Authority Determination Module for Secure Device Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic devices face issues with unauthorized access and malicious use of device resources due to vulnerabilities in their database management systems, which can be exploited through rooting or framework changes, leading to potential misuse when the device is lost or stolen.
Innovation Solution
Implementing a multi-region authority management system using a hypervisor (EL2), secure EL2, or virtual machine manager (VMM) to determine and control access to device resources based on predefined authority policies, ensuring secure and restricted access through a third authority level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a database is used to manage authority of access to device resources through a framework, then device resources can be accessed and controlled, but the database can be easily accessed or forged by malicious use such as rooting or framework changing, leading to security vulnerabilities
Solution Approach 1:
The patent segments the authority management system into multiple components: an authority database for storing access policies, an authority determination module for evaluating requests, and a region execution system for enforcing decisions. This segmentation isolates the critical authority database from direct access, protecting it while maintaining operational efficiency through dedicated determination and enforcement modules.
Solution Approach 2:
The patent introduces an authority determination module as an intermediary between resource access requests and the authority database. This mediator evaluates access requests against stored policies without exposing the database directly, preventing malicious access while enabling controlled resource management through policy-based decision-making.
2Adaptability or versatility
If the electronic device allows framework changes or rooting, then system adaptability and customization are improved, but the authority database becomes vulnerable to forgery and malicious use
Solution Approach 1:
The patent implements preliminary anti-action by pre-configuring an authority determination module that evaluates access requests before they reach the authority database. This preemptive security mechanism checks for malicious intent or unauthorized operations (such as rooting attempts) and blocks them in advance, allowing system customization while preventing harmful modifications to the authority structure.
Solution Approach 2:
The patent performs preliminary action by establishing authority policies and determination rules before any resource access occurs. The authority determination module is pre-loaded with security criteria that automatically evaluate and prevent malicious operations, enabling the system to adapt to user needs while maintaining inherent protection against framework exploitation.
3Reliability
If strict access controls are enforced through a third authority region, then device resource security is improved, but system complexity increases due to multi-region architecture
Solution Approach 1:
The patent applies universality by designing the authority determination module to handle multiple functions within a single component: policy evaluation, access decision-making, and enforcement coordination. The region execution system similarly performs multiple roles including isolation management and security verification. This multi-functionality reduces the number of separate components needed, lowering overall system complexity while maintaining strong security through centralized authority management.
Data Source
AI summary
An electronic device, and an operation method thereof, are disclosed. The electronic device may include a memory; and a processor configured to execute at least one operating system executed in a first region allowing an operation based on a first authority; execute at least one application executed in a second region allowing an operation based on a second authority; receive a first authority policy from a server; obtain a second authority policy from the at least one application; and in response to detection of access to at least one device resource by the at least one application, configure authority of access to the at least one device resource, according to a third authority policy based on the first authority policy and the second authority policy, by using an authority determination module executed in a third region allowing an operation based on a third authority.