Anti-malware Process Protection via Kernel-Level Signature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for securing computing devices against malicious users and malware fail to protect against attacks by users utilizing administrative permissions, allowing malicious activities such as terminating anti-malware processes.
Innovation Solution
Verifying anti-malware processes based on signatures associated with anti-malware drivers and assigning a protection level, using a hierarchy of protection levels to prevent alteration or termination by malicious users, including administrative users, by leveraging a tightly controlled agreement between OS and anti-malware manufacturers for verified signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware software is used to block malicious users, then protection against malware is improved, but the software can be circumvented by malicious users posing as administrative users
Solution Approach 1:
The patent introduces a kernel-level process monitor as an intermediary between user-level processes and the kernel. This mediator verifies the legitimacy of processes attempting to access protected resources, checking digital signatures and certification authorities before allowing operations. The process monitor acts as a trusted intermediary that prevents spoofed administrative users from bypassing anti-malware protection.
Solution Approach 2:
The patent implements preliminary verification of process legitimacy before allowing any operations. By checking digital signatures and certification authorities at the kernel level before process execution, the system prevents malicious users from circumventing protection in the first place, rather than responding to attacks after they occur.
2Adaptability or versatility
If administrative users have broad permissions to terminate or alter processes, then system control flexibility is improved, but malicious users can disable anti-malware protection
Solution Approach 1:
The patent applies different permission levels to different processes based on their legitimacy. Verified anti-malware processes receive elevated protection privileges that prevent termination or alteration, while unverified processes maintain standard permissions. This localized differentiation of rights allows system control flexibility for legitimate administrators while protecting anti-malware processes from malicious manipulation.
Solution Approach 2:
The patent segments process permissions into distinct categories: protected processes (verified anti-malware) and unprotected processes (other applications). By segmenting the permission model, the system can grant broad control flexibility to administrators for legitimate processes while restricting such powers against verified anti-malware processes, preventing malicious users from disabling protection.
3Reliability
If process verification based on driver certificates is implemented, then protection against unauthorized process alteration is improved, but system complexity increases
Solution Approach 1:
The patent makes the kernel-level process monitor a universal component that handles multiple functions: verifying digital signatures, checking certification authorities, determining process legitimacy, and controlling access rights. By consolidating these functions into a single multi-functional mechanism, the system achieves high process protection reliability without proportionally increasing complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Anti-malware process protection techniques are described. In one or more implementations, an anti-malware process is launched. The anti-malware process is verified based at least in part on an anti-malware driver that contains certificates which contain an identity that is signed with the trusted certificate from a verified source. After the anti-malware process is verified, the anti-malware process may be assigned a protection level, and an administrative user may be prevented from altering the anti-malware process.