Removable Media File System Isolation via Virtual Machine

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Computing systems are vulnerable to attacks through compromised removable media file systems, which can crash or steal data due to their unrestricted access to system resources, making it difficult to protect the host system from such threats.

Innovation Solution

Implementing a lightweight virtual machine on the computing device that mounts the removable media file system, isolating it from the host system and connecting it to a server to serve files, thereby containing any potential attacks within the virtual environment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the file system runs in kernel mode with unrestricted access to computing resources, then the file system can access and manipulate system resources freely, but the computing system becomes vulnerable to crashes and data theft from compromised removable media

Engineering Contradiction:

ImproveFile system access capabilityVSAvoidSystem vulnerability to attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

A virtual machine is introduced as an intermediary layer between the removable media file system and the host computing system. The file system runs within the virtual machine environment, which mediates all resource access requests through virtualization layers, preventing direct access to critical host resources while maintaining file system functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The computing system is segmented into distinct virtualized environments. The file system operates in an isolated virtual machine instance separated from the host operating system, creating security boundaries that contain potential attacks within the virtual environment while preserving resource access capabilities through controlled virtualization interfaces.

Inventive Principle:

Principle #1Segmentation

2Object-affected harmful factors

If the file system is isolated in a virtual machine environment, then the computing system is protected from attacks, but the file system loses direct access to computing resources

Engineering Contradiction:

ImproveSystem securityVSAvoidResource access capability

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

Direct mechanical/resource access from the file system to host resources is replaced with virtualized resource access mechanisms. The virtual machine provides abstracted interfaces for resource access, substituting direct hardware interaction with software-mediated access that maintains security while preserving functionality.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The virtual machine environment provides universal access to computing resources through standardized virtual interfaces. Rather than restricting access entirely, the virtualization layer provides multi-functional resource access pathways that work across different resource types (storage, memory, CPU) while maintaining security boundaries.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentEP3555787B1Safe mounting of external media

Publication Date: 2021.11.24 MICROSOFT TECHNOLOGY LICENSING LLC

Figure 1
Figure 2
Figure 3

AI summary

Mounting a filesystem for media. The method includes detecting that media has been connected to a computing device. The method further includes causing a filesystem for the media to be mounted to a virtual machine. The virtual machine is coupled to a server. The method further includes causing file data from the media organized by the filesystem to be served from the server to the computing device.