Random Application Translocation via Mirroring File System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware software can be included with legitimate software and executed via relative paths, posing a security risk as existing technologies fail to effectively prevent such malicious execution.
Innovation Solution
A method that uses random translocation at launch time to prevent malware by creating a mirroring file system, which maps the application's directories from a trusted source, restricting access to relative paths and ensuring the application executes from a random, secure location, thereby preventing unauthorized access to file system resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications are allowed to access file system resources via relative paths, then application functionality and ease of operation are improved, but security is worsened as malware can be executed from arbitrary locations
Solution Approach 1:
The patent introduces a file system intermediary layer that sits between the application and the actual file system. This intermediary intercepts file access requests, validates them against security policies, and either allows or blocks access based on whether the application is running in a translocated state. This mediator resolves the contradiction by maintaining relative path functionality for legitimate applications while blocking malicious access attempts.
Solution Approach 2:
The system performs preliminary actions by creating translocation markers and establishing security policies before the application executes. When an application is downloaded or installed, the system pre-configures translocation data structures and security rules that will govern its file access behavior. This preliminary setup ensures that when the application runs, security constraints are already in place, preventing malware execution while allowing legitimate functionality.
2Object-affected harmful factors
If applications are translocated to random locations at launch time, then security is improved by preventing malware execution, but device complexity and ease of operation worsen
Solution Approach 1:
The patent uses copying by creating translocation data structures that mirror the application's file system layout without physically moving the application files. The translocation marker contains a copy of the necessary path mapping information, allowing the system to virtualize the application's file system view without complex physical relocation. This reduces device complexity while maintaining security benefits.
Solution Approach 2:
The translocation marker structure serves multiple functions: it acts as a security credential, a file system mapping table, and an execution control mechanism. By making this single data structure multi-functional, the patent reduces overall system complexity while achieving malware prevention, file access management, and application lifecycle control in a unified manner.
3Object-affected harmful factors
If applications are translocated to random locations, then security is improved, but application performance and ease of operation deteriorate due to path resolution overhead
Solution Approach 1:
The system performs preliminary path resolution by pre-computing and caching the translocated application's file system paths when the translocation marker is created. Instead of resolving paths in real-time during execution, the paths are resolved in advance and stored in the translocation data structure. This eliminates runtime overhead while maintaining security, as the path mapping is established before the application needs to access files.
Solution Approach 2:
The translocation marker is designed to be self-sufficient, containing all necessary path mapping information and security credentials within its own data structure. When the application needs to access a file, the intermediary uses information already present in the translocation marker without needing to query external systems or perform complex lookups. This self-service approach minimizes runtime overhead while maintaining security constraints.
Data Source
AI summary
In one embodiment, a software application that is downloaded from an untrusted source is marked, based on the untrusted classification of the source, to be translocated when the software application is launched. When the software application is launched it is translocated, through a mirroring file system, to a random mount point that is a partial bind mount to the real file system that stores the image of the software application (e.g. the image of the software application's bundle).