Admin-Privilege App Installation Across Secure and Standard OS Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure platforms, such as UWP applications, struggle to execute administrator authority requiring processes without appropriate execution control, especially when operating from non-administrator accounts.
Innovation Solution
An information processing apparatus and method that allows execution of administrator authority requiring processes by installing and activating a client application B, even from non-administrator accounts, through an authority promotion process using a secure platform application and client application A, ensuring appropriate execution regardless of account authority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure platform (UWP application) is used to ensure system safety and control application execution, then system security and stability are improved, but the ability to execute administrator authority requiring processes is restricted
Solution Approach 1:
The system is segmented into multiple application types (UWP applications for secure execution, Win32 applications for administrator authority requiring processes) and account types (standard account, administrator account). This segmentation allows each component to operate within its appropriate security context while maintaining overall system security.
Solution Approach 2:
A Win32 application acts as an intermediary between the UWP application and the system resources requiring administrator authority. The UWP application can request the Win32 application to execute administrator authority requiring processes on its behalf, enabling secure applications to perform privileged operations without compromising system security.
2Ease of operation
If administrator authority requiring processes are enabled for non-administrator accounts, then ease of operation is improved, but system security control is weakened
Solution Approach 1:
The system dynamically adjusts authority allocation based on the executing application type and account credentials. Non-administrator accounts can execute standard UWP applications without elevated privileges, while administrator authority is dynamically granted only when a Win32 application explicitly requests it and the user provides administrator credentials through UAC prompt.
Solution Approach 2:
Different authority levels are assigned to different applications and operations. UWP applications run with restricted privileges for security, while Win32 applications can obtain elevated privileges when needed. This local quality approach ensures that administrator authority is applied only where necessary rather than system-wide.
3Reliability
If the system checks account authority type before execution, then security control is improved, but processing time and complexity increase
Solution Approach 1:
The system performs preliminary classification of applications into UWP and Win32 types during installation and configuration. This preliminary action allows the system to pre-determine which application type can execute which processes, reducing the need for repeated authority verification during execution and minimizing time loss.
Data Source
AI summary
A method for controlling an information processing apparatus having an OS, capable of appropriately executing a process related to a program for executing an administrator authority requiring process. The method comprising: when receiving an operation from a predetermined account in a predetermined OS environment, executing a first process for installing a first program regardless whether the predetermined account is an administrator account or a non-administrator account; when receiving an operation from the predetermined account in an OS environment which is not the predetermined OS environment, executing a second process for activating a third program for installing a second program regardless whether the predetermined account is the administrator account or the non-administrator account; and executing a third process for installing the second program when the third program is activated and execution of an administrator authority requiring process is permitted.