Anti-Virus Filter Driver Bypassing for Deadlock Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The execution of multiple anti-virus programs on a computer can lead to operating system failures such as deadlocks and freezes due to infinite loops caused by simultaneous scanning activities, which is a common issue as users often have multiple anti-virus programs installed without realizing it.
Innovation Solution
An anti-virus program that bypasses filter drivers in the driver model and directly interacts with the target driver to prevent execution failures, by sending requests directly to the function driver instead of passing them through other filter drivers, thereby avoiding deadlocks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple anti-virus programs are installed to protect against malware, then the security coverage is improved, but operating system stability deteriorates due to deadlocks and freezes
Solution Approach 1:
The patent introduces a flag mechanism as an intermediary to mediate between multiple anti-virus programs. When one anti-virus program is scanning a file, it sets a flag that other anti-virus programs can detect. This flag acts as a signaling mechanism that prevents simultaneous scanning of the same file, thereby avoiding deadlocks while allowing multiple anti-virus programs to coexist and provide comprehensive security coverage.
Solution Approach 2:
The anti-virus programs monitor their own scanning state through the flag mechanism. When a program detects that the flag is already set (indicating another program is scanning), it voluntarily pauses or skips the scan. This self-regulating behavior allows the system to automatically prevent deadlocks without external intervention, maintaining both security coverage and system stability.
2Reliability
If anti-virus programs scan files when opened to detect malware, then malware detection capability is improved, but system performance deteriorates due to infinite loops
Solution Approach 1:
The patent applies preliminary anti-action by setting a flag before the scanning process begins. This preemptive measure prevents other anti-virus programs from initiating scans on the same file, thereby avoiding infinite loops before they can occur. The flag is set in advance as a protective measure that preserves malware detection capability while preventing performance degradation from redundant scanning.
3Reliability
If anti-virus programs are updated or new versions are released to address sophisticated malware, then security effectiveness is improved, but device complexity increases due to multiple concurrent programs
Solution Approach 1:
The patent creates a universal scanning mechanism that works across multiple different anti-virus programs through the common flag interface. Each anti-virus program maintains its unique malware detection capabilities and update cycles, but they all interact through the same flag-based coordination system. This multi-functional approach allows diverse security tools to coexist without increasing operational complexity, as they all follow the same coordination protocol.
Data Source
AI summary
An anti-virus program executes simultaneously with another anti-virus program by accessing a function (target) driver in the driver model directly instead of traversing each filter driver in the driver model as is conventionally done. The filter driver component of the anti-virus program avoids deadlock and infinite execution loops by bypassing filter drivers of other executing anti-virus programs and other filter drivers and going straight to the driver that will be performing the specific function, such as opening a file for scanning. This is done by having the filter driver component of the anti-virus program obtain directly the handle of the function driver that will perform the function needed by the anti-virus program and thereby avoiding the filter drivers of other programs, specifically other anti-virus programs, that can prevent completion of the required function.