Application Network Access Control via Security Labels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively control network access by applications based on their security levels, especially when applications use network service functions provided by the operating system, leading to difficulties in determining the origin of network access and potential omissions in monitoring.
Innovation Solution
A system and method that monitor and control network access requests from applications using a service provision unit and direct network access, based on assigned security levels, through first and second monitoring units and access control units, ensuring accurate access control regardless of the access method.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a firewall is used to check network access immediately before access is sent to the network, then network access control can be performed, but the firewall cannot determine from which application the network access originated when the operating system executes the network access, making it difficult to perform access control according to the application's label
Solution Approach 1:
The system performs preliminary action by assigning security labels to applications in advance and establishing access control rules before network access occurs. The access control unit retrieves and applies these pre-defined labels and rules when monitoring network access requests, enabling precise identification of application origins without adding complex real-time analysis mechanisms.
Solution Approach 2:
The access control unit acts as an intermediary between the application and the network. It intercepts network access requests, identifies the originating application, retrieves the appropriate security label, and determines whether to permit or block access based on pre-established rules. This intermediary mechanism enables precise application identification without requiring the firewall itself to perform complex application analysis.
2Reliability
If a hook of system call is used to check network service function when called by application, then monitoring can be performed at the call timing, but the monitoring target is limited to a specific application to which a hook is set, causing omission of applications during monitoring
Solution Approach 1:
The access control unit implements a universal monitoring mechanism that functions for all applications regardless of whether hooks are set. Instead of requiring individual hook configurations for each application, the system uses a single access control unit that retrieves security labels for any application attempting network access, making the monitoring system universally applicable and eliminating omissions.
Solution Approach 2:
Security labels are assigned to applications in advance through preliminary action. When network access is attempted, the access control unit simply retrieves the pre-assigned label and applies the corresponding access control rule. This eliminates the need for complex real-time hook management and ensures no applications are omitted from monitoring.
3Ease of operation
If multi-level security system assigns labels to applications and controls access based on assigned labels, then access control according to security level can be achieved, but existing systems fail to effectively control network access when applications use network service functions provided by operating system
Solution Approach 1:
The system implements self-service by having applications automatically associated with their security labels without requiring manual configuration during access. The access control unit autonomously retrieves the appropriate security label for each application attempting network access and applies the corresponding rules, making the system both easy to operate and reliable in controlling network access.
Solution Approach 2:
The access control unit implements feedback by continuously monitoring network access requests, retrieving the security labels of originating applications, and adjusting access decisions based on the label information and pre-established rules. This feedback mechanism ensures that network access control remains effective even when applications use operating system network service functions.
Data Source
AI summary
Provided are first monitoring unit 106a for monitoring whether service provision unit 102 has been called by an application, second monitoring unit 107a for monitoring whether a network access request is sent to a network, first access control unit 106b for controlling the network access request of the call detected by the first monitoring unit 106a, based on a security level assigned to the application program that has called the service provision unit, and second access control unit 107b for determining whether the first access control unit 106b has already performed access control on the network access request detected to have been sent by the second monitoring unit 107a, and, if the access control has been performed, controlling the network access request based on a security level assigned to the application program that has sent this network access request.