Domain-Based Network Port Isolation in Operating Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional UNIX or UNIX-like operating systems have a coarse granularity in access control, which limits the ability to isolate network ports at a finer level, compromising organizational security and resource management.
Innovation Solution
Implementing domain-based isolation rules within the operating system to govern access to logical network port identifiers, allowing administrators to define and enforce rules based on user domains, thereby controlling access to specific objects and resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional UNIX access control mechanisms are used, then system administration is simplified through shared root account access, but the granularity of access control is too coarse to provide fine-grained isolation of network ports and resources
Solution Approach 1:
The patent segments the root account privileges by introducing domain-based access control that divides system resources into distinct domains (e.g., network ports, file systems, devices). Each domain can have its own access control policies, allowing fine-grained isolation without requiring multiple root accounts. This enables administrators to control access to specific network ports or resources independently while maintaining simplified administration through a unified domain management framework.
2Reliability
If fine-grained isolation of network ports is implemented, then organizational security and resource management are improved, but the complexity of access control mechanisms increases
Solution Approach 1:
The patent introduces a new dimension of domain-based access control that operates alongside traditional UNIX access control mechanisms. Instead of replacing the existing coarse-grained control, it adds a layered domain isolation framework that operates at a different level of abstraction. This allows fine-grained network port isolation to be implemented without fundamentally restructuring the entire access control system, thereby limiting the increase in complexity.
3Reliability
If domain-based isolation rules are enforced in the operating system space, then unauthorized operations and connections are prevented, but the overhead of evaluating domain isolation rules increases processing time
Solution Approach 1:
The patent implements preliminary action by pre-evaluating and caching domain isolation rules during system initialization or policy definition phases. Domain isolation policies are established beforehand and stored in an accessible format, allowing the kernel to quickly evaluate connection requests against pre-computed rules rather than interpreting complex policies in real-time. This reduces the processing overhead for each connection request while maintaining security enforcement.
Data Source
AI summary
When an operating system process evaluates a rule for an operation being attempted on a logical network port, the operating system process determines whether the target logical port falls within a range of logical ports, and then determines whether the operation is associated with a permitted domain of the range of logical ports. If the operation is a bind operation, then the process attempting to bind to the target port will be allowed to bind if the target port falls within the range and the operation/process is associated with a permitted domain. Otherwise, the binding operation will not be allowed to proceed.