File System Execution Control via Kernel Space Configuration

Solution Overview

Problem

Current antivirus software and unified threat management systems are limited in preventing sophisticated attacks like phishing and social engineering, and they cannot entirely prevent malicious code from running, providing a false sense of security for inexperienced users.

Innovation Solution

An operating system that limits file execution based on configuration information stored in the file system, with a portion accessible from user space and another portion only accessible via kernel space, processes execution requests by loading data structures and taking actions based on parameters, automatically revoking execution permissions if a file is modified.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If antivirus software is used to detect and remove malicious software, then malware detection capability is improved, but the system cannot prevent sophisticated attacks like phishing and social engineering, and provides a false sense of security to inexperienced users

Engineering Contradiction:

Improvemalware detection capabilityVSAvoidsophisticated attacks effectiveness

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by embedding execution configuration information in file system data structures before program execution. The operating system checks this configuration information prior to allowing program execution, preventing malicious code from running in the first place rather than detecting and removing it after the fact.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary mechanism - the execution configuration information stored in file system data structures - that mediates between the file system and program execution. This intermediary layer provides additional security verification beyond traditional antivirus software by controlling whether programs are allowed to execute based on embedded configuration data.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If UTM or UTS systems are used to perform security functions, then prevention of rogue user accounts engaging in malicious activity is improved, but malicious code can still run entirely as the systems only limit entrance of malicious software

Engineering Contradiction:

Improveprevention of rogue user accountsVSAvoidmalicious code execution

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by embedding execution configuration information in file system data structures before program execution. The operating system checks this configuration information prior to allowing program execution, preventing malicious code from running in the first place rather than detecting and removing it after the fact.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary mechanism - the execution configuration information stored in file system data structures - that mediates between the file system and program execution. This intermediary layer provides additional security verification beyond traditional antivirus software by controlling whether programs are allowed to execute based on embedded configuration data.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If the operating system loads data structures from the file system and processes execution requests based on parameters, then execution control security is improved, but system complexity increases due to additional security checks

Engineering Contradiction:

Improveexecution control securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the security verification function with the existing file system data structures. By embedding execution configuration information within the file system metadata, the system combines file management and execution control security into a unified structure, avoiding the need for separate complex security verification systems.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The file system data structures self-serve the security function by containing embedded execution configuration information. The operating system simply reads and processes this information during normal file operations, allowing the file system itself to provide security verification without requiring additional dedicated security hardware or complex external verification systems.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10606813B2Systems and methods for securely managing program execution

Publication Date: 2020.03.31 GRAVITY FALLS LLC

AI summary

Disclosed are various embodiments securing the execution of unauthorized applications on a computing device. A file system stored in a storage device includes files and file system data structures. The file system data structures have kernel space accessible portions. When a file is executed, a computing device can determine whether the file can be executed based on a file system data structure corresponding to the file based on the kernel space accessible portion. The operating system can determine whether to execute the file or take another action based on flags stored in the kernel space accessible portion.