Adaptive Node Manager for Kernel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Android systems, the existing mechanism for kernel upgrades affects system security as it allows malicious programs to directly access kernel features, compromising system integrity.
Innovation Solution
A method and device for managing kernel nodes using an adaptive node manager with an interface management module and encryption management module, which controls access to feature nodes through a hash table, ensuring only authorized programs can access kernel features, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a node is loaded by using insmod and installed in a /sys/module directory with a preset name, then user-space programs can easily access the kernel feature node, but system security is compromised allowing malicious programs to directly access kernel features
Solution Approach 1:
The patent introduces an adaptive node manager as an intermediary layer between user-space programs and kernel feature nodes. This manager intercepts access requests, performs security verification, and dynamically manages node visibility. The node manager acts as a mediator that prevents direct access while maintaining controlled access for authorized programs, thereby resolving the security vulnerability without completely eliminating access convenience.
Solution Approach 2:
The patent implements dynamic node management where the visibility and accessibility of kernel feature nodes are not fixed but change based on authorization status and system state. Nodes can be dynamically created, hidden, or exposed through the adaptive node manager based on real-time security requirements, transforming the static access model into a dynamic one that adapts to security needs.
2Reliability
If an entire kernel system is replaced during kernel upgrades, then security vulnerabilities can be addressed, but system complexity and upgrade overhead increase
Solution Approach 1:
The patent segments the kernel system into modular components where individual feature nodes can be independently managed, created, and updated. Instead of replacing the entire kernel, specific kernel features are isolated as separate nodes that can be selectively loaded and unloaded. This segmentation allows security vulnerabilities to be addressed by updating or removing specific nodes without affecting the entire kernel system.
Solution Approach 2:
The patent enables selective discarding of vulnerable or unnecessary kernel feature nodes while preserving and recovering the functional integrity of the remaining system. Through the adaptive node manager, problematic nodes can be discarded (removed or hidden) and their functions recovered or replaced through alternative nodes, allowing incremental security improvements without full system replacement.
3Adaptability or versatility
If hardware and software are completely separated with modular policy, then independent upgrade between function modules is achieved, but device complexity increases
Solution Approach 1:
The adaptive node manager serves as a universal management interface that handles multiple kernel feature nodes through a unified mechanism. Rather than requiring separate management systems for each modular component, the node manager provides multi-functional capabilities to create, manage, and control all kernel feature nodes through a single system, reducing the complexity overhead of modularization.
Data Source
AI summary
A method and a device for managing a node includes: initiating, by an application program, a first request by calling an interface function, where the first request is used to perform an operation on a feature node in a kernel; searching, based on a keyword of the interface function, a table used for node management for an entry corresponding to the feature node, where the entry includes a node identifier of the feature node and a user handle identifier of the feature node; and performing, by the user program, the operation on the feature node based on the user handle identifier. A program running in user space can be prevented from directly accessing a feature node in kernel space, thereby improving system security.