Data Integrity Detection Across Kernel and User Mode Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data modification across operating system kernel and user mode spaces can occur due to malicious software, making it difficult to ensure data integrity and detect potential malware or faults within the system.
Innovation Solution
A method and system that determine content indicators of data at the boundaries of kernel and user mode spaces, comparing them to detect any modifications, using checksum, cryptographic hash, or digital signature indicators, and generating logs or preventing data transmission upon detection of modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is allowed to traverse freely between user mode and kernel mode spaces, then system operation efficiency is maintained, but data integrity cannot be ensured due to potential malicious modification
Solution Approach 1:
The patent applies preliminary action by computing content indicators (such as checksums or cryptographic hashes) of data at the boundaries of user mode and kernel mode spaces before the data actually traverses between these spaces. This advance preparation allows integrity verification to occur without blocking normal data flow, thus maintaining system operation efficiency while ensuring data integrity through pre-computed comparison points
Solution Approach 2:
The patent introduces content indicators as intermediary elements that mediate between user mode applications and kernel mode operations. These indicators serve as surrogate markers that can be computed and compared without requiring direct intervention in the main data path, allowing integrity verification to occur indirectly through comparison of indicator values at different traversal points
2Measurement precision
If content indicators are computed and compared at data boundaries, then data modification detection capability is improved, but system complexity increases
Solution Approach 1:
The patent applies local quality by computing content indicators only at specific boundary locations where user mode and kernel mode spaces interface, rather than throughout the entire data path. This localized approach concentrates verification efforts at critical transition points where malicious modifications are most likely to occur, achieving high detection accuracy without the overhead of comprehensive system-wide monitoring
Solution Approach 2:
The patent extracts the essential integrity verification function by isolating content indicator computation and comparison operations from the main data processing flow. By separating the verification mechanism into distinct extraction points at mode boundaries, the system achieves precise modification detection while keeping the core data processing paths simple and efficient
3Reliability
If multiple content indicators are used to represent data records, then detection reliability is improved, but computational overhead increases
Solution Approach 1:
The patent applies partial action by using a selective number of content indicators rather than computing all possible types for every data record. The system computes one or more indicators from a set of available types (such as checksum, cryptographic hash, or digital signature) based on the specific verification needs and security requirements, achieving sufficient reliability without the excessive computational cost of multiple redundant indicators
Data Source
AI summary
A method and apparatus for detecting data modification in a layered operating system is disclosed. Outbound content indicators at different layers are compared to detect potential outbound data modifications. Likewise, inbound content indicators at different layers are compared to detect potential inbound data modifications. Content indicators include checksum, cryptographic hash, signature, and fingerprint indicators. Embodiments of the present invention enable detection of data modifications across an operating system's kernel and user mode spaces, prevention of modified outbound data from reaching a network, prevention of modified input data from reaching a user application, and detection of malware and faults within an operating system.