Overlayfs Integrity Control via Copy-on-Write Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for dynamic integrity control of files in persistent memory are complex and resource-intensive, particularly in detecting modifications and ensuring security against persistent attacks like advanced persistent threats (APT), as they often require extensive database management and resource-consuming hash calculations.
Innovation Solution
A method involving a copy-on-write mechanism where files in a read-only memory space are copied to a separate writable space upon modification, with a denylist or allowlist to filter files for integrity control, allowing for efficient detection of integrity violations without the need for frequent database updates or resource-intensive calculations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional integrity control methods using hash functions and FIM tools are employed, then file integrity verification capability is improved, but system resource consumption and complexity increase
Solution Approach 1:
The patent segments the file system into two distinct memory spaces: a read-only first space for storing original files and a read-write second space for storing modified files. This segmentation eliminates the need for complex hash calculations and database management by simply comparing file presence between the two spaces, thereby reducing system complexity while maintaining integrity verification capability.
Solution Approach 2:
The patent employs a copy-on-write mechanism where modified files are copied to the second memory space rather than updating files in place. This copying approach simplifies integrity control by enabling direct comparison of file presence between spaces without requiring resource-intensive hash function calculations or complex database operations.
2Measurement precision
If frequent integrity checks are performed using traditional methods, then detection precision is improved, but processing time and resource consumption increase
Solution Approach 1:
By copying modified files to a separate second memory space and maintaining a mapping between original and modified files, the system enables rapid integrity checks through simple presence comparison rather than complex hash calculations. This significantly reduces processing time while maintaining high detection precision for integrity violations.
Solution Approach 2:
The patent performs preliminary actions by pre-establishing the copy-on-write mechanism and file mapping structure before integrity checks are needed. This allows the system to conduct frequent integrity verification with minimal processing time during actual checks, as the structural framework is already in place for rapid comparison.
3Reliability
If comprehensive file monitoring is implemented to detect all modifications, then reliability is improved, but system performance and productivity deteriorate
Solution Approach 1:
The patent extracts the integrity control function from the main file system operations by implementing a separate copy-on-write mechanism in a second memory space. This extraction allows comprehensive monitoring of file modifications without burdening the main system performance, as the integrity verification operates independently through simple file presence comparison.
Solution Approach 2:
By copying modified files to the second space rather than processing them in the main system, the patent achieves comprehensive integrity monitoring with minimal impact on system productivity. The copy operation is transparent and efficient, allowing the main system to continue operations while integrity verification proceeds independently.
4Adaptability or versatility
If read-write memory space is used for storing files requiring integrity control, then adaptability is improved, but security against persistent attacks deteriorates
Solution Approach 1:
The patent segments memory spaces into read-only first space for original files and read-write second space for modified files. This segmentation inherently protects against persistent attacks by isolating the original files in a protected read-only environment while allowing controlled modifications in the second space, thus maintaining both adaptability and security.
Solution Approach 2:
The second memory space acts as an intermediary layer between the protected read-only first space and external modification attempts. This intermediary structure allows the system to maintain adaptability for legitimate modifications while blocking harmful persistent attacks from directly affecting the original files in the first space.
Data Source
AI summary
A method is disclosed for dynamic control, at file level, of an integrity of a set of files stored in a persistent memory of a computer. The method includes mounting an overlay file system of the Overlayfs type, with a “lower” directory containing the files which is marked as read-only, and with an “upper” directory containing any file resulting from a modification of the files of the “lower” directory by virtue of a copy-on-write mechanism. A denylist of files from the “lower” directory to be excluded from the integrity control is created and maintained. An integrity violation of a file is detected if a copy of said file is identified in the “upper” directory. The method also includes containerization, which natively implements file mounting by overlays of the Overlayfs type.