Consequence Execution Paths for Targeted Security Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus programs fail to address execution of consequences on specific portions of computing devices and systems, and do not restrict communication with secure processing resources while maintaining security.
Innovation Solution
Implementing a device-specific and function-specific consequence mechanism using one-time-programmable (OTP) fuse configurations, hardware security monitors, and firmware-initiated security actions to detect and respond to security threats by disabling or resetting device functions as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus programs detect security threats, then security threats can be identified, but consequences cannot be executed on specific portions of the system and secure processing resources cannot be restricted
Solution Approach 1:
The system segments consequence execution into two distinct paths: a first consequence execution path for non-secure processing resources and a second consequence execution path for secure processing resources. This segmentation allows differentiated security responses - standard antivirus actions for regular processes and restricted, controlled consequences for secure resources - thereby enabling both comprehensive security coverage and adaptable response strategies without compromising secure resource integrity
Solution Approach 2:
The system introduces an intermediary mechanism (the consequence execution module with separate paths) between threat detection and consequence execution. This intermediary evaluates the nature of the threat and the type of resource involved, then routes appropriate consequences through the correct path. This mediator enables flexible, context-aware security responses while maintaining protection of secure processing resources
2Reliability
If secure processing resources are isolated for security, then security is improved, but communication with these resources is restricted
Solution Approach 1:
The system implements dynamic security isolation for secure processing resources. Rather than static complete isolation, the system dynamically controls communication based on security context - allowing necessary interactions through the second consequence execution path while blocking malicious access. This dynamic approach maintains security integrity while enabling legitimate operational communication with secure resources
3Reliability
If device functions are disabled to address security threats, then security is improved, but device functionality is reduced
Solution Approach 1:
The system applies local quality by executing consequences specifically on the affected portion of the system rather than globally disabling all functions. The first consequence execution path enables targeted disablement of specific non-secure resources or processes that are compromised, while leaving other device functions operational. This localized approach maintains security protection while preserving overall device productivity and functionality
Data Source
AI summary
In some examples, a computing device can include a processing resource and hardware logic to cause the processing resource to receive input from a source indicating a security threat to a portion of a system in communication with the computing device, determine a consequence to address the security threat specific to the portion of the system and a function of the portion of the system, communicate the consequence to a secure processing resource, and determine whether to execute the consequence based on a response from the secure processing resource.