Untrusted Code Isolation via File System Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for testing untrusted code, such as those using virtual machines, are not applicable to systems that do not support virtualization, like ARM-based devices, and cannot fully abstract hardware features like Data Execution Prevention, necessitating a solution for running tests directly on physical systems without virtual machine abstraction.
Innovation Solution
A processing platform utilizing two file systems, one safe and one unsafe, with a file protection mechanism to ensure isolation, where the unsafe OS is used for testing and then restored to its clean state, avoiding the need for reinstalling the OS and accommodating systems that cannot use virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are used to test untrusted code, then isolation guarantees are provided, but the solution is not applicable to systems that do not support virtualization (e.g., ARM-based devices)
Solution Approach 1:
The patent creates a copy of the unsafe operating system in a protected file system, allowing the test environment to be replicated without requiring virtualization hardware. The unsafe OS is copied into an isolated file system context where it can execute untrusted code while the host system remains protected.
Solution Approach 2:
The patent introduces a file protection mechanism as an intermediary layer between the unsafe OS and the host system. This intermediary enforces isolation rules at the file system level, providing VM-like protection without requiring virtualization support.
2Adaptability or versatility
If virtual machines are used to abstract hardware features, then hardware features can be abstracted, but hardware features like Data Execution Prevention cannot be fully abstracted
Solution Approach 1:
The patent extracts the isolation functionality from the virtualization layer and places it directly at the file system level. By taking out the virtualization dependency, the solution works on systems without virtualization support while maintaining protection of hardware features through file system-level controls.
3Reliability
If the unsafe OS is restored by reinstalling from scratch, then the clean state is recovered, but the operation is costly in terms of time and resources
Solution Approach 1:
The patent performs preliminary actions by creating a protected copy of the unsafe OS in isolation before testing begins. The file system is prepared with the unsafe OS in advance, so that after testing, the system can simply revert to the pre-prepared clean state without time-consuming reinstallation.
Solution Approach 2:
The patent implements a mechanism where the unsafe OS state is discarded after testing and the original clean state is recovered. The file protection mechanism allows the system to discard the contaminated file system state and recover the clean state efficiently without full reinstallation.
4Productivity
If the unsafe OS runs directly on physical system resources, then testing can be performed, but the system can be compromised by malicious code
Solution Approach 1:
The patent segments the file system into protected and unprotected portions. The unsafe OS runs in an isolated file system segment that is protected from affecting the host system, allowing productive testing while preventing system compromise through file-level segmentation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A processing platform is described herein for performing a task on a physical system. For example, the task may entail testing untrusted code on the physical system. The processing platform provides the same isolation guarantees as a virtual machine, but without using a virtual machine. A processing framework is also described herein which includes two or more processing platforms, together with a control system for administering the operations performed by the processing platforms.