COM Object Privilege Elevation via Intermediary Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems face challenges in implementing a least-privilege access model for COM objects while allowing legitimate processes to execute with higher-level access rights, as users are often granted excessive privileges to ensure application functionality, leading to security risks.
Innovation Solution
A mechanism that intercepts user process requests for COM object creation, determines entitlement, creates COM objects without elevated privileges, and selectively elevates privilege levels for authorized processes, using a combination of client COM handling units and COM handling policies to manage access and privilege reassignment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users are granted high privilege levels (such as local administrator rights) to ensure application functionality, then application operations can execute correctly, but security risks increase due to potential accidental or malicious resource tampering
Solution Approach 1:
The system dynamically adjusts privilege levels based on the specific COM object being accessed. Instead of granting users permanent high-privilege accounts, the system temporarily elevates privileges only when necessary for specific operations, then returns to lower privilege states. This dynamic privilege management allows applications to function correctly when needed while minimizing security exposure during non-critical operations.
Solution Approach 2:
The system applies different privilege levels to different COM objects rather than using a uniform high-privilege approach for all operations. Each COM object access is evaluated individually, and privilege elevation is applied locally only to the specific process accessing the elevated COM object, not to the entire user session. This localized privilege application ensures minimum necessary access rights are granted.
2Object-affected harmful factors
If a least-privilege access model is implemented to enhance security, then security risks are reduced, but legitimate processes requiring higher access rights cannot execute properly
Solution Approach 1:
The system performs preliminary checks to determine whether a process is entitled to access an elevated COM object before granting access. The COM handling unit intercepts creation requests, verifies entitlement against stored policies, and only then allows the process to access the elevated object. This preliminary verification ensures that legitimate processes with proper authorization can execute with necessary privileges while blocking unauthorized access attempts.
Solution Approach 2:
The system introduces a COM handling unit as an intermediary between user processes and COM objects. This intermediary intercepts creation requests, determines entitlement based on stored policies, and manages the privilege elevation process. The intermediary ensures that only authorized processes can access elevated COM objects while maintaining the least-privilege principle for all other operations.
3Adaptability or versatility
If privilege elevation is applied broadly to ensure all processes can access COM objects, then application compatibility is maintained, but system stability decreases due to increased exposure to malicious or erroneous operations
Solution Approach 1:
The system applies privilege elevation locally only to the specific process that has been verified as entitled to access the elevated COM object. The COM handling unit intercepts creation requests and elevates privileges only for that particular process, not for all processes system-wide. This localized approach maintains application compatibility for authorized processes while limiting the attack surface and reducing system stability risks.
Solution Approach 2:
The system dynamically determines which processes receive privilege elevation based on real-time entitlement verification. Rather than applying static broad privilege elevation to all processes, the system evaluates each creation request individually, checks entitlement against stored policies, and applies elevation only when appropriate. This dynamic approach ensures application compatibility while maintaining system stability through selective privilege management.
Data Source
AI summary
A computer device and method are provided to handle COM objects. A COM creating unit (800) intercepts a request for creation of an elevated COM object by a first user process (120a), determines whether the first user process (120a) is entitled to access the COM object, and creates the COM object without elevated privileges. A COM implementing unit (900) intercepts a second user process (120b) that implements the COM object, confirms that the second user process (120b) is entitled to access the COM object and elevates the privilege level of the second user process (120b) to implement the elevated COM object.