Hard Drive Sector Archive Bit for Virus Scan Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virus scanning methods on hard drives are time-consuming, leading to increased vulnerability to infections, as users often delay scans due to the lengthy process, and existing solutions like incremental scans can be bypassed by viruses mimicking the scanning process.
Innovation Solution
A system where each sector on the hard drive maintains a protected archive bit that can only be reset by authenticated processes, ensuring that only altered sectors are scanned, thereby focusing the virus protection software's attention on changed files without allowing viruses to mimic the scanning process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full scan of all files is performed, then virus detection reliability is improved, but scan time increases significantly
Solution Approach 1:
The patent segments the file system into sectors and introduces archive bits at the sector level to track modifications. This segmentation allows the virus scanner to focus only on modified sectors rather than scanning entire files or the entire file system, thereby reducing scan time while maintaining detection reliability through comprehensive tracking of all modified data.
Solution Approach 2:
The system performs preliminary action by setting archive bits whenever sectors are modified, before the virus scanner needs to check for infections. This pre-marking of modified sectors eliminates the need for time-consuming full scans, as the scanner can directly identify and check only the sectors that have changed since the last scan.
2Loss of time
If incremental scanning based on archive bits is used, then scan time is reduced, but viruses can mimic the scanning process to evade detection
Solution Approach 1:
The patent introduces an intermediary authentication mechanism where a secret key stored in read-only memory on the disk controller mediates between the virus scanner and the archive bits. The scanner must authenticate with this secret key to reset archive bits, preventing viruses from mimicking the scanning process and falsely clearing archive bits to evade detection.
Solution Approach 2:
The system applies preliminary anti-action by implementing authentication requirements before archive bits can be reset. This preemptive security measure counteracts potential virus attempts to mimic the scanner and clear archive bits, ensuring that only authenticated scanner operations can modify the scan state.
3Reliability
If authentication mechanisms are added to protect archive bits, then security against virus mimicry is improved, but system complexity increases
Solution Approach 1:
The authentication mechanism serves itself by storing the secret key directly in read-only memory on the disk controller, eliminating the need for external authentication servers or complex credential management systems. The disk controller itself provides the authentication service, reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent merges the authentication functionality with the existing disk controller and archive bit system. Rather than adding a separate authentication subsystem, the secret key authentication is integrated into the disk controller's existing operations, reducing system complexity while providing security against virus mimicry.
Data Source
AI summary
A system and method that marks whenever a sector on a hard drive is altered. A protected archive bit is maintained for each sector on the hard drive in a secured fashion. Authenticated requests are able to reset the protected archive bit. When a file is changed, the hard drive marks the sectors of the program that have been altered. When the virus protection application executes, it retrieves the sectors that have been altered, identifies the files that correspond to such sectors, and scans the identified files. If a virus has attacked the computer and attached itself to one of the files, the file is identified and scanned and the virus is discovered with appropriate eradication actions performed. An authentication scheme is assigned to a hard drive with a secret that is shared between the drive and the virus protection program and stored in a secure location.