Kernel Driver I/O Interception for Disk Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data centers face security threats from malicious code that can modify the master boot record or target customer data, allowing unauthorized access and data manipulation, which existing security measures fail to adequately prevent.
Innovation Solution
A server kernel processing system intercepts I/O requests to identify if they target the master boot record or protected volumes, blocking unauthorized modifications and using a whitelist mechanism to authorize access to protected data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are used, then basic data protection is provided, but malicious code can still modify the master boot record or target customer data
Solution Approach 1:
The system performs preliminary actions by intercepting I/O requests before they can execute modifications. The kernel-mode driver captures requests targeting the master boot record or customer data volumes before the malicious code can complete its harmful operation, preventing the modification from occurring in the first place
Solution Approach 2:
A kernel-mode driver acts as an intermediary between user-mode applications and the protected system resources. This intermediary layer analyzes I/O requests, determines their legitimacy, and either allows or blocks them, providing a security buffer that prevents malicious code from directly accessing critical areas
2Reliability
If all I/O requests are blocked for security, then data protection is improved, but legitimate access to protected volumes is prevented
Solution Approach 1:
The system applies different security qualities to different I/O requests based on their characteristics. Legitimate requests from authorized processes are allowed to proceed with normal access to protected volumes, while suspicious or unauthorized requests are blocked. This localized differentiation of security treatment maintains both protection and operational ease
3Reliability
If a whitelist mechanism is implemented, then unauthorized access is prevented, but system complexity increases
Solution Approach 1:
The whitelist mechanism operates autonomously within the kernel-mode driver, automatically analyzing I/O requests against the whitelist criteria without requiring external intervention for each decision. The system self-manages the security enforcement, reducing the operational complexity despite the enhanced security functionality
Data Source
AI summary
A server kernel processing system receives an input/output (I/O) request from a user mode computing environment. The I/O request is analyzed to determine whether it is a modification request to modify data in a target volume. If so, target analysis logic determines whether the request is for a target volume that is within a first or second protected volume. If the request is to modify data stored in the first protected volume, the request is blocked. If the request is to modify data in a second protected volume, then a whitelist is examined to determine whether the requesting process and user are on the whitelist. If not, the request is also blocked.