File Security Management via Isolated Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional file security management systems are inefficient in monitoring and preventing malicious code, as they rely on pattern matching and random file selection, which can lead to missed threats and high resource utilization, and fail to prevent execution of infected files before inspection.
Innovation Solution
A file security management apparatus and method that converts incoming files into monitoring target files, decrypts them in an isolated environment, and executes them through a dedicated application, allowing for real-time monitoring and containment of malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security apparatus randomly selects and compares stored files with patterns in DB, then the system can operate with simple monitoring logic, but the degree of security is low and resource utilization is high
Solution Approach 1:
The patent converts incoming files into monitoring target files before execution, preparing them in advance for security inspection. This preliminary conversion enables the security apparatus to focus monitoring resources on converted files rather than randomly scanning all stored files, thereby improving security detection effectiveness while optimizing resource utilization.
2Reliability
If conventional security apparatus inspects all files at regular intervals, then the monitoring coverage is comprehensive, but the system requires high-level specifications and the inspection frequency increases system load
Solution Approach 1:
The patent extracts and isolates converted files into a separate monitoring target group, distinguishing them from regular stored files. This extraction allows the security apparatus to apply specialized monitoring procedures only to converted files, reducing the need for high-level system specifications while maintaining comprehensive monitoring coverage for potentially malicious files.
Solution Approach 2:
The patent segments the file monitoring process into two distinct paths: regular file storage and converted file monitoring. By segmenting the monitoring scope, the system can allocate resources more efficiently, focusing intensive monitoring only on converted files that pose potential security risks, thereby reducing overall system complexity and load.
3Reliability
If inspection is performed after file enters system, then the file can be processed normally, but execution may have been completed before inspection and malicious code has already caused damage
Solution Approach 1:
The patent performs file conversion into monitoring target files as a preliminary action before the files are executed. This conversion process prepares the files for immediate security inspection, ensuring that security checks are already in place before execution begins, thereby preventing malicious code from causing damage before detection.
Solution Approach 2:
The patent introduces a conversion module as an intermediary between file reception and execution. This intermediary converts incoming files into a monitored format, creating a buffer zone that allows security inspection to occur seamlessly before execution, thus bridging the gap between file arrival and security verification without delaying normal processing.
4Ease of operation
If conventional security apparatus monitors files at specific locations, then the monitoring scope is limited and easy to manage, but malicious code that is not activated or does not exhibit malicious behavior at specific time cannot be detected
Solution Approach 1:
The patent makes the conversion module universal by applying it to all incoming files regardless of their source or intended location. This universal conversion ensures that all files are prepared for monitoring in the same way, enabling the security apparatus to detect potential threats uniformly across the system without being limited to specific locations or file types, while maintaining ease of management through a standardized process.
Data Source
AI summary
A file security management apparatus and method which protect various types of systems for executing files, entering from the outside, from malicious code, and which prevent data from being divulged from the systems and also prevent the systems from operating erroneously, thereby ultimately protecting the systems. The file security management apparatus includes a conversion module configured to convert an incoming file, received by a system, into a monitoring target file; a search module configured to identify a selection for the execution of the monitoring target file, and to output incoming files, configured in the monitoring target file, into a search window; and a security module configured to decrypt the monitoring target file to the incoming file, and to perform processing so that the incoming file is executed via a corresponding application program in an isolated drive set as an isolated environment.