Secure Operating Mode Kernel Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems are inadequate in preventing the interception of user-provided information during security-critical Internet applications, as they cannot effectively counter keylogger programs, phishing attacks, and other malicious software that exploit operating system vulnerabilities, and rely on external hardware solutions which are costly and inconvenient.
Innovation Solution
A secure operating mode is implemented where the bootloader verifies the operating system kernel and executable files before loading them into read-only memory, ensuring that user information is encrypted and not persisted on the local file system, and only authorized websites can access sensitive data, preventing interception by third parties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If external hardware solutions (smart card readers) are used to prevent capture of user information, then security is improved, but device complexity and cost increase
Solution Approach 1:
The patent extracts the security verification functionality from external hardware and implements it within the operating system kernel. The kernel includes a verification module that checks executable files against a whitelist before allowing execution, removing the need for external smart card readers while maintaining security controls.
Solution Approach 2:
The operating system kernel is enhanced with multi-functional capabilities including executable file verification, whitelist management, and secure execution environment control. This universal security mechanism replaces multiple specialized external security devices with a single integrated system.
2Reliability
If external hardware solutions (smart card readers) are used to prevent capture of user information, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The system performs automatic verification of executable files against the whitelist without requiring user intervention. The kernel's verification module automatically checks files before execution, eliminating the need for users to manually insert smart cards or configure security settings, thus maintaining ease of operation.
3Adaptability or versatility
If traditional operating systems are patched to address vulnerabilities, then adaptability is improved, but reliability deteriorates due to potential introduction of new vulnerabilities
Solution Approach 1:
The system performs preliminary verification of executable files against a whitelist before allowing execution. This preventive approach blocks known malicious files and unauthorized modifications before they can execute, addressing vulnerabilities proactively rather than through reactive patching that may introduce new issues.
Solution Approach 2:
The system uses disposable security tokens or one-time verification codes in the whitelist mechanism that can be easily updated without requiring complex patching processes. This allows frequent updates of security rules without the risks associated with traditional OS patching.
Data Source
AI summary
A computing device operates in a secure operating mode in response to user selection. Computer hardware is initialized to verify a bootloader of an operating system, and the bootloader verifies the operating system kernel. The kernel then verifies operating-system level executable files. After verification, a limited set of the verified files is loaded into a portion of the memory that is subsequently marked by the kernel as read-only. These files are executed to provide a basic Internet browser session; all other files are identified as non-executable. When the user accesses an authorized website and conducts a transaction that requires a user to provide information, the information is encrypted during transmission of the network. In addition, such information cannot be accessed by other parties since the information provided is not persisted at the computing device.