Dual Partition Memory Architecture for Malicious Software Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious software poses a significant threat to computer systems connected to the Internet, as users often unintentionally download harmful programs disguised as useful files, which can capture sensitive information or convert devices into 'zombie' computers for criminal activities, causing damage and inconvenience.
Innovation Solution
A method involving the creation of two partitions in a computer's memory, where one partition is dedicated for secure Internet use with a restricted Internet OS that cannot write or copy files in the secure partition, and a secure memory with a CRC table for authentication, ensuring that only authenticated software can access the Internet, while downloaded files are scanned for malicious content in a separate download memory before being transferred.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single partition is used for both conventional use and Internet access, then the system is simpler to operate, but malicious software can be installed on the entire system
Solution Approach 1:
The computer memory is divided into two separate partitions: a first partition for conventional computer use and a second partition dedicated solely for Internet access. This segmentation isolates malicious software to the second partition, preventing it from affecting the first partition while maintaining system security.
2Reliability
If the Internet OS can write and copy files freely, then software installation is easier, but malicious software can be installed and propagated
Solution Approach 1:
The Internet operating system is configured with pre-established restrictions that prevent it from writing or copying files into the first partition. These preventive measures are built into the system architecture before any Internet activity occurs, blocking malicious software installation pathways before they can be exploited.
3Reliability
If memory allocation is flexible and changeable, then software can be updated easily, but malicious software can alter memory to propagate
Solution Approach 1:
The size of the second partition and the memory allocated to Internet software applications are fixed at system initialization. These memory allocations cannot be changed during runtime, preventing malicious software from altering memory structures to propagate or execute unauthorized code.
4Measurement precision
If CRC checking is performed on all files, then malicious software detection is more accurate, but system performance decreases
Solution Approach 1:
Cyclic redundancy check (CRC) verification is performed selectively on files loaded into the second partition rather than all files in the system. This partial checking approach maintains high detection accuracy for Internet-related files while minimizing the performance impact on overall system operations.
Data Source
Figure 1~2
Figure 3a~3b
Figure 4
AI summary
A computer random access memory is divided into first and second partitions. Each partition has its own operating system (OS). The first partition has a conventional OS and is designated for non-Internet use. The second partition is designated for secure Internet access, and has an OS specific for Internet usage. Software in the second partition cannot write or copy files in the second partition. The size of the second partition is fixed and unchangeable while said second partition is open. Each software application in the second partition is allocated a memory region that cannot be changed, thereby preventing memory overflow attacks. A secure memory is designated for temporary storage of software used in the second partition. Cyclic redundancy check (CRC) values are calculated for all files in the secure memory. To detect unauthorized file changes, CRC values are calculated for all files used in the second partition, and checked against values stored in the secure memory. The second partition can write only to a secure memory using a security arrangement such as password protection or a download memory separate from the first partition to allow files stored in the download memory to be examined by scanning and testing from the first partition prior to being stored elsewhere in the computer.