Custom UWP SID Authorization for Granular API Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing authorization mechanisms in information handling systems, such as access control lists (ACLs), are limited in providing granular permissions to Universal Windows Platform (UWP) applications, leading to unnecessary access grants and increased security risks, as they only offer binary allow or deny restrictions, rather than more nuanced permissions like read-only or write-only access.
Innovation Solution
The implementation of a Custom-Capability-derived Security Identifier (SID) system that determines the identity of UWP applications and grants access to specific API endpoints based on custom capabilities defined in the app's manifest, allowing for granular authorization and limiting access to only the necessary interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional ACLs are used for UWP app authorization, then implementation simplicity is maintained, but access control granularity is insufficient (only binary allow/deny)
Solution Approach 1:
The patent transforms the binary authorization parameter (allow/deny) into a multi-level parameter system using SIDs with different scopes (app-wide, package-specific, resource-specific). This allows the same authorization mechanism to provide both simplicity and granularity by changing the parameter resolution level based on the SID scope.
Solution Approach 2:
The patent introduces Custom Capabilities as an intermediary layer between the app and the service. These capabilities act as mediators that translate fine-grained access requirements into standardized authorization tokens, maintaining system simplicity while enabling precise control over resource access.
2Manufacturing precision
If service endpoints are created for each specific access scenario, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent makes a single service endpoint universal by implementing dynamic authorization logic that evaluates Custom Capabilities at runtime. Instead of creating multiple specialized endpoints, one endpoint handles all access scenarios by universally applying the capability-based authorization framework, reducing complexity while maintaining precision.
Solution Approach 2:
The patent introduces dynamic authorization evaluation where the effective permissions are determined at runtime based on the app's Custom Capabilities and the requested resource. This dynamic approach allows a single static endpoint to provide multiple fine-grained access controls without increasing structural complexity.
3Ease of operation
If full service access is granted to UWP apps, then ease of app development is improved, but security risk increases due to unnecessary access
Solution Approach 1:
The patent implements partial authorization by granting apps only the specific capabilities they need rather than full service access. The Custom Capability system allows developers to declare only the necessary permissions in the app manifest, providing just-enough access to maintain security while keeping development simple through the standardized capability framework.
Data Source
AI summary
An information handling system may include at least one processor and a non-transitory, computer-reading medium having instructions thereon that are executable by the at least one processor for: providing access to one or more objects via a plurality of application programming interface (API) endpoints; receiving a call to a particular API endpoint from an app; and determining, based on a security identifier (SID) of the app, whether the call should be allowed; wherein the SID of the app is based on one or more custom capabilities defined in a manifest of the app.