Application-Layer Command Validation With Policy-Based Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in ensuring secure and efficient command content validation, particularly in edge systems, which can impact reliability and security due to the need for robust root of trust, reliable component verification, and traceability.
Innovation Solution
Implementing command content validation on the application object layer through intercepting commands, comparing them to predefined policies, and allowing or disallowing actions based on these policies, using a command content validation module that identifies and validates API calls and syntax against a policy database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If command content validation is implemented by intercepting and comparing commands to policies, then security and reliability are improved, but system complexity and processing time increase
Solution Approach 1:
The patent applies preliminary action by establishing policy definitions and validation rules before command execution. The system pre-configures allowed and disallowed command content patterns, so that during runtime, commands are simply compared against these pre-established policies rather than analyzing security implications from scratch each time. This reduces both complexity and processing time while maintaining reliability.
Solution Approach 2:
The patent introduces an intermediary validation layer between command issuance and execution. This intermediary component intercepts commands, compares them against policy definitions, and determines whether to allow or block execution. By inserting this mediator layer, the system achieves comprehensive security validation without requiring complex integration into each individual command processing path.
2Reliability
If comprehensive policy checking is performed on all commands, then security is improved, but processing speed and efficiency deteriorate
Solution Approach 1:
The patent applies partial action by implementing selective policy validation. Rather than performing exhaustive checks on every single command parameter, the system validates against defined policy patterns and rules that capture the essential security requirements. This approach provides sufficient security validation without the overhead of examining every detail of each command, thus maintaining processing speed while improving security.
3Object-affected harmful factors
If command validation is implemented at the application object layer, then security against malicious commands is improved, but system complexity increases
Solution Approach 1:
The patent extracts the validation logic from the core application object layer and implements it as a separate, dedicated validation mechanism. By taking out the security validation functionality from the main application logic, the system can provide comprehensive security checking without embedding complex validation code throughout the application layer. This separation reduces the complexity burden on the application objects themselves while still providing robust protection against malicious commands.
Data Source
AI summary
Systems and methods support command content validation. During runtime of an application, a command content validator may intercept a first command directed to a first software component, wherein the application includes a plurality of software components; compare the first command to a stored set of policies, wherein the set of policies sets out either or both of allowed command content and disallowed command content; determine that the first command is allowed based on the set of policies; and allow or disallow a first requested action of the first command to be performed.