Storage Drive Lock Logic for OS Integrity

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current anti-virus solutions are ineffective against stealthy malware, particularly Ring 0 rootkits that can hide deep within the operating system and disrupt their functioning by providing incorrect information.

Innovation Solution

Implementing a storage drive with lock logic that secures core operating system modules in locked memory blocks, only modifiable with a valid key or password, and utilizing a quarantine module to divert unauthorized changes to a quarantine area for later evaluation, ensuring that critical OS assets remain protected and the system operates without significant impairment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional anti-virus solutions are used to detect malware, then they can identify common viruses and worms, but they are ineffective against stealthy Ring 0 rootkits that hide deep in the operating system

Engineering Contradiction:
Improvemalware detection effectivenessVSAvoidstealthiness of Ring 0 rootkits
Core Design Contradiction:
ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The storage drive is segmented into multiple independent regions: a locked region for storing critical OS modules and a quarantine region for unauthorized modifications. This segmentation isolates critical assets from potential malware attacks, preventing rootkits from corrupting essential system files while maintaining detection capabilities.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The storage drive acts as an intermediary layer between the operating system and the physical storage medium. By implementing lock logic and quarantine mechanisms within the storage drive itself, it mediates all access to critical OS modules, preventing direct modification by malware while allowing legitimate system operations to proceed normally.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If locked memory blocks are used to protect critical OS modules, then system integrity is maintained, but access and modification of these modules becomes more restricted

Engineering Contradiction:
Improvesystem integrityVSAvoidaccessibility of OS modules
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The storage drive performs self-service by automatically managing the locking and unlocking of memory blocks containing critical OS modules. The lock logic within the storage drive autonomously controls access based on predefined security policies, eliminating the need for manual intervention while maintaining system integrity and enabling legitimate access when required.

Inventive Principle:
Principle #25Self-service

3Adaptability or versatility

If unauthorized changes are allowed to proceed normally, then system flexibility is maintained, but malware can corrupt critical OS components

Engineering Contradiction:
Improvesystem flexibilityVSAvoidmalware corruption risk
Core Design Contradiction:
Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The quarantine region converts the harmful effect of unauthorized modifications into a beneficial security feature. Instead of allowing malware to corrupt critical OS components, unauthorized changes are automatically diverted to the quarantine region where they cannot cause harm. This transforms potential system damage into an isolated containment area for analysis and evaluation.

Inventive Principle:
Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentEP2652666B1Storage drive based antimalware methods and apparatuses
Publication Date: 2018.11.14 INTEL CORP
  • EP2652666B1 patent drawingFigure 1
  • EP2652666B1 patent drawingFigure 2
  • EP2652666B1 patent drawingFigure 3

AI summary

An anti-malware approach uses a storage drive with the capability to lock selected memory areas. Platform assets such as OS objects are stored in the locked areas and thus, unauthorized changes to them may not be made by an anti-malware entity.