Dynamic Whitelist Security System for File Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT security technologies are expensive to maintain and fail to provide effective protection against new or unknown threats, as they rely on outdated blacklists and behavioral patterns, leading to high false-alarm and missed-detection rates, and are inflexible in managing file content access in large networks.
Innovation Solution
A security system that employs agent software on each host to analyze file system activity, using centralized policy management to implement dynamic approval states (Approved, Banned, Pending, and Locally Approved) and content tracking, allowing real-time detection and control of new files, and utilizing a central server for meta-information queries and timed analysis to enhance visibility and protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklist-based pattern scanning is used to detect known threats, then detection capability for known viruses and worms is improved, but the system becomes ineffective against new or unknown threats and requires perpetual updates
Solution Approach 1:
The patent inverts the traditional blacklist approach by implementing a whitelist system. Instead of maintaining a list of known bad patterns and blocking them, the system maintains a list of known good programs and allows only those to execute. This inversion fundamentally changes the detection paradigm from reactive (blocking known threats) to proactive (allowing only verified safe programs), thereby solving the contradiction between detecting known threats and protecting against new threats.
Solution Approach 2:
The system performs preliminary actions by pre-approving and whitelisting programs before they are executed. The whitelist is populated in advance with verified safe programs, and the system proactively checks each executable against this pre-established list. This preliminary approval mechanism ensures that only pre-validated programs can run, providing protection against new threats without requiring constant updates to detection patterns.
2Adaptability or versatility
If behavioral patterns are used for detection, then some unknown threats can be identified, but false-alarm rates become unacceptably high
Solution Approach 1:
The patent inverts the behavioral analysis approach by instead of analyzing what programs do to detect malicious behavior, it analyzes what programs are allowed to run based on their identity in the whitelist. This inversion eliminates false alarms because the decision to allow execution is based on positive identification of approved programs rather than interpreting potentially ambiguous behavioral patterns.
3Reliability
If whitelist systems are implemented to limit execution to known good programs, then protection against malicious software is improved, but flexibility in running custom enterprise programs is lost
Solution Approach 1:
The patent implements a dynamic whitelist system that can adapt to enterprise needs. The whitelist is not static but can be updated, modified, and customized based on organizational requirements. This dynamic approach allows the system to maintain high security while accommodating custom enterprise programs by adding them to the whitelist through proper authorization channels, thus resolving the contradiction between protection level and operational flexibility.
4Stability of the object's composition
If centralized whitelist management is used, then security policy consistency across the network is improved, but response time for approving new legitimate programs is delayed
Solution Approach 1:
The patent segments the whitelist management system into hierarchical levels with different authorization capabilities. Local administrators can approve programs for their specific departments or teams without requiring central approval for every program. This segmentation allows policy consistency to be maintained at the appropriate level while dramatically reducing approval delays for local needs, resolving the contradiction between centralized control and rapid response.
Data Source
AI summary
A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and unwanted software. The system can implement centralized policies that allow an administrator to approve, block, quarantine, and log file activities. The system can extract content of interest from a file container, repackage the content of interest as another valid file type, perform hashes on the content of interest, associate the hash of the container with the hash of the repackaged content, transfer the repackaged content, and store the hash with other security-related information.