Selective File Hashing for Large-File Integrity Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file integrity monitoring methods fail to provide efficient and flexible file monitoring, especially in large files, and are inefficient in large files, and do not provide effective monitoring and processing of large files.
Innovation Solution
A method and system for file integrity monitoring that optimizes hashing by selecting predetermined and random sections of file bytes for hashing, allowing for efficient monitoring of large files and providing flexible response actions to file changes, including continuous background monitoring and integration with existing security architectures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the entire file is hashed to ensure complete integrity verification, then measurement precision is improved, but use of energy and computational resources increase significantly for large files
Solution Approach 1:
The patent divides the file into multiple sections (e.g., header, body, footer) and selects specific sections for hashing rather than hashing the entire file. This segmentation allows the system to verify critical portions of the file while reducing computational overhead for large files.
Solution Approach 2:
The patent applies different hashing strategies to different sections of the file based on their importance. Critical sections such as headers and footers are hashed with higher priority or more frequently, while less critical sections may be hashed less frequently or with simpler algorithms, optimizing the balance between verification accuracy and resource consumption.
2Speed
If file integrity monitoring is performed frequently to detect tampering quickly, then speed of detection is improved, but use of energy and computational resources increase
Solution Approach 1:
The patent implements periodic integrity monitoring where files are hashed at scheduled intervals rather than continuously. This allows the system to detect tampering within defined time windows while significantly reducing computational resource consumption compared to continuous monitoring.
Solution Approach 2:
The patent performs preliminary hashing of files and stores these baseline hash values. Subsequent integrity checks compare current file states against these pre-computed baselines, enabling rapid detection of changes without repeatedly performing full hashing operations on unchanged files.
3Reliability
If monitoring is applied to all files uniformly to ensure comprehensive security, then reliability is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent applies differentiated monitoring strategies to different files or file sections based on their security sensitivity. High-priority files (e.g., system files, configuration files) receive more intensive monitoring with frequent hashing and stricter verification, while lower-priority files receive reduced monitoring, optimizing the balance between security coverage and processing overhead.
Data Source
AI summary
A method, system, server, and software application provide verification of file integrity. Embodiments include determining for a byte array representing a file, whether a size of the file is larger than a threshold size value. A first predetermined section of the byte array, a second predetermined, and a third random section of the byte array is selected. A first hashing of the file is performed. A first hash value is generated of the first and second predetermined sections of the byte array and the third random section of the byte array. A second hashing of the file is performed to determine whether a second hash value that matches the first hash value. A determination is made that the file has been tampered with in the event the second hash value does not match first hash value.