Quarantine Engine for Secure Portable Media File Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional virus scanners are ineffective in detecting and preventing the spread of malicious software from portable storage media due to slow response times and inability to detect polymorphic malware, while businesses need a secure method to transfer untrusted files without compromising computer security.
Innovation Solution
A multi-level security system that includes a quarantine engine with a file filter and picker interface, a malware scanner, and a detonation engine to filter, scan, and detonate untrusted files in a controlled environment, ensuring only safe files are transferred and detected malware is identified and added to signature databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional virus scanners are used to detect malware from portable storage media, then the system can identify known malware signatures, but the scanners are too slow to respond to files transferred quickly and cannot detect polymorphic malware
Solution Approach 1:
The security system is divided into multiple independent scanning engines: a first malware scanning engine that performs initial signature-based scanning, and a second malware scanning engine that performs additional scanning including polymorphic detection. This segmentation allows each engine to specialize in specific detection methods, improving overall detection reliability while maintaining speed through parallel processing of different scanning techniques.
Solution Approach 2:
The system performs preliminary scanning actions immediately when portable storage media is connected, before any file access occurs. The quarantine engine intercepts files at the source and presents them to scanning engines proactively, ensuring malware detection happens before the files can potentially harm the system. This preliminary action eliminates the delay between file transfer and detection.
2Ease of operation
If businesses allow customers to bring their own files on portable media devices, then customer access and convenience are improved, but computer security is compromised due to potential malware transmission
Solution Approach 1:
A quarantine engine acts as an intermediary between the portable storage media and the computer system. This intermediary component intercepts all files from the portable media, presents them to scanning engines for analysis, and only releases safe files to the computer. The quarantine engine maintains a clean interface for users while performing rigorous security checks, allowing easy file access without compromising security.
Solution Approach 2:
The system creates a disposable quarantine environment that is discarded after use. Each time portable media is connected, a fresh quarantine session is created, scanned, and then either released or destroyed. This disposable approach ensures that even if malware slips through initial scanning, it cannot persist or infect the main system, as the quarantine environment is discarded after single-use inspection.
3Productivity
If files are transferred directly from portable storage media to the computer, then transfer speed is maximized, but malware can execute immediately and cause harm
Solution Approach 1:
The quarantine engine performs preliminary scanning and verification actions immediately when portable media is connected, before any file transfer to the computer occurs. Files are scanned in advance and only transferred after verification, eliminating the window where malware could execute during transfer. This preliminary action maintains transfer speed by processing files in a streamlined fashion without requiring post-transfer scanning.
Solution Approach 2:
The quarantine engine serves as an intermediary transfer mechanism that sits between the portable storage media and the computer filesystem. It controls the transfer process itself, scanning files during the transfer operation rather than allowing direct transfer followed by separate scanning. This intermediary approach integrates security checks into the transfer process, maintaining productivity while preventing malware execution.
Data Source
AI summary
System, method and medium for securely transferring untrusted files from a portable storage medium to a computer. The invention can filter, scan and detonate untrusted files to be transferred to a computer from a portable storage medium. First, the types of files which are eligible to be selected for transfer are limited, by file type and/or content. Second, each file selected for transfer is scanned against a collection of signatures of known malware. Thus, files contain malware which has been previously identified as such can be blocked from ever being transferred to the computer. Finally, each file to be transferred is detonated by opening it in a controlled, sterile environment to determine if it adversely impact the operation of that sterile environment. Malware detected in this way can then be added to the collection of malware that can be detected by the second step.