Removable Media USB-ARM Kernel Filter Driver
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The distribution of malware through removable storage devices, such as USB flash media, poses a significant threat to network security, as existing methods either restrict device usage or interfere with productivity, and current anti-virus scanning methods are inefficient in preventing zero-day attacks and auto-run malware execution.
Innovation Solution
The Architecture for Removable Media (ARM) system, which isolates and scans removable media using one or more anti-virus engines, blocks access until scanning is complete, and employs a kernel filter driver to grant access only to cleared files, preventing execution of malicious software and eliminating race conditions between security software and auto-run functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If organizations seal USB drives to prevent media insertion, then network security is improved, but user productivity and convenience deteriorate
Solution Approach 1:
The patent introduces an intermediary scanning system that sits between the USB drive and the host computer. The media is first scanned by security software to detect malware, and only after successful scanning is the media granted access to the host system. This intermediary process maintains security while enabling legitimate productivity use, resolving the contradiction between security and convenience.
2Reliability
If media is scanned by a security consultant before use, then malware detection is improved, but user productivity and convenience deteriorate
Solution Approach 1:
The system implements self-service security scanning where the host computer automatically scans the removable media upon insertion, without requiring manual intervention from security consultants. The scanning process is transparent to users and occurs in the background, maintaining both high security and user productivity.
3Reliability
If anti-virus scanning is performed on removable media, then malware detection is improved, but access time and productivity deteriorate due to scanning delays
Solution Approach 1:
The system performs preliminary scanning actions automatically as soon as media is inserted, before the user needs to access files. By initiating the scanning process immediately and in the background, the system prepares the media for access in advance, reducing the perceived wait time for users while maintaining thorough security checks.
4Ease of operation
If operating system auto-run functionality is enabled, then ease of operation is improved, but malware execution risk increases
Solution Approach 1:
The system applies preliminary anti-action by blocking the auto-run functionality before malware can execute. The scanning system intercepts and prevents automatic execution of suspicious files, while still allowing users to manually open files after they have been scanned and approved. This approach maintains ease of operation for legitimate files while preventing malware execution.
Data Source
AI summary
A storage device is coupled to a computing system comprising an operating system and application software. Access to the storage device is blocked by a kernel filter driver, except exclusive access is granted to a first anti-virus engine. The first anti-virus engine is directed to scan the storage device for malicious software and report results. Exclusive access may be granted to one or more other anti-virus engines and they may be directed to scan the storage device and report results. Approval of all or a portion of the information on the storage device is based on the results from the first anti-virus engine and the other anti-virus engines. The storage device is presented to the operating system and access is granted to the approved information. The operating system may be a Microsoft Windows operating system. The kernel filter driver and usage of anti-virus engines may be configurable by a user.