Demountable Storage Access Control via Simulated USB Mounting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures, such as firewalls and antivirus solutions, are inadequate in preventing data exfiltration through mass storage devices like USB sticks, particularly on operating systems like macOS, which tightly control system extensions, making it difficult to block sensitive file transfers.
Innovation Solution
A software entity is established to control access to demountable storage devices, preventing their automatic mounting to user space applications, and instead allowing access through a simulated storage device, with evaluation of file attributes against predefined criteria to determine if the transfer is allowed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If direct calls are made to allow supervisory applications to oversee file saves to USB devices, then data exfiltration control is improved, but security risk increases due to potential access by untrusted entities
Solution Approach 1:
The patent introduces an intermediary mechanism (the supervisory application framework) that sits between user applications and the file system, allowing controlled monitoring of file saves to USB devices without exposing direct system calls to untrusted entities. This mediator architecture enables security oversight while maintaining system integrity.
2Object-affected harmful factors
If tight control of system extensions is implemented in macOS, then security against untrusted entities is improved, but ability to resist data exfiltration deteriorates
Solution Approach 1:
The patent uses a supervisory application as an intermediary that operates within the constrained macOS environment, enabling data exfiltration prevention without requiring direct system extension access. This mediator works within the security model to achieve both goals.
Solution Approach 2:
The patent creates a virtual copy of the USB device interface that presents a simulated storage device to user applications. This copy mechanism allows monitoring and control of file transfers without needing direct access to the physical USB device or system extensions, working within macOS security constraints.
3Reliability
If file labels and content filters are used to prevent exfiltration, then data protection is improved, but system complexity increases and malicious users can bypass by altering labels or obscuring content
Solution Approach 1:
The supervisory application acts as an intermediary that intercepts file save operations before they reach the USB device. This mediator approach simplifies the system by providing a single centralized control point rather than requiring complex distributed filtering across multiple applications and files.
Solution Approach 2:
By creating a virtual copy of the storage device interface, the system can monitor all file transfer attempts uniformly without needing to analyze individual file contents or labels. This copying approach provides a simpler, more robust solution that cannot be bypassed by label alteration or content obfuscation.
Data Source
AI summary
Described herein is a data carrier storing program code for causing one or more processors of a data processing system to perform the following steps to control access to a demountable storage device: issue a command to the system to prevent the mounting of at least some demountable storage devices so as to be accessible to applications comprised in a set of user space applications running on the data processing system; establish a software entity for controlling access to a demountable storage device; detect the coupling of the demountable storage device to the data processing system, and cause the demountable storage device to be mounted such that it is accessible by the software entity but not by the applications comprised in the set of user space applications running on the data processing system; issue a command to the system to advertise to one or more of the applications comprised in the set of user space applications running on the data processing system the software entity as a means of accessing a simulated storage device; receive from a user space application of the one or more of the applications comprised in the set of use space applications a request to access the simulated storage device; apply one or more predefined criteria to determine whether to block the request; and if the request is determined to be not blocked, execute by means of the software entity an access to the demountable storage device.