Agent Command Permission Mapping for Fine-Grained Endpoint Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems face challenges in providing fine-grained access to system commands, leading to potential insider threat risks and inefficiencies due to users being granted access to entire groups of commands rather than specific commands needed for their roles, resulting in unnecessary computational overhead.
Innovation Solution
Implementing a system that assigns individual agent application commands to permission levels rather than user types, allowing users to execute specific commands based on permission levels, thereby minimizing insider threat risks and reducing computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users are granted access to entire groups of commands based on user types, then ease of operation is improved, but security and resource efficiency deteriorate due to insider threat risks and unnecessary computational overhead
Solution Approach 1:
The patent segments command groups into individual commands with separate permission levels. Instead of granting users access to entire command groups based on user types, the system evaluates each command individually against the user's permission level, allowing precise control over which specific commands a user can execute.
Solution Approach 2:
The patent applies different access control policies to different commands based on their specific security requirements. Each command is assigned a permission level that matches its sensitivity and risk profile, allowing the system to apply appropriate security measures locally to each command rather than uniformly to all commands in a group.
2Ease of operation
If users are granted access to entire groups of commands based on user types, then ease of operation is improved, but computational overhead increases due to unnecessary command group processing
Solution Approach 1:
The patent extracts the permission level evaluation from the user type framework and applies it directly to individual commands. This eliminates the need to process entire command groups and their associated user type permissions, reducing computational overhead by evaluating only the specific command's permission level against the user's level.
Solution Approach 2:
The patent segments the command group processing into individual command evaluations. Instead of processing the entire command group as a unit based on user type, the system evaluates each command separately, processing only the necessary permission check for the specific command being executed.
3Reliability
If individual command access control is implemented, then security and resource efficiency are improved, but device complexity increases due to permission level mapping requirements
Solution Approach 1:
The patent creates a universal permission level framework that can be applied to any command in the agent application. The permission level mapping system serves multiple functions: it controls access to individual commands, evaluates user authorization, and enforces security policies across the entire system through a single unified mechanism.
Data Source
AI summary
The present disclosure provides techniques for fine-grained access to system commands run via an installed agent application. A processing device receives, from an agent application, a user identifier and an indication of an agent application command with respect to a target endpoint, wherein the agent application command is included in a plurality of agent application commands assigned to a first user type that is different from a second user type corresponding to the user identifier. The processing device maps the agent application command to a permission level assigned to the agent application command. The processing device determines, based on the mapping, that the permission level is assigned to the user identifier. The processing device enables, based on the determination, the agent application to execute the agent application command with respect to the target endpoint.