Fine-Grained API Privilege Elevation to Reduce UAC Attack Surface
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Microsoft Windows elevation model provides coarse control over privilege elevation, leading to a broader attack surface and insufficient fine-grained management of privilege levels for processes, which can be exploited by malware or unauthorized access.
Innovation Solution
A Privilege Manager Agent injects a dynamic library into the AppInfo service to manage Win32 API function calls, allowing selective elevation or restriction of privilege levels based on policy settings, creating customized access tokens and using thread-level impersonation to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If coarse-grained privilege elevation control is used (traditional UAC model), then ease of operation is improved, but security is worsened due to broader attack surface
Solution Approach 1:
The patent segments the coarse-grained process-level privilege control into fine-grained function-call-level control. By inserting a dynamic library into the AppInfo service, the system divides privilege management into individual Win32 API function calls, allowing each call to be evaluated and controlled separately based on policy settings, thereby reducing the attack surface while maintaining ease of operation.
Solution Approach 2:
The patent applies local quality by allowing different privilege levels for different function calls within the same process. Instead of uniformly elevating or restricting entire processes, the system selectively applies privilege elevation or restriction to specific Win32 API function calls based on their security requirements, creating customized access tokens for each controlled call.
2Object-affected harmful factors
If fine-grained privilege control is implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a dynamic library injected into the AppInfo service. This intermediary intercepts Win32 API function calls, evaluates them against policy settings, and manages privilege elevation/restriction automatically. This intermediary handles the complexity of fine-grained control, preventing it from propagating to the overall system architecture.
Solution Approach 2:
The patent creates customized access tokens (copies of the original token) with specific privilege levels for each controlled function call. Instead of modifying the original process token, the system generates temporary token copies tailored to the security requirements of individual API calls, reducing the complexity of managing permanent privilege changes.
3Object-affected harmful factors
If processes run with restricted privileges, then security is improved, but adaptability is worsened due to limited access to system resources
Solution Approach 1:
The patent implements dynamic privilege management where the privilege level of a process thread is adjusted in real-time based on the specific Win32 API function being called. The system dynamically evaluates each function call against policy settings and temporarily elevates or restricts privileges as needed, allowing processes to adapt to different security requirements without permanently sacrificing access capability.
Solution Approach 2:
The patent changes the privilege level parameter of process threads on-demand for specific function calls. By modifying the access token parameters temporarily during controlled API calls and then restoring them, the system enables processes to access system resources when necessary while maintaining restricted privileges otherwise, balancing security with adaptability.
Data Source
AI summary
A method for implementing a privilege management agent in an operating system having User Account Control (UAC), the privilege management agent having pre-defined application control policies and an application control service (ACS). The privilege management agent is used to process elevation requests to provide an access token to allow a process running under a user account to run as an elevated process based on the pre-defined process access policies. The method includes intercepting an elevation request from a process having a primary access token provided by the UAC after a user launches a process that requires elevation, tagging the process for possible elevation. The ACS evaluates the tagged process and pre-defined process access policies for a match which corresponds to the elevation request. If found, the ACS applies a customized access token to elevate the process to run with elevated rights, otherwise the process is terminated.