Sandbox Process for Network Configuration Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security measures are inadequate in detecting and preventing malware from accessing sensitive resources in network configuration databases, as some malware can evade honeypots and gain unauthorized access.
Innovation Solution
A method involving a sandbox process that accesses a reference database to determine if a requesting computer process needs a specified resource, and if not, directs it to an anti-malware monitored environment, either virtual or real, to assess its intentions, thereby preventing malicious access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If honeypots are used to detect unauthorised access to sensitive resources, then detection capability is improved, but some malware can still evade the honeypots and gain access
Solution Approach 1:
The patent introduces a sandbox process as an intermediary between the requesting computer process and the configuration database. This sandbox process verifies whether the requesting process is entitled to access the requested resource before allowing the access. The sandbox process acts as a mediator that checks entitlement rights and only permits access if the requesting process is authorized, thereby preventing malware from evading detection while maintaining legitimate access.
2Reliability
If a sandbox process is introduced to verify entitlement before resource access, then security is improved, but system complexity increases
Solution Approach 1:
The sandbox process is designed to handle multiple functions: it verifies entitlement rights, determines whether a computer process is entitled to access requested resources, and controls resource access. By making the sandbox process multi-functional, the patent reduces the need for separate security components and simplifies the overall system architecture while maintaining high security standards.
Data Source
AI summary
Embodiments of the invention relate to improving security of computer resources. According to an aspect, providing access to a reference database storing information on known behavior of trusted computer processes and on resources the trusted computer processes need from a configuration database, the configuration database stores configuration information of a computer network; detecting, by a first computer process from a second computer process, a request for specified resource of the configuration database; determining, based on the request and the reference database, whether the second computer process is known to need the requested resource; upon determining that the computer process is not known to need the requested resource, causing a response to the request indicating to the second computer process that the response includes the requested resource but wherein the response comprises a resource indicator that directs the second computer process to access an environment monitored by an anti-malware computer process.