Untrusted Code Isolation via File System Segmentation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for testing untrusted code, such as those using virtual machines, are not applicable to systems that do not support virtualization, like ARM-based devices, and cannot fully abstract hardware features like Data Execution Prevention, necessitating a solution for running tests directly on physical systems without virtual machine abstraction.

Innovation Solution

A processing platform utilizing two file systems, one safe and one unsafe, with a file protection mechanism to ensure isolation, where the unsafe OS is used for testing and then restored to its clean state, avoiding the need for reinstalling the OS and accommodating systems that cannot use virtual machines.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If virtual machines are used to test untrusted code, then isolation guarantees are provided, but the solution is not applicable to systems that do not support virtualization (e.g., ARM-based devices)

Engineering Contradiction:
Improveisolation guaranteesVSAvoidapplicability to non-virtualized systems
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent creates a copy of the unsafe operating system in a protected file system, allowing the test environment to be replicated without requiring virtualization hardware. The unsafe OS is copied into an isolated file system context where it can execute untrusted code while the host system remains protected.

Inventive Principle:
Principle #26Copying

Solution Approach 2:

The patent introduces a file protection mechanism as an intermediary layer between the unsafe OS and the host system. This intermediary enforces isolation rules at the file system level, providing VM-like protection without requiring virtualization support.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Adaptability or versatility

If virtual machines are used to abstract hardware features, then hardware features can be abstracted, but hardware features like Data Execution Prevention cannot be fully abstracted

Engineering Contradiction:
Improvehardware feature abstractionVSAvoidhardware feature protection
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent extracts the isolation functionality from the virtualization layer and places it directly at the file system level. By taking out the virtualization dependency, the solution works on systems without virtualization support while maintaining protection of hardware features through file system-level controls.

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If the unsafe OS is restored by reinstalling from scratch, then the clean state is recovered, but the operation is costly in terms of time and resources

Engineering Contradiction:
Improveclean state recoveryVSAvoidOS reinstallation time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary actions by creating a protected copy of the unsafe OS in isolation before testing begins. The file system is prepared with the unsafe OS in advance, so that after testing, the system can simply revert to the pre-prepared clean state without time-consuming reinstallation.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent implements a mechanism where the unsafe OS state is discarded after testing and the original clean state is recovered. The file protection mechanism allows the system to discard the contaminated file system state and recover the clean state efficiently without full reinstallation.

Inventive Principle:
Principle #34Discarding and recovering

4Productivity

If the unsafe OS runs directly on physical system resources, then testing can be performed, but the system can be compromised by malicious code

Engineering Contradiction:
Improvetesting capabilityVSAvoidsystem compromise risk
Core Design Contradiction:
ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the file system into protected and unprotected portions. The unsafe OS runs in an isolated file system segment that is protected from affecting the host system, allowing productive testing while preventing system compromise through file-level segmentation.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentEP3005090B1Framework for running untrusted code
Publication Date: 2018.11.14 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP3005090B1 patent drawingFigure 1
  • EP3005090B1 patent drawingFigure 2
  • EP3005090B1 patent drawingFigure 3

AI summary

A processing platform is described herein for performing a task on a physical system. For example, the task may entail testing untrusted code on the physical system. The processing platform provides the same isolation guarantees as a virtual machine, but without using a virtual machine. A processing framework is also described herein which includes two or more processing platforms, together with a control system for administering the operations performed by the processing platforms.