Archive Decompression Screening for Malicious and Oversized Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
During cloud integration, compressed files uploaded to a cloud-based application server may contain unwanted or malicious files, and upon decompression, large files can consume significant disk space, leading to potential security issues and denial of service.
Innovation Solution
A decompression module is implemented, comprising a file extension module, a file type detector module, and a file size checker module, which verifies the file types and sizes against predefined parameters before allowing files to be stored, ensuring only expected and valid files are processed and stored.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If compressed files are uploaded and decompressed at the application server, then file contents can be accessed, but unwanted or malicious files may be executed causing security issues
Solution Approach 1:
The patent applies preliminary action by verifying file contents through multiple modules (file extension module, file type detector module, file size checker module) before decompression and storage. This pre-verification prevents malicious files from being processed, eliminating the security vulnerability that would exist if verification occurred after decompression.
Solution Approach 2:
The patent introduces an intermediary verification system between file upload and decompression. The decompression module with its multiple verification modules acts as an intermediary that filters and validates files before they reach the decompression process, preventing harmful files from executing while allowing legitimate files to proceed.
2Reliability
If large compressed files are decompressed and stored, then complete file contents are available, but significant disk space is consumed potentially leading to denial of service
Solution Approach 1:
The patent applies preliminary action by checking file sizes before decompression through the file size checker module. This pre-check prevents large files from being decompressed and stored, avoiding disk space exhaustion that could lead to denial of service, while still allowing the system to function normally for appropriately sized files.
Solution Approach 2:
The patent applies preliminary anti-action by proactively preventing the decomposition of large files before they can consume excessive disk space. The verification modules detect and reject files that would exceed safe size thresholds, counteracting the potential harmful effect of disk space exhaustion before it can occur.
3Ease of operation
If all files in a compressed archive are decompressed, then complete content is accessible, but files with wrong extensions or types may be processed causing security vulnerabilities
Solution Approach 1:
The patent applies local quality by performing different verification checks on different aspects of each file individually. The file extension module checks extensions, the file type detector module checks actual file types, and the file size checker module checks sizes. This granular, localized verification ensures that each file is validated according to its specific characteristics before processing, preventing files with wrong extensions or types from being executed while maintaining accessibility for legitimate files.
Solution Approach 2:
The patent applies preliminary action by verifying file extensions and types before decompression. The file extension module and file type detector module validate each file's identity before it is decompressed, ensuring that only files with correct extensions and types are processed, thereby preventing security vulnerabilities from files with mismatched extensions.
Data Source
AI summary
A method and system including receiving a main input stream for a compressed file at an application server, wherein the main input stream includes two or more file streams; extracting a file-type extension from each file stream input stream; determining the file-type extension is supported; determining, for each file stream with the supported file-type extension, a signature for the file stream with the supported file-type extension is valid; determining, for each valid file stream, a size of the file is less than a threshold level; and storing the valid file stream on a storage device when the size of the file is less than the threshold level. Numerous other aspects are provided.