Dual Privilege Token Segmentation for Operating System Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems face security risks due to applications being instantiated with full privileges, allowing them to perform harmful, deceptive, or malicious actions, as they are not restricted from modifying files or critical system behavior.
Innovation Solution
The operating system generates and manages both a full privileges token and a limited privileges token for a user, where the limited token is derived from the full token by removing sensitive privileges, ensuring that only necessary actions can be performed, thereby restricting rogue processes from causing harm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If applications are instantiated with full privileges, then they can perform all necessary system operations and modify files, but they can also perform harmful, deceptive, or malicious actions and compromise system security
Solution Approach 1:
The patent segments user privileges into two distinct tokens: a full privileges token containing all user privileges and a limited privileges token containing only a subset of privileges. This segmentation allows the operating system to selectively apply different privilege levels to different processes, enabling applications to operate with minimal necessary privileges while maintaining the capability to escalate to full privileges when needed and trusted.
Solution Approach 2:
The patent applies local quality by assigning different privilege characteristics to different processes based on their trustworthiness and requirements. Trusted processes receive the full privileges token, while untrusted or standard processes receive the limited privileges token. This localized application of privilege quality ensures that only specific processes have access to sensitive operations, reducing overall system security risk.
2Ease of operation
If the operating system provides full privileges to all user processes, then users can access all system resources and perform all operations, but rogue processes can cause harm and modify critical system behavior
Solution Approach 1:
The operating system performs preliminary action by creating the limited privileges token in advance, derived from the full privileges token but with sensitive privileges removed. This preliminary restriction ensures that when processes are created, they start with reduced privileges by default, preventing rogue processes from causing harm while still allowing legitimate processes to access necessary resources. The full privileges token remains available for escalation when needed.
3Reliability
If the operating system creates separate full and limited privilege tokens, then security is enhanced by restricting rogue processes, but device complexity increases due to dual token management
Solution Approach 1:
The patent employs copying by creating the limited privileges token as a derived copy of the full privileges token. The limited token is generated by removing sensitive privileges from the full token, rather than maintaining completely separate privilege definitions. This copying approach simplifies token management by establishing a hierarchical relationship between tokens, reducing the complexity of maintaining multiple independent privilege sets while still providing enhanced security through selective privilege restriction.
Data Source
AI summary
An operating system for a computing device has a first session for a user that includes a first base process that has a first privileges token attached thereto. The first privileges token includes substantially a full set of privileges of the user on the operating system. The operating system also has a second session for the user that includes a second base process that has a second privileges token attached thereto. The second privileges token is derived from the first privileges token and includes only a minimum set of privileges of the user on the operating system. Thus, the second, limited token does not have all privileges associated with the first, full token but instead has a limited set of privileges and not extra privileges that could be employed to take actions that would be harmful, deceptive, or malicious.