Virtual Machine File Processing for Secure Malware Quarantine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions struggle to effectively quarantine and manage potentially malicious files, risking unintentional processing and system exposure due to user interaction or system processes, and face challenges in efficiently handling duplicate files and user restoration requests.
Innovation Solution
Implementing a quarantine mechanism that encrypts potentially malicious files, either in a separate location or 'in place', and processes them within a virtual machine (VM) using hardware isolation to prevent host system interference, along with access control and metadata management to ensure secure handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware software quarantines malicious files by encryption and deletion, then the system is protected from malware execution, but permanent data loss occurs and users cannot restore files without proper privileges
Solution Approach 1:
The patent segments the file handling process into two distinct phases: (1) quarantine phase where the original file is renamed with a .qar extension and moved to a quarantine directory, and (2) processing phase where the quarantined file can be safely analyzed. This segmentation allows the system to protect against malware execution while preserving the original file data for potential restoration or analysis.
Solution Approach 2:
The patent creates a copy of the malicious file in a quarantined state rather than deleting the original. The file is copied to a quarantine directory with restricted permissions, allowing the system to maintain a safe副本 for analysis and user review while preventing execution. This copying approach preserves data while eliminating the security risk.
2Productivity
If the host operating system processes malicious files directly, then file processing is fast and simple, but the system is exposed to malware that can damage or disrupt operations
Solution Approach 1:
The patent introduces a virtual machine as an intermediary environment between the host operating system and the malicious file. The virtual machine provides isolation, allowing the file to be processed safely without exposing the host system to malware. This intermediary approach maintains processing capability while eliminating the security risk.
Solution Approach 2:
The patent moves the file processing from the host operating system dimension to a virtual machine dimension. By creating a separate execution environment, the system can process malicious files without the host OS being affected. This dimensional separation allows safe processing while protecting the main system.
3Reliability
If quarantined files are stored in encrypted form, then security is improved, but users cannot visually identify or manage quarantined files easily
Solution Approach 1:
The patent applies different quality treatments to different parts of the file system: the original file is renamed with a .qar extension to indicate quarantine status, while the quarantined file in the directory maintains its original content but is isolated through permission restrictions. This local quality differentiation allows visual identification through naming while maintaining security through isolation.
Solution Approach 2:
The patent uses file extension changes (.qar suffix) as a visual indicator of quarantine status, analogous to color coding. This allows users to easily identify quarantined files in the file system without needing to decrypt or open them, providing visual feedback while maintaining security.
4Adaptability or versatility
If the system allows user initiation of virtual machine processing, then user control and flexibility are improved, but the complexity of the system increases
Solution Approach 1:
The patent enables users to initiate virtual machine processing themselves through a simple interface. Users can select quarantined files and request processing in the virtual machine environment, giving them direct control without requiring administrator intervention or complex system configurations. This self-service approach simplifies the user experience while maintaining flexibility.
Data Source
AI summary
An example storage medium includes instructions that, when executed, cause a processor of a computing device to encrypt a source file that has been identified as potentially malicious, place the encrypted file in a location accessible to a virtual machine, provide, to the virtual machine, information for decrypting the encrypted file, and cause the virtual machine to use the information to process the encrypted file.