Access Control Lists for Operating System Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern application control systems, particularly in Windows OS versions like 10, face challenges due to inaccessible information needed for access rule decisions, which hinders efficient access control when switching between user mode and kernel mode, leading to time-consuming operations.
Innovation Solution
The implementation of a computer-implemented method using access control lists (ACLs) to generate and apply ACLs based on access rules, determining categories of objects, and intercepting user requests to decide on access permissions, allowing or denying access efficiently without mode switching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the application control system switches between user mode and kernel mode to access necessary information for access control decisions, then the system can obtain required information (such as electronic digital signature) for making access decisions, but the operation time increases significantly due to the mode switching overhead
Solution Approach 1:
The system performs preliminary actions by creating access control lists (ACLs) in advance during system initialization or policy definition phases. These ACLs contain pre-processed access control decisions and mappings between object categories and security attributes. When an access request occurs, the kernel-mode component can directly apply these pre-computed ACLs without needing to switch to user mode to retrieve or process access rules, thereby eliminating mode switching overhead while maintaining accurate access control decisions.
2Adaptability or versatility
If the system uses complex access rules that consider multiple attributes (such as access token and object attributes) to make access decisions, then the access control becomes more flexible and accurate, but the system complexity increases and requires more extensive information processing
Solution Approach 1:
The system segments the access control functionality into distinct components: (1) policy definition component that creates access rules in user mode, (2) ACL generation component that translates access rules into ACLs, and (3) ACL application component that enforces access decisions in kernel mode. This segmentation allows each component to operate independently with well-defined interfaces, reducing system complexity while maintaining flexible access control capabilities. The ACL structure itself segments access control information into object-category-based groups, making it easier to process and apply.
Solution Approach 2:
The access control list (ACL) serves as an intermediary data structure between the complex access rules and the simple access decision-making process. The ACL translates multi-attribute access rules into a standardized format that maps object categories to access permissions. This intermediary representation simplifies the kernel-mode access decision process while preserving the flexibility and complexity of the original access rules, allowing the system to handle complex policies without requiring complex real-time processing in the critical access path.
Data Source
AI summary
Disclosed are systems and method for controlling access to objects of an operating system using Access Control Lists (ACLs). An exemplary method comprises: generating, by a processor, one or more ACLs for objects of the operating system based on at least one access rule specifying the access mode to the object of the operating system to one or more users based on the one or more categories to which the objects belongs; intercepting a request from a user to access an object of the operating system; determining, by the processor, one or more ACLs associated with the requested object; and applying, by the processor, the determined one or more ACLs to decide whether to allow or deny access of the user to the requested object, wherein if one of the applied ACLs denies access to the object, the access will be blocked, otherwise the access will be allowed.