then discarded. This dynamic approach ensures that each scanning environment is clean and has not been exposed to previous threats, making conventional anti-malware software effective even in isolated environments where persistence threats exist.
Solution Approach 2:
The patent creates virtual copies of operating systems in isolated virtual machine instances for each scanning task. These copies provide a clean, controlled environment that replicates necessary system functions without sharing state with other scanning operations, thereby maintaining anti-malware effectiveness in isolated settings.
3Reliability
If full-size IT PCs are used in ICS environment, then malware scanning is performed, but the devices are not desirable in the ICS environment
Solution Approach 1:
The patent nests virtual machine instances within a compact scanning system. Multiple virtualized scanning environments are contained within a single physical device, providing full malware scanning capability without requiring multiple full-size PCs in the ICS environment. This nesting achieves both comprehensive scanning and space efficiency.
Solution Approach 2:
The patent replaces the mechanical approach of using physical full-size PCs with a virtualized system running on smaller hardware. By substituting the physical infrastructure with virtualized computing resources, the system maintains scanning capability while reducing the physical footprint and improving suitability for ICS environments.
Data Source
Figure 1
Figure 2
AI summary
Method of detecting malware in a computer storage medium is described. The method involves connecting the computer storage medium to an air-gapped anti-malware device. Scanning the computer storage medium for malware.