JIT Compiled Endpoint Protection Rules in Kernel Mode
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint protection strategies in kernel mode face challenges such as increased complexity, system instability, and difficulty in writing secure and error-free code due to the use of low-level languages like C and the lack of effective unit testing frameworks.
Innovation Solution
Implementing a just-in-time (JIT) compilation-based blocking strategy that compiles complex protection rules into a single expression tree in user mode, which is then validated and assembled into machine code in kernel mode, allowing for safe and efficient endpoint protection without slowing down the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex detection/protection logic is implemented within kernel mode, then endpoint protection effectiveness is improved, but device complexity and system load increase
Solution Approach 1:
The patent segments the endpoint protection system into two distinct parts: a kernel mode component that provides fast blocking capability and a user mode component that contains the complex detection logic. The kernel mode driver handles only critical blocking operations, while the user mode service performs complex rule evaluation and analysis, thereby reducing kernel mode complexity while maintaining protection effectiveness.
Solution Approach 2:
The patent introduces a message passing interface as an intermediary between kernel mode and user mode components. This mediator enables the kernel mode driver to offload complex detection tasks to the user mode service while maintaining fast blocking capability, effectively resolving the contradiction between protection effectiveness and kernel complexity.
2Reliability
If complex detection/protection logic is implemented within kernel mode, then endpoint protection effectiveness is improved, but system stability deteriorates
Solution Approach 1:
By segmenting the protection logic into kernel mode (blocking) and user mode (detection), the patent isolates complex and potentially buggy detection code from the critical kernel mode environment. This segmentation protects operating system stability while maintaining protection effectiveness, as user mode code cannot crash the kernel even if it contains bugs.
Solution Approach 2:
The message passing interface acts as a stable intermediary that allows the kernel mode driver to communicate with the user mode service without direct coupling. This mediator ensures that instability in the user mode detection logic does not propagate to the kernel mode component, thereby maintaining overall system stability.
3Ease of manufacture
If complex operations are performed in user mode, then ease of programming and testing is improved, but processing speed deteriorates
Solution Approach 1:
The patent segments operations by type rather than by complexity: fast blocking operations remain in kernel mode for speed, while complex detection operations are performed in user mode where higher-level languages and testing frameworks can be used. This segmentation allows each component to operate in its optimal environment.
Solution Approach 2:
The kernel mode driver performs preliminary blocking actions immediately when threats are detected, preventing malicious operations before they can execute. This preliminary action in kernel mode ensures speed-critical operations are fast, while allowing more complex analysis to occur subsequently in user mode.
4Reliability
If protection rules are evaluated in user mode, then programming safety is improved, but processing speed deteriorates
Solution Approach 1:
The patent segments the rule processing pipeline into two stages: fast rule matching in kernel mode for speed-critical path, and comprehensive rule evaluation in user mode for safety. This segmentation allows the system to maintain high-speed blocking while performing thorough, safe rule evaluation in the user mode environment with better tooling support.
Data Source
AI summary
An endpoint protection system implementing a new blocking strategy allows a user to specify an arbitrary number of protection rules through a user interface. In user mode, the protection rules are compiled into a single expression tree, which is then compiled into byte code. In kernel mode, the byte code is dynamically loaded in memory (e.g., kernel space) and the assembler validates the byte code and performs a plurality of security checks, then ultimately assembles the byte code into machine code that is native to the processor. Because complex detection/protection logic is compiled in user mode, the invention allows for highly expressive and powerful protection rules. Further, because complex detection/protection logic is not manually written in kernel mode, but validated then evaluated via simple machine code instructions in the privileged mode, the invention is safer and will not slow down the entire operating system.