Channel-Based Mandatory Access Control in Message-Based OS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Message-based operating systems face security vulnerabilities due to inadequate enforcement of mandatory access control, allowing malicious or unintended messages to be communicated over unprotected channels, potentially leading to security breaches.
Innovation Solution
Implementing a system with a channel manager that identifies processes and communication channels, applies access rules based on a channel policy to control access, and enforces mandatory access control within the kernel of a message-based operating system to protect communication channels and processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mandatory access control is not enforced in message-based operating systems, then communication between processes is simple and efficient, but security vulnerabilities arise allowing unauthorized access to communication channels
Solution Approach 1:
The patent applies preliminary action by establishing access rules and channel policies before communication occurs. The kernel configures communication channels with specific access control rules that are enforced prior to any message transmission, preventing unauthorized access before security breaches can occur.
Solution Approach 2:
The patent introduces an intermediary mechanism in the kernel that mediates all communication channel access. This intermediary enforces access rules by filtering and controlling messages between processes, adding a layer of security management that prevents direct unauthorized access while maintaining controlled communication.
2Reliability
If access rules are enforced for all communication channels, then unauthorized access is prevented, but system complexity and overhead increase
Solution Approach 1:
The patent applies local quality by configuring access rules specific to each communication channel rather than applying uniform access control across all channels. Each channel can have tailored access rules based on its security requirements, allowing efficient communication on less sensitive channels while maintaining strict security where needed.
Solution Approach 2:
The patent changes parameters by implementing configurable access control rules that can be adjusted based on communication needs. The system allows dynamic configuration of channel policies and access rules, enabling optimization of security levels and communication efficiency for different scenarios without compromising overall system security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for enforcing mandatory access control in a message-based operating system are provided. Calls to operating system logic may be passed as messages over communication channels in a message-based operating system. A first process configured to receive a message via a communication channel in a message-based operation system may be identified. In addition, the communication channel may be identified. Further, an access rule may be identified. The access rule may be a rule to govern access to the communication channel. The access to the communication channel by the second process may be controlled based on the access rule. The access may be controlled in a kernel of a message-based operating system. The second process may be configured to execute invocation logic. The invocation logic may be executable to send the message via the communication channel.