Kernel Mode Code Injection Checking Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are ineffective in preventing malicious code injection at the kernel level of an operating system, allowing malware to compromise security and inject code into innocent processes, which can evade detection by user mode hooking techniques.
Innovation Solution
A method that hooks the kernel mode OS system call, directs requests to a checking module, and queries a process database to allow or deny requests based on legitimacy, effectively blocking unauthorized code injection by implementing a code injection checking module as a kernel driver.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user mode hooking techniques are used to detect code injection, then detection capability is provided, but malware can easily subvert security operations through hooking techniques
Solution Approach 1:
The patent inverts the traditional approach by having the kernel mode driver perform security checks on system calls rather than relying on user mode hooks. The kernel mode checking module validates process identities and detects code injection attempts at the kernel level, making security operations independent of user mode hooking techniques that malware can subvert.
Solution Approach 2:
The patent introduces a kernel mode checking module as an intermediary between system calls and the operating system kernel. This intermediary validates system calls, checks process identities, and detects code injection attempts before executing sensitive operations, providing a secure layer that cannot be easily subverted by user mode malware.
2Difficulty of detecting and measuring
If code injection detection is implemented in user mode, then detection functionality is provided, but it is easily defeated by malware through user mode hooking
Solution Approach 1:
The patent inverts the detection architecture by implementing code injection detection in kernel mode rather than user mode. The kernel mode checking module intercepts and validates system calls at the kernel level, making detection reliable and independent of user mode hooking techniques that malware can exploit.
Solution Approach 2:
The patent transitions the detection mechanism from user mode to kernel mode, effectively moving to a different operational dimension. This dimensional change allows the system to detect code injection attempts at a lower level where malware cannot easily interfere, providing robust and reliable detection capability.
3Ease of operation
If malicious code is allowed to run in process address space, then process identity-based security is maintained, but injected malicious code activity compromises operating system security
Solution Approach 1:
The patent implements preliminary validation of process identities and system call parameters before executing sensitive operations. The kernel mode checking module verifies process identities and detects code injection attempts before the malicious code can compromise the operating system, preventing harmful actions rather than responding to them afterward.
Solution Approach 2:
The patent implements feedback mechanisms where the kernel mode checking module continuously monitors system calls and process activities. When code injection is detected or suspicious activity is identified, the system can terminate the compromised process or block further malicious operations, providing real-time protection while maintaining process identity-based security.
Data Source
AI summary
A method, computer program product and system for preventing code injection in an operating system. The method 300 includes a checking module 340 hooking a kernel mode OS system call 330 and a request 315 sent to the kernel mode OS system call 330 being directed to the checking module 340. The checking module 340 queries 345 a process database 350 and the checking module 340 then allows or denies the request 315 based on a response from the process database 350.