Secure File System Filter Driver Isolating Guest Host Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer systems lack effective security measures to prevent malicious code from compromising file systems, leading to data corruption, unauthorized access, and loss, as they rely on operating system-level controls that can be bypassed by threats like boot-sector viruses and malware, and existing file systems expose all files when access is gained to a single file.
Innovation Solution
A control computing environment governs file system access and updates for a user computing environment, providing isolation through a secure file system filter driver and version manager, limiting communication to secure data channels, and using power source redundancy to prevent data loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional operating system-level security controls are used, then ease of operation is maintained, but security against malicious code is insufficient
Solution Approach 1:
The system is divided into two distinct processing environments: a host processing environment that provides secure file system management and a guest processing environment that runs user applications. This segmentation isolates malicious code in the guest environment from the host file system, preventing compromise while maintaining operational simplicity for users.
Solution Approach 2:
A file system filter driver acts as an intermediary between the guest processing environment and the host file system. All file access requests from the guest environment must pass through this filter driver, which enforces security policies and prevents malicious code from directly accessing or corrupting the host file system.
2Ease of operation
If all files are accessible when a single file is accessed, then ease of operation is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The file system is segmented into guest-accessible files managed by the secure file system filter driver and host-protected files. The filter driver creates isolated file system views for different guest applications, allowing each to access only its required files while preventing access to other files, thus maintaining ease of operation without exposing all files to potential threats.
3Productivity
If direct disk access is allowed for booting, then productivity is improved, but security against boot-sector viruses deteriorates
Solution Approach 1:
The host processing environment performs preliminary verification of boot sector files before they are accessed by the guest environment. The secure file system filter driver pre-loads and validates boot files, checking them for malicious code before the guest system boots, thus maintaining fast boot performance while preventing boot-sector virus infections.
Data Source
AI summary
System, method, computer, and computer program for secure data processing of potentially malicious code and documents or other data that may contain malicious code. System, method, computer for a secure and reliable computing environment to protect against data loss and/or corruption to provide secure and reliable data processing.