Kernel Self-Protection via Digital Signature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware systems are vulnerable to malware attacks, which can weaken or disable them, leaving computing devices more susceptible to further malware infections.
Innovation Solution
A self-protection application executes in kernel mode, monitoring and managing access to anti-malware files and processes through digital signature verification, allowing only trusted processes to access anti-malware components and restricting unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If anti-malware software is made more accessible and less restricted, then ease of operation improves, but reliability deteriorates as malware can more easily disable or weaken the protection
Solution Approach 1:
The patent segments the anti-malware system into a protected core component and a self-protection application layer. The self-protection application acts as an intermediary that manages access to the core anti-malware functions, allowing legitimate operations while blocking malicious interference attempts through digital signature verification and access control lists.
Solution Approach 2:
The self-protection application serves as an intermediary between the operating system/kernel and the anti-malware core. It intercepts and filters access requests, verifying digital signatures and checking access control lists before permitting operations, thus protecting the core from both legitimate and malicious access attempts while maintaining normal functionality.
2Reliability
If digital signature verification is implemented for all access requests, then reliability improves, but device complexity increases due to additional verification layers
Solution Approach 1:
The patent implements digital signature verification selectively rather than universally. The self-protection application verifies signatures for critical anti-malware components and access control lists, while allowing unrestricted access to non-critical functions. This partial verification approach provides sufficient security for protecting core functions without the overhead of verifying every single access request.
Solution Approach 2:
The system performs preliminary digital signature verification and access control list checks before granting access to protected anti-malware functions. By verifying credentials in advance and maintaining pre-defined access control policies, the system avoids the need for complex real-time verification of every access parameter, reducing overall system complexity.
3Reliability
If kernel mode execution is used for self-protection application, then reliability improves through wider hardware access, but device complexity increases due to kernel-mode operations
Solution Approach 1:
The self-protection application operates autonomously in kernel mode, independently monitoring system calls, verifying digital signatures, and enforcing access control policies without requiring constant user intervention or complex external management. This self-managing approach simplifies the overall system architecture despite the inherent complexity of kernel-mode operations.
Data Source
AI summary
A self-protection application executes in kernel mode and manages access to processes and files related to an associated anti-malware application. The self-protection application monitors executing processes on the client device and detects the processes that are attempting to access files/processes related to the anti-malware software. These processes and files are verified by the self-protection application using digital signature authentication. Trusted processes such as those originating from the anti-malware software or other authorized programs are allowed access while other processes are restricted access.