Kernel Hook for File Property-Based Integrity Measurement

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing integrity measurement architectures in computer platforms face challenges in effectively measuring and verifying the integrity of specific non-executable files, due to constraints that prevent targeted rules for these files, leading to either unnecessary measurements or missed critical files.

Innovation Solution

An extended integrity measurement architecture that allows rules to cover specific non-executable files through a policy with file property-based and context-based selection criteria, enabling targeted integrity measurements and appraisals for these files.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing integrity measurement architectures are used to measure all files, then comprehensive security coverage is achieved, but measurement overhead and processing time increase significantly

Engineering Contradiction:

Improvesecurity coverageVSAvoidmeasurement overhead

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies local quality by differentiating measurement strategies based on file characteristics. Executable files receive full integrity measurement while non-executable files use selective measurement based on specific criteria (filename patterns, file paths, file types). This resolves the contradiction by providing comprehensive security for critical files while reducing overhead for less critical files.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent segments the file system into different categories (executable vs. non-executable files) and applies different measurement policies to each segment. This segmentation allows the system to focus measurement resources on high-risk files while minimizing overhead on low-risk files, thereby resolving the time vs. coverage contradiction.

Inventive Principle:

Principle #1Segmentation

2Productivity

If targeted rules are applied to measure only specific non-executable files, then measurement efficiency improves, but security coverage may be insufficient

Engineering Contradiction:

Improvemeasurement efficiencyVSAvoidsecurity coverage

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent creates a universal measurement framework that can handle both executable and non-executable files through a single policy mechanism. The framework uses multiple selection criteria (filename patterns, file paths, file types) to universally identify files requiring measurement, ensuring no critical file is missed while maintaining efficiency.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent implements dynamic measurement policies that can be adjusted based on system requirements. The selection criteria and measurement rules can be modified without changing the underlying architecture, allowing the system to adapt to new threat landscapes while maintaining efficient operation.

Inventive Principle:

Principle #15Dynamics

3Measurement precision

If comprehensive integrity measurement is performed on all files, then complete verification is achieved, but system performance and processing speed decrease

Engineering Contradiction:

Improveverification completenessVSAvoidprocessing speed

Core Design Contradiction:

Measurement precisionVSSpeed

Solution Approach 1:

The patent applies different verification depths based on file characteristics. Critical executable files receive complete integrity verification while non-executable files receive selective verification based on predefined criteria. This local differentiation maintains measurement precision for critical files while improving overall processing speed.

Inventive Principle:

Principle #3Local quality

4Loss of energy

If selective measurement policies are implemented for non-executable files, then unnecessary measurements are reduced, but policy complexity increases

Engineering Contradiction:

Improveresource wasteVSAvoidpolicy complexity

Core Design Contradiction:

Loss of energyVSDevice complexity

Solution Approach 1:

The patent uses preliminary action by pre-defining selection criteria (filename patterns, file paths, file types) that automatically identify files requiring measurement. This preliminary classification eliminates the need for complex runtime decisions, reducing both resource waste and perceived policy complexity.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250039142A1Measuring files based on file property-based selection criteria

Publication Date: 2025.01.30 HEWLETT PACKARD ENTERPRISE DEV LP

AI summary

A technique includes registering, with a core of an operating system kernel, a hook that corresponds to a file event and associates the file event with an event-driven module of the operating system kernel. The core is associated with an integrity measurement architecture policy. The technique includes, responsive to an occurrence of the file event, triggering execution of the event-driven module to extend a scope of the integrity measurement architecture policy. Executing the module includes the operating system kernel determining a property of a file that is associated with the file event; and filtering a set of rules of an extended integrity measurement policy based on the property. The filtering includes identifying a given rule of the set of rules having a condition that is contingent on the file event being associated with the property. Executing the module includes the operating system kernel identifying an integrity measurement-affiliated action of the given rule and performing the integrity measurement-affiliated action on the file.