Dynamic Access Control for Guest OS Sector Groups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional information processing devices struggle to accurately determine the validity of access requests for new applications, as the security operating system lacks initial rules for protecting files related to these applications.
Innovation Solution
An information processing device with an operating system and a control system that includes an analyzer to generate access data, a monitor to determine unauthorized access, a determiner to identify access requests for application-related sector groups, and a manager to update rule and correspondence information based on changes to the application storage area.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the security operating system uses fixed rule information to determine access validity, then unauthorized access can be blocked for known applications, but new applications cannot be accessed because no rules exist for them
Solution Approach 1:
The rule information and correspondence information are made dynamic rather than static. The manager automatically updates these data structures when applications are added, modified, or deleted in the application storage area. This allows the access control system to adapt to new applications while maintaining security for existing ones, resolving the contradiction between reliability and adaptability.
Solution Approach 2:
The system implements a feedback mechanism where the manager monitors changes in the application storage area and automatically updates the rule information and correspondence information in the control system. This closed-loop feedback ensures that the access control rules remain synchronized with the actual application state, allowing new applications to be accessed while maintaining security validation.
2Reliability
If the system manually updates security rules for each new application, then access control accuracy is maintained, but the complexity and time required for system maintenance increases
Solution Approach 1:
The manager automatically performs the task of updating rule information and correspondence information without requiring manual intervention. When the application storage area changes, the manager self-services by detecting these changes and updating the control system's data structures automatically. This eliminates the need for manual rule updates while maintaining access control accuracy, reducing maintenance complexity.
Solution Approach 2:
The system performs preliminary actions by pre-establishing the correspondence between application storage areas and sector groups. The manager proactively monitors and detects changes before they affect access control, automatically updating rules in advance. This preliminary action prevents access control failures before they occur, maintaining reliability without manual intervention.
3Reliability
If the system monitors all access requests through the control system, then unauthorized access is detected, but processing time increases due to additional validation steps
Solution Approach 1:
The system performs preliminary action by pre-establishing correspondence information between application storage areas and sector groups, and pre-validating access rules. When an access request arrives, the analyzer can quickly generate access data by referencing pre-computed correspondence information, and the monitor can immediately determine validity without extensive real-time analysis. This reduces processing time while maintaining detection capability.
Solution Approach 2:
The access control process is segmented into distinct functional components: the analyzer generates access data by referencing correspondence information, the monitor determines validity based on rule information, and the determiner identifies whether the request targets application-related sector groups. This segmentation allows each component to operate efficiently with its specific task, reducing overall processing time while maintaining comprehensive security validation.
Data Source
AI summary
An information processing device includes a guest OS and a host OS that accesses a sector group in response to an access request from the guest OS. The host OS includes: an access log analyzer that generates, by reference to a sector-group database, a sector-group access log from the access request; a sector-group access determiner that determines, based on the sector-group access log, whether the access request seeks to access the sector group related to an application; and a manager that updates, based on a developer definition policy, a sector-group access rule database and the sector-group database if it is determined that the access request seeks to access the sector group and the guest OS makes a change to an application storage area.