Configuration Based Workflow for Command Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In UNIX IT systems, there is a lack of mechanisms to control commands that perform destructive actions, such as shutdown or reboot, especially when issued by privileged users, which can lead to data corruption and loss of critical business functionalities due to human error or malicious intent.
Innovation Solution
A configuration-based workflow method that intercepts and validates commands before they reach the OS kernel, using a security integration layer that interacts with external systems to ensure compliance with pre-configured conditions and security policies, thereby preventing accidental or intentional errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If RBAC is implemented to control user access, then user access control is improved, but root users can still initiate shutdown or disruptive commands without control
Solution Approach 1:
The patent introduces an intermediary component that sits between the root user and the system commands. This intermediary validates and controls command execution, preventing root users from directly initiating shutdown or disruptive commands without proper authorization, thus resolving the contradiction between maintaining root access flexibility and preventing unauthorized destructive actions
2Reliability
If eTrust Access Control is configured to prohibit certain commands, then command security is improved, but a root user can stop the eTrust service and invoke prohibited commands
Solution Approach 1:
The patent implements preliminary action by establishing command validation mechanisms before the eTrust service can be stopped or commands executed. The system pre-configures allowed and prohibited commands, and validates all root user commands against this configuration before execution, preventing root users from stopping the service to bypass controls
3Speed
If shutdown or reboot command is issued without validation, then system responsiveness is improved, but data corruption may occur due to human error
Solution Approach 1:
The patent implements feedback mechanisms that validate shutdown and reboot commands before execution. The system checks whether proper authorization and conditions are met, provides feedback to the user about the command status, and only allows execution when validation succeeds, thus preventing data corruption while maintaining system responsiveness
Data Source
AI summary
An approach is provided for delivering a configuration based workflow in an IT system. A set of parameters and pre-configured conditions associated with a command initiated for execution are determined. Validation action(s) that validate the command and are included in the configuration based workflow are determined. The validation action(s) are specified by respective interaction(s) with external system(s). Validation action(s) included in the configuration based workflow are performed by completing the interaction(s) with the external system(s) using the set of parameters. It is determined whether the validation action(s) are successfully completed. If the validation action(s) are successfully completed, the execution of the command is continued. If at least one of the validation action(s) is not successfully completed, the execution of the command is discontinued.