System and method to secure a computer system by selective control of write access to a data storage medium

What is this patent about?

’661 is related to the field of computer security and malware prevention, specifically focusing on protecting mass storage devices from unauthorized data writes. Traditional antivirus solutions often rely on reactive scanning, identifying malicious code only after it has already infected the operating system or matched a known signature. This invention addresses the need for a proactive defense mechanism that intercepts write operations at the system level to prevent the initial saving of harmful code, such as viruses or Trojans, onto a hard drive.

The underlying idea behind ’661 is to shift security from signature-based detection to a strict permission-based gatekeeper model that operates within the operating system's kernel. Instead of trying to recognize what a file is, the system focuses on what an application is allowed to do. By monitoring write requests in real-time, the system can block any application that does not have explicit authorization to modify the storage medium, effectively creating a sandbox environment where only trusted, verified processes can commit data to the disk.

The claims of ’661 focus on a method and system that utilizes a kernel-mode interceptor to monitor file system access and enforce write privileges. The independent claims specify that when an application attempts to write data, the system pends the operation and interrogates a rules database to retrieve a permission value associated with that specific application. This control mechanism is designed to be granular, allowing or denying access based on the application's identity, the specific file type being written, or even a digital signature to ensure the application hasn't been tampered with.

In practice, the invention functions by categorizing applications into different access levels, ranging from full access to restricted access based on file extensions or specific directories. If an application is not found in the database, the system can prompt the user for a decision, which is then saved to the rules database for future use. To ensure the integrity of the process, the system can perform content inspection to verify that a file's internal structure matches its extension, preventing attackers from disguising executable payloads as harmless data files like images.

This approach differs from prior art by decoupling write permissions from standard directory-level privileges and moving the enforcement into the kernel mode, where it is harder for malware to bypass. Furthermore, the system incorporates a social or centralized aspect where user responses to unknown applications are collected and shared via a central server. This collective intelligence allows the rules database to be updated dynamically across a network of computers, providing a rapid, community-driven defense against zero-day threats that have not yet been cataloged by traditional antivirus vendors.