Application Restrictor Selective Privileged Loading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware solutions fail to detect zero-day vulnerabilities and often resort to all-or-nothing blocking techniques, which prevent trusted applications from accessing necessary resources like printing or system settings, increasing system vulnerability.
Innovation Solution
An application restrictor system that selectively blocks the loading of privileged applications by maintaining lists of trusted and privileged applications, allowing loading only when all applications in the parent process tree are trusted, thereby preventing untrusted applications from accessing privileged functions without blocking trusted ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all but a limited set of trusted applications are blocked to protect against zero-day vulnerabilities, then system security is improved, but trusted applications are prevented from accessing necessary resources like printing or system settings
Solution Approach 1:
The patent applies local quality by differentiating between privileged applications and non-privileged applications in the blocking mechanism. Instead of uniformly blocking all untrusted applications, the system selectively blocks only privileged applications (those with special permissions) when loaded by untrusted applications. This localized approach maintains security for critical resources while allowing trusted applications full access to necessary functions like printing and system settings.
Solution Approach 2:
The patent segments the application blocking mechanism into two distinct categories: privileged applications and non-privileged applications. By dividing the blocking rule into these segments, the system can apply different blocking behaviors - blocking privileged applications from untrusted parents while allowing non-privileged applications. This segmentation resolves the contradiction by enabling fine-grained control over application access.
2Ease of operation
If Adobe Reader and regedit are made trusted applications to allow access to printing and system settings, then application functionality is improved, but system vulnerability increases
Solution Approach 1:
The patent applies local quality by assigning different trust levels and permission scopes to different applications. Instead of making all applications fully trusted or fully blocked, the system allows privileged applications (like Adobe Reader and regedit) to be blocked only when invoked by untrusted applications. This localized permission control enables these applications to function when needed by trusted applications while preventing exploitation by untrusted applications.
Solution Approach 2:
The patent introduces dynamic blocking behavior where the permission to load a privileged application is not fixed but depends on the parent application's trust status. The blocking decision is made dynamically at runtime based on the parent-child relationship between applications. This dynamic approach allows privileged applications to be accessible when needed while maintaining security against untrusted applications.
Data Source
AI summary
The loading of a privileged application can be selectively blocked. An application restrictor can be configured to register for notifications whenever an application image is loaded. Then, whenever the application restrictor receives a notification, the application restrictor can evaluate whether the application image that is being loaded is a privileged application. If so, the application restrictor can evaluate the current process's parent tree to determine if an untrusted application is present at any level of the parent tree. The application restrictor will then allow the privileged application to load only when all applications in the parent tree are trusted applications. In this way, untrusted applications can be blocked from accessing a privileged application without blocking trusted applications from accessing the privileged application.