Secured Software Agent for Open Device Kernel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security methods for preventing and detecting security threats on open devices are inadequate, as they can be circumvented by malware and rootkits, and lack comprehensive automation for exhaustive verification, leading to potential unauthorized access and data breaches.
Innovation Solution
A system and method that incorporates a secured software agent embedded within an abstraction layer between device hardware and application software, which limits access, validates loadable kernel modules, blocks system call table modifications, and prevents debug utility requests, ensuring dynamic platform security and integrity monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security methods are used for preventing and detecting security threats on open devices, then device functionality and openness are maintained, but security reliability is insufficient as methods can be circumvented by malware and rootkits
Solution Approach 1:
The patent introduces a security agent as an intermediary component embedded within the operating system kernel. This agent acts as a mediator between the hardware and application software, monitoring and controlling system calls to detect and prevent security threats. The agent intercepts system calls, validates them against security policies, and blocks malicious operations while allowing legitimate operations to proceed, thereby enhancing security reliability without requiring fundamental changes to the open device architecture.
Solution Approach 2:
The security system is segmented into distinct functional components: a security agent embedded in the kernel, a system call table with marked entries, and an application layer. This segmentation allows the security agent to specifically monitor and control critical system calls without affecting the overall functionality of the open operating system. The system call table is further segmented with marked entries that indicate security-relevant operations, enabling targeted security enforcement.
2Measurement precision
If comprehensive automation for exhaustive verification is implemented, then security detection capability is improved, but processing time and system performance deteriorate
Solution Approach 1:
The security agent implements partial verification by focusing on marked system call table entries that represent critical security-relevant operations. Instead of verifying every system call exhaustively, the agent selectively monitors and validates only those calls marked in the system call table, such as file operations, network communications, and process management functions. This partial action approach maintains high security verification precision for critical operations while minimizing processing time overhead for non-critical operations.
Solution Approach 2:
The system performs preliminary action by pre-marking system call table entries that correspond to security-critical operations before runtime verification begins. This pre-marking allows the security agent to quickly identify and focus verification efforts on relevant operations without performing exhaustive analysis on all system calls. The marked entries serve as pre-identified targets for security monitoring, enabling efficient verification with reduced processing time.
3Reliability
If access to abstraction layer is restricted to prevent security threats, then security reliability is improved, but ease of operation for legitimate applications deteriorates
Solution Approach 1:
The security agent implements local quality control by applying different access control policies to different system call table entries. Critical security-sensitive operations have marked entries that trigger strict verification and blocking by the security agent, while non-critical operations allow more permissive access. This local differentiation ensures that security restrictions are applied precisely where needed in the abstraction layer without unnecessarily impeding legitimate application operations elsewhere in the system.
Solution Approach 2:
The security agent incorporates feedback mechanisms that monitor system call patterns and adjust access control decisions dynamically. When legitimate applications require access to restricted abstraction layer functions, the agent can learn from verified patterns and adjust its control policies to allow legitimate operations while maintaining security. The feedback loop enables the system to balance security reliability with operational ease based on observed behavior patterns.
Data Source
AI summary
A system and method is provided for implementing platform security on a consumer electronic device having an open development platform. The device is of the type which includes an abstraction layer operable between device hardware and application software. A secured software agent is provided for embedding within the abstraction layer forming the operating system, The secured software agent is configured to limit access to the abstraction layer by either blocking loadable kernel modules from loading, blocking writing to the system call table or blocking requests to attach debug utilities to certified applications or kernel components.