Application-Level Access Control via Whitelist Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional operating systems lack the ability to provide fine-grained access control for applications, where users can have varying levels of access depending on the specific application, rather than being restricted to general administrative or limited user rights.
Innovation Solution
A method and apparatus for authenticating users and authorizing access to applications based on user identity, group membership, and blacklist/whitelist configurations, allowing for application-level control by determining if a user is authorized to execute a specific application before granting access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional administrative or limited user rights are used, then system security is maintained, but fine-grained access control for specific applications is lost
Solution Approach 1:
The patent segments the authorization mechanism by introducing application-specific authorization lists (whitelists and blacklists) that operate independently for each application. This allows fine-grained control at the application level while maintaining the overall system security structure, resolving the contradiction between access control granularity and system complexity.
Solution Approach 2:
The patent applies local quality by allowing different authorization rules to be applied to different applications. Each application can have its own whitelist or blacklist configuration, enabling tailored access control policies for specific applications without affecting the entire system, thus achieving fine-grained control without proportionally increasing overall complexity.
2Adaptability or versatility
If administrative rights are granted to users, then access to all applications is enabled, but control over specific application access is lost
Solution Approach 1:
The patent implements preliminary action by pre-configuring authorization lists (whitelists and blacklists) for each application before users attempt to access them. This allows administrators to establish fine-grained access control rules in advance, making permission management more systematic and easier to operate rather than handling ad-hoc permission requests.
Solution Approach 2:
The patent introduces authorization lists as an intermediary mechanism between users and applications. These lists act as mediators that automatically determine whether a user should be granted or denied access to specific applications, simplifying permission management by replacing complex manual authorization decisions with automated rule-based control.
3Reliability
If limited user rights are assigned, then system security is maintained, but access to specific applications is restricted
Solution Approach 1:
The patent applies dynamics by making user access rights dynamic rather than static. Users can have limited rights in general but automatically gain access to specific applications when those applications are in their whitelist, and lose access when in their blacklist. This dynamic adjustment allows the system to maintain security while adapting access permissions based on application-specific requirements.
Solution Approach 2:
The patent changes the parameter of user access rights from a fixed state (administrative or limited) to a variable state that depends on the application context. By introducing whitelists and blacklists, the system dynamically modifies the effective access rights parameter based on which application the user is attempting to access, enabling both security maintenance and enhanced adaptability.
Data Source
AI summary
A user requests to execute an application. The system authenticates the user and determines whether the user is authorized to execute the application. If the user is both authenticated and authorized to execute the application, the system grants the user permission to execute the application. Otherwise, the system denies the user permission to execute the application.