Secure Supervisor System Calls for Malicious Software Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic devices are vulnerable to malicious software that consumes resources such as processing power and RAM, leading to poor user experience due to the lack of robust security measures in conventional system service requests.
Innovation Solution
Implementing a mechanism where requesting applications must provide a digitally signed request for resource allocation, validated by a supervisor application using cryptographic techniques, to ensure only authorized applications access resources, thereby preventing malicious software from unauthorized resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the electronic device operates in supervisor mode to enable all possible requests, then resource availability and processing capability are improved, but security against malicious software deteriorates
Solution Approach 1:
The patent applies preliminary action by requiring applications to obtain digital signatures and certificates BEFORE they can access resources. The security validation occurs in advance through the signature verification process, ensuring that only authorized applications can proceed with resource requests. This prevents malicious software from exploiting supervisor mode without proper authorization.
Solution Approach 2:
The patent introduces an intermediary security validation mechanism that acts as a mediator between the application and the resource allocation process. The digital signature and certificate verification process serves as this intermediary layer, checking authorization before resources are granted. This intermediary security check resolves the contradiction by allowing supervisor mode functionality while blocking unauthorized access through cryptographic validation.
2Ease of operation
If conventional system service requests are used without signature validation, then ease of operation is improved, but security against malicious software deteriorates
Solution Approach 1:
The patent applies self-service by requiring applications to automatically generate and include their own digital signatures with requests. The application itself is responsible for obtaining the certificate and embedding it in the request, rather than requiring manual security configuration. This self-service approach maintains ease of operation while enabling robust security through automated cryptographic validation.
3Reliability
If digital signature validation is implemented for all resource requests, then security against malicious software is improved, but device complexity increases
Solution Approach 1:
The patent applies copying by using digital signatures that are cryptographic copies of the application's identity and authorization information. Instead of complex hardware-based security mechanisms, the system uses software-based digital certificates that replicate security functions through mathematical algorithms. This copying approach reduces device complexity while maintaining strong security through standardized cryptographic protocols.
4Productivity
If supervisor mode is used to process all requests, then resource allocation efficiency is improved, but vulnerability to malicious software increases
Solution Approach 1:
The patent applies preliminary anti-action by implementing signature validation BEFORE resource allocation occurs. This preemptive security measure counteracts potential malicious actions before they can execute. By validating the digital signature in advance, the system prevents malicious software from consuming resources efficiently, while still allowing legitimate applications to access resources without delay.
Data Source
AI summary
A device, system, and method processes a request for allocation of a resource of an electronic device utilizing a secure supervisor system call. The method includes receiving a call from a requesting application of the electronic device, the call indicating the request for allocation of the resource of the electronic device. The method includes determining whether the call is authorized to receive the resource of the electronic device. The determining includes determining whether the call includes a signature that is generated based upon a predetermined signature operation and determining whether the signature is valid based upon the predetermined signature operation when the call includes the signature. The method includes processing the request for the allocation of the resource when the call is determined to be authorized.