Declaration of Operation Framework for Software Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional tools for detecting and preventing malicious code in computing systems are ineffective against undiscovered code and cannot guarantee data safety, especially when downloading software from untrusted sources, leading to potential system infections and data loss.
Innovation Solution
A system and method that utilize a 'declaration of operation' (DOO) to monitor and control software applications' access to system resources, granting or denying access based on predefined permissions, allowing users to modify access scopes during or after installation, and storing DOO on local or removable storage for secure resource management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus tools are used to detect and prevent malicious code, then known malicious code can be detected and removed, but undiscovered malicious code can still infect systems and access resources
Solution Approach 1:
The patent applies preliminary action by establishing a Declaration of Operation (DOO) framework before software execution, where access permissions are pre-declared and system resources are pre-mapped. The system proactively monitors and controls access requests against these pre-established declarations, preventing undiscovered malicious code from accessing unauthorized resources before it can cause harm, rather than relying on post-detection removal methods.
2Adaptability or versatility
If users download software from untrusted sources, then more software options are available, but the risk of infection and data loss increases
Solution Approach 1:
The patent introduces an intermediary layer between the user and system resources in the form of the Declaration of Operation framework. This intermediary monitors and controls all access requests from downloaded software against pre-declared permissions, acting as a mediator that allows software from untrusted sources to execute while blocking unauthorized access to system resources, thus enabling software diversity without compromising security.
Solution Approach 2:
The system implements feedback mechanisms where access requests are continuously monitored and compared against the Declaration of Operation. When a software application attempts to access resources beyond its declared permissions, the system provides feedback by denying access and can alert the user, creating a closed-loop security system that responds to attempted violations in real-time.
3Measurement precision
If digital signatures are used for software verification, then authenticity can be confirmed, but user understanding and control remain insufficient
Solution Approach 1:
The patent creates a simplified copy of the complex verification process in the form of the Declaration of Operation interface. Instead of requiring users to understand and verify digital signatures directly, the system creates an accessible representation (DOO) that translates technical verification into user-friendly access permission declarations, making security control intuitive and actionable for ordinary users.
4Reliability
If conventional tools are updated and executed frequently to detect new malicious code, then detection capability improves, but system complexity and resource consumption increase
Solution Approach 1:
The patent segments the security function into distinct components: the Declaration of Operation framework, the access monitoring module, and the resource mapping system. This segmentation allows each component to operate independently and specialize in specific tasks, reducing overall system complexity while maintaining effective security monitoring. The modular architecture enables updates to individual components without affecting the entire system.
Data Source
AI summary
A software package in accordance with one embodiment comprises a software application, and a declaration of operation associated with the software application. The declaration of operation is examined by a system module running on the computing system. The system module is configured to control access requests submitted by the software application after software application is installed on the computing system. The system module monitors a request for accessing a resource accessible via the computing system. The system module grants the software application access to the resource, in response to determining that the request for access complies with the declaration of operation.