Dynamic Rule Management for Kernel Filter Drivers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current rule management systems for kernel mode filter drivers in computing systems face inefficiencies due to long startup times and high resource demands when dealing with a large number of processes, as they load all potential rules at startup and search through them during runtime, leading to slow processing.
Innovation Solution
Implementing a method where rules are loaded only on an as-needed basis by configuring a 'managing kernel unit' in the kernel mode and a 'process management unit' in the user mode to provide notifications and select relevant rules dynamically, reducing memory and processing resource usage without compromising security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all rules are loaded at startup for every process, then security coverage is complete, but startup time increases and resource consumption increases
Solution Approach 1:
The patent extracts only the necessary rules from the complete rule set and loads them into the filter driver at startup or on-demand. Instead of loading all rules, the system identifies and loads only those rules relevant to specific processes, thereby reducing startup time and resource consumption while maintaining complete security coverage for the processes that need it.
Solution Approach 2:
The rule set is segmented into process-specific subsets. Each process receives only its relevant rules rather than the complete rule set. This segmentation allows the system to maintain comprehensive security coverage across all processes while reducing the memory and processing burden on individual filter driver instances.
2Reliability
If all rules are loaded at startup for every process, then security coverage is complete, but memory and processing resources are consumed
Solution Approach 1:
The system extracts and loads only the necessary rules into the filter driver's memory rather than loading the complete rule set. This extraction approach reduces memory consumption while maintaining security coverage for the processes that require rule enforcement.
Solution Approach 2:
The rule loading mechanism is made dynamic, allowing rules to be loaded on-demand when processes are created or when specific conditions are met, rather than statically loading all rules at startup. This dynamic approach optimizes resource usage by loading rules only when needed.
3Reliability
If filter drivers search through all stored rules at runtime, then all rules are considered for security decisions, but processing speed decreases
Solution Approach 1:
The patent extracts and pre-filters the rule set to contain only rules relevant to the specific process being evaluated. This extraction eliminates the need to search through irrelevant rules during runtime, thereby maintaining security decision accuracy while significantly improving processing speed.
Solution Approach 2:
The system performs preliminary filtering and organization of rules before runtime processing. Rules are pre-processed and organized in a manner that enables efficient lookup and evaluation during runtime, reducing the computational burden on filter drivers while maintaining comprehensive security evaluation.
Data Source
Figure 1A~1C
Figure 2
Figure 3A
AI summary
A method for providing rules for a plurality of processes from a user mode to a kernel mode of a computer is disclosed. The method includes providing to the kernel mode a policy for at least a first process of the plurality of processes, the policy indicating at least when and/or how notifications are to be provided from the kernel mode to the user mode upon detection in the kernel mode of launching of the first process. The method further includes selecting, from the rules stored in the user mode, rules related to the launching of the first process, in response to receiving from the kernel mode a first notification in accordance with the policy, and providing the selected rules related to the launching of the first process from the user mode to at least one of the one or more filter drivers in the kernel mode.