Recursive Descent Parsing and AST Transformation for Protected Executables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems grant applications extensive control over file systems, allowing malware to surreptitiously access and manipulate user data without user consent, leading to unauthorized data access, transmission, and execution of malicious code.
Innovation Solution
Implementing an operating system with features that restrict applications to specific subsets of system functions, require user volition for access, and separate user and application data storage areas to prevent unauthorized access and transmission, ensuring user control over data access and network activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications are granted extensive control over file systems, then application functionality and ease of operation are improved, but security and protection against unauthorized access deteriorate
Solution Approach 1:
The patent divides the file system into distinct storage areas: user data storage areas and application data storage areas. Applications are restricted to accessing only their designated application data storage areas, while user data remains isolated. This segmentation prevents applications from surreptitiously accessing user files while maintaining application functionality within their designated boundaries.
Solution Approach 2:
The operating system acts as an intermediary between applications and the file system. The OS mediates all file access requests by checking whether applications are attempting to access user data or their own application data, and enforces access control policies accordingly. This intermediary role allows the system to maintain security while permitting legitimate application operations.
2Adaptability or versatility
If applications can access any user data file, then data accessibility is improved, but data security and user control deteriorate
Solution Approach 1:
The patent implements separate storage areas for user data and application data, with clear access boundaries. Each application is assigned a specific application data storage area that it can access, while user data storage areas remain inaccessible to applications. This segmentation maintains data security while allowing applications to access their own data as needed.
Solution Approach 2:
Different parts of the file system have different access qualities. Application data storage areas are accessible to their respective applications with full read/write permissions, while user data storage areas have restricted access. This local differentiation of access rights ensures that applications can function properly without compromising user data security.
3Ease of operation
If applications can initiate network transmissions autonomously, then network connectivity is improved, but protection against malicious transmission deteriorates
Solution Approach 1:
The patent requires user volition or explicit permission as a preliminary action before applications can initiate network transmissions. The system checks for user authorization before allowing any network activity, preventing autonomous or surreptitious transmissions by applications. This preliminary verification maintains network connectivity functionality while blocking malicious or unauthorized transmissions.
4Adaptability or versatility
If applications can launch other applications without restriction, then system flexibility is improved, but protection against surreptitious execution deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the operating system monitors and verifies each application launch request. Before allowing an application to launch another application, the OS checks for user permission or authorized conditions. This feedback loop maintains system flexibility for legitimate application launches while preventing surreptitious or malicious execution of applications.
Data Source
AI summary
Methods, systems, and devices for parsing text are described herein. A method of securing executable files is performed at a computing device having one or more processors and memory. The memory stories one or more programs configured for execution by the one or more processors. The computing device obtains source text that comprises a disassembled executable file and identifies, via a general parser module, the syntax of the source text by performing a recursive descent parsing of the source text. The device generates an abstract syntax tree (AST) for the source text based on the identified syntax and generates a transformed AST from the generated AST by replacing one or more system calls with respective protected system functions. The device also generates a secured executable file by assembling the transformed AST.