Data-Driven Security Patching for Viewing Applications

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Computer systems face challenges in quickly responding to security vulnerabilities, as existing solutions require significant time to diagnose, develop, and deploy patches, leaving systems vulnerable during attacks, especially when malicious code exploits various data types within complex formats like electronic documents or web pages.

Innovation Solution

A data-driven system that uses a security data file to selectively disable specific content elements or features within viewing applications, such as web browsers, by associating unique codes with potentially harmful content types, allowing for rapid protection without altering the program code, and enabling updates to the security data file to address newly discovered vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional virus checkers and security patches are used, then system security is improved, but response time to new vulnerabilities is too slow

Engineering Contradiction:

Improvesystem securityVSAvoidresponse time to vulnerability

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system pre-configures viewing applications with security data files containing vulnerability information before attacks occur. When vulnerabilities are discovered, the security data file is updated and the viewing application automatically applies the patch without requiring manual intervention or system restart, enabling preliminary protective action before malicious code can execute

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of modifying the original viewing application code, the system creates a copy of the application memory space and overlays security patches as separate data structures. This allows multiple vulnerability fixes to be applied to the same application instance without rewriting the original code, enabling rapid response to new vulnerabilities

Inventive Principle:

Principle #26Copying

2Adaptability or versatility

If viewing applications process all content types, then functionality and versatility are improved, but vulnerability to malicious code increases

Engineering Contradiction:

Improvecontent processing capabilityVSAvoidsecurity vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The security data file contains specific entries for different content types and vulnerabilities. The viewing application checks each content element against the security data file and applies selective restrictions only to vulnerable content types while maintaining processing capability for safe content types, achieving local security quality without sacrificing overall functionality

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system segments content processing by separating secure content elements from vulnerable ones. The viewing application processes content elements individually, checking each against the security data file, and only restricts processing of vulnerable elements while allowing processing of safe elements, maintaining segmented functionality

Inventive Principle:

Principle #1Segmentation

3Reliability

If security patches modify program code, then vulnerability fixes are effective, but deployment time and complexity increase

Engineering Contradiction:

Improvevulnerability fix effectivenessVSAvoidpatch deployment complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The security data file acts as an intermediary between the vulnerability information and the viewing application. Instead of directly modifying the application code, the security data file serves as a mediator that contains vulnerability definitions and patch instructions, allowing the viewing application to apply fixes by reading and executing instructions from the security data file rather than modifying its own code

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system uses dynamic memory overlays where security patches are loaded into the viewing application's memory space as needed. The patch application area can be dynamically adjusted based on the specific vulnerability being addressed, allowing flexible and adaptive patch deployment without requiring static code modifications

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS9558356B2Data driven system for responding to security vulnerability

Publication Date: 2017.01.31 ADOBE INC

AI summary

A data-driven system for fast response to security vulnerability, in one example embodiment, comprises a request detector, a content type evaluator, and a presentation module. A request detector may be configured to detect a request to display content. A content type evaluator may be configured to determine a type of the requested content. A presentation module may be configured to selectively display the requested content based on the determined type of the requested content. The content type evaluator and the presentation module may utilize a data file that stores information related to potential vulnerabilities associated with a content viewing application. Example data file may be an XML file.