Anti-Malware Component Notification via Kernel Security Agent
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for providing user notifications about security actions consume high system resources and pose security and privacy concerns due to the creation of user-mode processes with high privileges, making systems vulnerable to exploitation and misattribution of file access events.
Innovation Solution
Implementing a Component Object Model (COM) interface by an anti-malware component in user mode, assisted by a kernel mode security agent to obtain user tokens and provide notifications without creating user-mode processes, thereby executing with low privileges and reducing resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user-mode processes are created to provide security notifications, then notification delivery is achieved, but system resource consumption increases significantly
Solution Approach 1:
The patent merges the notification delivery function into the existing anti-malware component process, eliminating the need for separate user-mode notification processes. The anti-malware component directly interacts with the GUI subsystem through COM interfaces to display notifications, consolidating multiple functions into a single process and reducing overall system resource consumption.
Solution Approach 2:
The anti-malware component is designed to perform multiple functions: malware detection, security actions, and user notification delivery. By making the anti-malware component universal and capable of handling notification delivery itself, the system eliminates the need for dedicated notification processes, thereby reducing the number of concurrent processes and system resource usage.
2Reliability
If high-privileged user-mode processes are created for security notifications, then notification capability is enhanced, but system security vulnerability increases
Solution Approach 1:
The patent applies local quality by assigning different privilege levels to different components: the anti-malware component runs with low privileges in user mode, while the security agent runs with high privileges in kernel mode. This localized privilege assignment ensures that even if the anti-malware component is compromised, the attacker gains limited access, thereby reducing system security vulnerability while maintaining notification capability.
Solution Approach 2:
The security agent acts as an intermediary between the anti-malware component and the kernel mode system. It mediates privilege escalation and provides necessary system resources to the anti-malware component without requiring the anti-malware component to run with high privileges directly, thus reducing security vulnerability while enabling notification delivery.
3Reliability
If user account impersonation is used for notification processes, then notification delivery is enabled, but privacy concerns arise
Solution Approach 1:
The patent extracts the user token information from the security agent and provides it to the anti-malware component as a parameter, rather than having the anti-malware component impersonate the user account. This extraction approach allows the anti-malware component to deliver notifications in the user's context without actually impersonating the user, thereby eliminating privacy concerns while maintaining notification delivery capability.
4Reliability
If multiple user-mode processes are created for concurrent user sessions, then notification coverage is improved, but device performance deteriorates
Solution Approach 1:
The patent merges the notification delivery function into the existing anti-malware component process, allowing a single process to serve multiple user sessions. The anti-malware component receives notifications from the security agent and uses COM interfaces to deliver them to the appropriate user sessions, eliminating the need to create separate processes for each session and thereby maintaining device performance while improving notification coverage.
Data Source
AI summary
A security agent executing in kernel mode may receive a request from the anti-malware component executing with low privileges in user mode, and, in response, the security agent may perform a security action with respect to a malicious file detected on the computing device. The security agent may then assist the anti-malware component in providing a user notification about the security action by obtaining, on behalf of the anti-malware component, a user token associated with the user session in which the malicious file was detected. The anti-malware component can use the obtained user token to request a pointer to a Component Object Model (COM) interface for outputting the notification in context of the appropriate user session, which allows for securely and efficiently providing the user notification.