I/O Object Manager for Volume-Level File Quarantine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file quarantine technologies face challenges with high complexity and low security, particularly in determining whether an initiator of an I/O request is a process inside a sandbox at a volume device level, which hinders effective quarantine operations.
Innovation Solution
The implementation utilizes a redirection capability of an I/O object manager and volume virtualization technology to determine if a process is inside a sandbox before the I/O request reaches a volume device, redirecting requests to a virtual volume device if necessary, thereby enabling file quarantine at a volume device level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current file quarantine technology is used to determine whether an initiator of an I/O request is a process inside a sandbox, then file quarantine can be implemented, but the system complexity increases and security effectiveness decreases
Solution Approach 1:
The patent introduces an I/O object manager as an intermediary component between processes and volume devices. This manager intercepts I/O requests, determines whether the initiating process is inside a sandbox, and redirects requests from sandboxed processes to a virtual volume device. This intermediary approach simplifies the quarantine mechanism compared to complex file filter driver chains while maintaining security effectiveness.
Solution Approach 2:
The patent segments the volume device functionality by introducing a virtual volume device specifically for sandboxed processes. This segmentation allows the system to handle I/O requests from sandboxed and non-sandboxed processes through different paths, simplifying the quarantine logic compared to trying to manage all quarantine decisions through a single complex filtering layer.
2Reliability
If file quarantine is implemented at the volume device level by determining sandbox status of request initiators, then security is enhanced, but the complexity of tracking and determining process sandbox status increases
Solution Approach 1:
The I/O object manager performs multiple functions: it manages normal I/O requests, determines sandbox status of processes, redirects requests to appropriate volume devices, and handles both sandboxed and non-sandboxed processes through a single unified component. This multi-functionality eliminates the need for separate complex quarantine determination mechanisms for each process.
Solution Approach 2:
The system automatically determines the sandbox status of process initiators and performs redirection without requiring manual intervention or complex external quarantine management. The I/O object manager self-services the quarantine function by integrating the determination and redirection logic within itself, simplifying the overall quarantine process.
Data Source
AI summary
The present disclosure provides a file quarantine method, apparatus, and system. The method includes: receiving by an input/output (I/O) object manager, a change operation request from a first process for a volume device in a file system; and if it is determined that the first process is a process inside a sandbox, redirecting the change operation request to a virtual volume device corresponding to the volume device which is pointed to by the change operation request, and sending the redirected change operation request to the I/O object manager. The foregoing solution may implement file quarantine at a volume device level.