Script Execution Security Container with Intermediary Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems fail to effectively protect against malicious script files, particularly in 'default deny' protection mode, where trusted interpreters can execute harmful scripts without adequate limitations.
Innovation Solution
Implementing a security container with action limiting policies for script interpreters to detect and intercept script file execution, allowing trusted scripts while blocking or limiting actions of untrusted scripts, and applying virtual actions instead of prohibited ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a security container with action limiting policies is implemented for script interpreters, then computer security against malicious scripts is improved, but device complexity increases due to the additional security layer and interception mechanisms
Solution Approach 1:
A security container is introduced as an intermediary component between the script interpreter and the system resources. The container includes a security application that intercepts actions of the interpreter, determines whether they are permitted, and applies limitations when needed. This mediator approach allows security policies to be enforced without fundamentally changing the interpreter itself, thus improving security while managing complexity through a dedicated security layer.
2Reliability
If virtual actions are performed instead of intercepted actions, then system integrity is maintained by blocking harmful operations, but productivity decreases due to the overhead of action interception and substitution
Solution Approach 1:
The security container acts as an intermediary that monitors and controls interpreter actions. When a harmful action is detected, the security application substitutes it with a virtual action that maintains system integrity. The intermediary approach allows selective interception only when security policies are violated, rather than blocking all actions, thus balancing system protection with execution efficiency.
3Measurement precision
If all interpreter actions are intercepted and monitored, then detection precision of malicious scripts is improved, but loss of time increases due to the continuous monitoring and analysis required
Solution Approach 1:
The security container implements partial monitoring by focusing on specific actions that are more likely to indicate malicious behavior. Rather than intercepting and analyzing every single interpreter action in detail, the system applies action limiting policies that target suspicious patterns, allowing trusted scripts to execute with minimal interference while maintaining high detection precision for malicious ones.
Data Source
AI summary
Disclosed are a system and method for secure execution of script files. An example method includes providing a security container associated with a script interpreter, wherein the security container includes at least action limiting policies for the interpreter; detecting an attempt by the script interpreter to execute a script file; determining using the security container whether the script file is a trusted script file; allowing the script interpreter to execute a trusted script file; intercepting actions of the interpreter during execution of the script file; determining using the security container whether an intercepted action is permitted; when the intercepted action is permitted, determining using the security container whether any limitations are associated with the intercepted action; and when a limitation is associated with the intercepted action, applying the limitation to the intercepted action during the execution of the script file.