Centralized Policy Access Control for Malware Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security techniques inadequately protect application programs and operating systems from malicious software by granting excessive access rights to processes, allowing malware to exploit code defects and inherit unnecessary permissions, leading to potential system damage or disruption.
Innovation Solution
A software facility is introduced that adds a logic-driven access control layer to the operating system, utilizing a centralized policy store to authorize resource access based on the identity of principals and dynamically configurable environment parameters, assessing security risk, and implementing tiered access control to restrict permissions only to necessary resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional access control security systems grant all programs running in user context permission to access all user resources, then user resource accessibility is improved, but system security deteriorates due to excessive permissions being inherited by malware
Solution Approach 1:
The patent segments access permissions by creating distinct permission sets for different processes rather than granting blanket access. The system evaluates each process individually and assigns only the minimum necessary permissions required for that specific process to function, preventing malware from inheriting excessive permissions while maintaining user resource accessibility for legitimate processes.
Solution Approach 2:
The patent applies local quality by tailoring access permissions to each specific process's needs rather than applying a uniform permission policy. The system analyzes individual process requirements and grants permissions locally optimized for each process, ensuring that only necessary resources are accessible to each process while maintaining overall system security.
2Adaptability or versatility
If access control evaluates permissions at the time of resource access, then flexibility in resource access is improved, but security risk increases because malware can exploit code defects to gain excessive permissions
Solution Approach 1:
The patent implements preliminary action by evaluating and assigning permissions to processes before they access resources. The system performs security assessments and grants appropriate permissions in advance based on process identity and requirements, rather than at the moment of access. This prevents malware from exploiting code defects to dynamically gain excessive permissions while maintaining flexible access control for legitimate processes.
3Device complexity
If all processes running in user context are given the same access rights, then implementation simplicity is improved, but security precision deteriorates because permissions cannot be restricted to necessary resources
Solution Approach 1:
The patent applies dynamics by making access permissions dynamic rather than static. The system continuously evaluates process identity, behavior, and requirements to adjust permissions appropriately. This dynamic approach enables fine-grained permission control that adapts to each process's actual needs while maintaining manageable system complexity through automated evaluation mechanisms.
Data Source
AI summary
A facility for performing an access control check is provided. The facility receives a request to perform an access control check to determine whether authorization exists to access a resource. The access control check is performed against the identity of a principal, a policy that applies to the principal, and the identity of the resource the principal wants to access. The principal may either be an application program or a combination of an application program and an identity of a user in whose context the application program is executing.