Security Filter Whitelist Authentication for I/O Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for file system filters introduce significant delays in processing I/O requests due to robust verification processes, and simpler methods are easily bypassed by malicious users.
Innovation Solution
A security client maintains a whitelist of process identifiers for authenticated applications, registering callbacks to authenticate processes at creation and using precomputed hashes to verify their authenticity during I/O requests, allowing quick determination of authorized access to protected artifacts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If robust verification process is used to authenticate applications, then security is improved, but processing time increases significantly
Solution Approach 1:
The patent performs application authentication in advance by registering a callback routine that executes when a process is created. The security filter authenticates the application once at process creation time, stores the authentication result in a white list, and then uses this pre-computed authentication information to quickly handle subsequent I/O requests without repeating the full verification process.
2Productivity
If simple executable name verification is used, then processing speed is improved, but security is weakened and easily bypassed
Solution Approach 1:
The patent changes the authentication parameter from simple executable name comparison to hash value comparison. Instead of merely checking if the executable name matches, the system computes a hash of the executable file and compares it against a pre-stored hash in the white list. This parameter change maintains fast processing while significantly improving security against name-based attacks.
3Ease of operation
If executable name comparison is used for verification, then ease of operation is improved, but resistance to malicious attacks deteriorates
Solution Approach 1:
The patent replaces the mechanical string comparison operation with a cryptographic hash function. Instead of directly comparing executable names as strings, the system computes hash values of the executable files and compares these numeric representations. This substitution maintains operational simplicity while providing cryptographic security against name-based attacks, as the hash function is computationally infeasible to reverse or collision-proof.
Data Source
AI summary
A security client can efficiently authenticate an application during I/O request handling by maintaining a white list that identifies processes that have been created for authenticated applications. The security client can register to be notified when a process is being created. When such a notification is received, the security client can authenticate the application for which the process is being created and then add an entry to the white list that includes the process identifier of the process being created. Then, when the process subsequently generates I/O requests, the security client can use the white list to quickly determine that the process pertains to an authenticated application and allow the I/O requests to modify protected artifacts.