Root Access Control via Pre-Approved Behavioral Contracts

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing anti-virus, firewall, and encryption products for computing devices are inadequate in preventing performance degradation over time, as they rely on computationally-intensive scanning engines that consume resources and are limited to detecting known viruses, failing to address complex factors contributing to degradation.

Innovation Solution

A computing device method that requires applications seeking root access to propose and pre-approve operations, using a behavior analyzer and contracts negotiator/enforcer units to ensure only non-malicious operations are executed, thereby preventing malicious behavior and maintaining performance and security integrity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a computationally-intensive scanning engine is used to detect viruses and malware, then detection capability is improved, but processing resources and battery life are consumed excessively

Engineering Contradiction:

Improvedetection capabilityVSAvoidbattery life

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system performs preliminary analysis of application behavior patterns and operational contracts before granting root access. By evaluating the proposed operations in advance and comparing them against established behavior vectors and security policies, the system prevents malicious applications from obtaining privileged access, thereby eliminating the need for continuous intensive scanning while maintaining security detection capability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of performing comprehensive scanning of all system operations, the system skips directly to analyzing specific critical behavior vectors and operational contracts that are most indicative of malicious intent. By focusing analysis on high-value indicators rather than exhaustive scanning, the system achieves effective detection with reduced computational overhead and energy consumption.

Inventive Principle:

Principle #21Skipping (Rushing through)

2Reliability

If a computationally-intensive scanning engine is used to detect viruses and malware, then detection capability is improved, but processing resources are consumed excessively

Engineering Contradiction:

Improvedetection capabilityVSAvoidprocessing resources

Core Design Contradiction:

ReliabilityVSPower

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system applies different levels of analysis to different aspects of application behavior. Instead of uniformly scanning all operations, it focuses intensive analysis on critical behavior vectors and operational contracts that are most indicative of malicious intent, while using lighter-weight monitoring for routine operations. This localized quality approach maintains detection effectiveness for malicious software while reducing overall processing resource consumption.

Inventive Principle:

Principle #3Local quality

3Reliability

If existing anti-virus products are used, then known viruses and malware can be detected, but complex factors contributing to performance degradation cannot be addressed

Engineering Contradiction:

Improvedetection of known malwareVSAvoidability to address complex degradation factors

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system dynamically adapts its monitoring and analysis capabilities based on the specific operational context and behavior patterns observed. Instead of relying on static virus signatures, it continuously updates behavior vectors and evaluates operational contracts in real-time, enabling it to detect and respond to complex performance degradation factors that evolve over time and adapt to different system states.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system performs multiple functions through a unified approach: it monitors application behavior, analyzes operational contracts, evaluates behavior vectors, and responds to performance degradation. This multi-functional capability allows the same framework to address both traditional malware detection and complex performance issues arising from application interactions, hardware failures, and system state changes.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS9323929B2Pre-identifying probable malicious rootkit behavior using behavioral contracts

Publication Date: 2016.04.26 QUALCOMM INC

AI summary

The various aspects provide for a computing device and methods implemented by the device to ensure that an application executing on the device and seeking root access will not cause malicious behavior while after receiving root access. Before giving the application root access, the computing device may identify operations the application intends to execute while having root access, determine whether executing the operations will cause malicious behavior by simulating execution of the operations, and pre-approve those operations after determining that executing those operations will not result in malicious behavior. Further, after giving the application root access, the computing device may only allow the application to perform pre-approved operations by quickly checking the application's pending operations against the pre-approved operations before allowing the application to perform those operations. Thus, the various aspects may ensure that an application receives root access without compromising the performance or security integrity of the computing device.