File Processing Restriction via Blacklist Inversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing apparatuses lack an efficient mechanism to restrict processing of unexpected computer programs, which can lead to unintended behavior or damage, and existing solutions like whitelist techniques require significant processing overhead.
Innovation Solution
An information processing apparatus that detects file writing and registers file information in a restriction target storage, restricting processing on files that match registered information, thereby preventing the execution of unexpected computer programs without the need for whitelist creation or signature verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If whitelist techniques are used to detect and stop unexpected computer programs, then security reliability is improved, but processing overhead and system complexity increase significantly
Solution Approach 1:
Instead of maintaining a whitelist of permitted programs and checking against it (traditional approach), the patent inverts the logic by maintaining a blacklist of recently written files and restricting only those. This inversion dramatically reduces processing overhead since the system only needs to check against a small set of recently modified files rather than verifying every executed program against a comprehensive whitelist.
Solution Approach 2:
The patent performs preliminary action by detecting and registering file writing operations as they occur, proactively preparing the restriction data before any execution attempt. By pre-registering recently written files in the restriction target storage, the system eliminates the need for complex runtime analysis or whitelist verification, reducing processing overhead during program execution.
2Reliability
If comprehensive file verification mechanisms are implemented to prevent unexpected program execution, then security reliability is improved, but processing speed decreases
Solution Approach 1:
The patent extracts only the essential security function needed to prevent unexpected program execution - specifically, tracking recently written files - and isolates it from the main execution flow. By extracting this specific function and implementing it as a separate, lightweight mechanism using file information storage and comparison, the system maintains security reliability while minimizing impact on overall processing speed.
3Device complexity
If simple restriction mechanisms are used to block unexpected programs, then processing overhead is reduced, but security reliability may be compromised
Solution Approach 1:
The patent introduces an intermediary mechanism - the restriction target storage that stores file information of recently written files - which mediates between the simple restriction check and the security requirement. This intermediary component enables the system to maintain simple, low-overhead processing while still achieving reliable security by providing a structured way to track and verify file identities without complex analysis.
Data Source
AI summary
According to an embodiment, an information processing apparatus includes processing circuitry. The processing circuitry is configured to detect writing on a first file and register, in a restriction target storage, file information on the first file and perform, when processing on a second file is requested and file information on the second file coincides with the file information stored in the restriction target storage, first restriction to restrict the processing on the second file.