Kernel Mode Process Filtering for Firewall Policy Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security methods for computer systems lack the ability to distinguish between operating system processes and user processes, leading to potential security risks as firewall exceptions applied to system processes can inadvertently apply to user processes, resulting in unauthorized access or misuse.
Innovation Solution
Implementing a technique to determine whether a process is executing in kernel mode or user mode and using this information to enforce security policies, allowing for more granular control by filtering communications based on the operating mode of the source or destination process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security methods are used without process mode distinction, then security policies are simpler to implement, but security effectiveness deteriorates due to inability to distinguish between kernel mode and user mode processes
Solution Approach 1:
The patent segments security policies into separate rules for kernel mode processes and user mode processes. The firewall engine maintains distinct filtering criteria and handling mechanisms for each process mode, allowing precise control over which security rules apply to which processes. This segmentation resolves the contradiction by enabling differentiated security effectiveness while maintaining clear, organized policy structure.
Solution Approach 2:
The patent applies local quality by customizing security policy characteristics for different process modes. Kernel mode processes receive one set of security handling (e.g., stricter filtering or different rule application), while user mode processes receive another set. This localized differentiation improves security effectiveness for each process type without requiring complete policy redesign, thus managing complexity.
2Ease of operation
If firewall exceptions are applied broadly to system processes, then ease of operation is improved, but security risks increase due to potential unauthorized access by user processes
Solution Approach 1:
The patent segments firewall exceptions into mode-specific exceptions. Administrators can create exceptions for kernel mode processes without automatically applying them to user mode processes. The firewall engine enforces this segmentation by checking the process mode before applying exceptions, thereby maintaining ease of operation for administrators while preventing unauthorized access by user processes.
Solution Approach 2:
The patent introduces the process mode determination mechanism as an intermediary between the firewall exception application and the actual traffic filtering. This intermediary layer checks whether a process is in kernel or user mode before applying the corresponding firewall exception, thereby mediating between administrative ease and security requirements to prevent unauthorized access.
3Measurement precision
If process mode determination is implemented, then security precision is improved, but system complexity increases due to additional determination and notification mechanisms
Solution Approach 1:
The patent implements self-service by having the operating system's existing process management mechanisms provide process mode information without requiring external monitoring tools. The kernel itself maintains process mode state, and the firewall engine queries this existing system information directly, eliminating the need for separate complex determination infrastructure while achieving precise process mode identification.
Solution Approach 2:
The patent uses feedback mechanisms where the firewall engine receives process mode information from the operating system and adjusts its filtering decisions accordingly. This feedback loop allows the system to maintain high security precision by continuously relying on accurate process mode determination while keeping the architecture relatively simple through integration with existing OS mechanisms.
Data Source
AI summary
Some embodiments of the invention are directed to techniques for determining whether a process on a computer system that is sending or receiving data, or is attempting to send or receive data, with another computer system is executing in kernel mode or user mode and providing an indicator of this determination to a security engine. In some embodiments, such an indication is provided to a security engine (e.g., a firewall) that implements a security policy based at least in part on whether the sending or receiving process is in kernel mode or user mode, and filter communications based on a process' operating mode. This enables a security engine to maintain security policies of greater specificity and thus improve security of a computer system.