File System Access Policies Using Process Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file system access policies are vulnerable to sophisticated ransomware attacks that replace trusted applications with malicious versions, and automatic configuration methods risk granting unrestricted access to applications that may have been compromised.
Innovation Solution
Implement a file system filter driver that uses process fingerprints, calculated as hashes of executable code, to enforce access policies strictly tied to the application's code state, with a user-mode policy configuration service to learn and update policies dynamically, ensuring only legitimate access is allowed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control policies are configured to allow only certain applications to access files, then file system protection against ransomware is improved, but the system becomes vulnerable to sophisticated attacks that replace trusted applications with malicious versions
Solution Approach 1:
The system performs preliminary fingerprinting of executable code before allowing file system access. By calculating and storing fingerprints of the original trusted application code, the system can detect and block malicious versions before they gain access to the file system, preventing circumvention attacks.
Solution Approach 2:
The patent replaces traditional mechanical access control mechanisms with a cryptographic fingerprinting system. Instead of relying on simple application name-based access control, the system uses hash-based fingerprint matching to verify the integrity and identity of executable code, making it impossible for malicious versions to bypass security policies.
2Ease of operation
If automatic configuration of access policies is used, then ease of policy setup is improved, but the risk increases that applications may gain unrestricted access to the file system
Solution Approach 1:
The system performs self-service fingerprinting automatically when an application is executed. The fingerprinting process occurs autonomously without manual intervention, and the system self-adjusts by updating its fingerprint database as applications are installed or updated, maintaining security while requiring no manual policy configuration.
Solution Approach 2:
The system continuously monitors and updates the fingerprints of executed applications, creating a feedback loop where the fingerprint database is dynamically maintained. This feedback mechanism ensures that the access control policies always reflect the current state of trusted applications, preventing both over-permissioning and security breaches.
3Adaptability or versatility
If frequent automatic or semi-automatic updating of access policies is performed, then adaptability to application updates is improved, but the risk increases that application access may not be controlled at all
Solution Approach 1:
The system performs fingerprinting as a preliminary action before allowing any file system access. By establishing the fingerprint baseline before the application executes, the system ensures that even when applications are updated, the fingerprint verification process maintains strict access control, preventing the scenario where frequent updates lead to loss of access enforcement.
Data Source
AI summary
A method of protecting access to files on a computer file system is disclosed. A kernel-mode file system filter driver controls access to stored policies. Some access policies will cause the file system filter driver to send a request to a user-mode policy configuration service. The user-mode policy configuration service includes features allowing safe autoconfiguration of policies for new applications, and safe reconfiguration of policies for updated applications.