Dynamic Privilege Management for Legacy App Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current endpoint security systems face challenges in managing privileges effectively, particularly in preventing lateral movement of malware and maintaining functionality for legacy applications while reducing administrator privileges, especially in bring-your-own-device (BYOD) scenarios.
Innovation Solution
The implementation of dynamic privilege management techniques, which involve creating special security contexts to elevate or reduce privilege levels for processes based on policies, allowing processes to run with elevated or unelevated privileges as needed, thereby controlling access to system resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If administrator privileges are removed from domain user accounts on endpoints, then security is improved by limiting malware's ability to move laterally, but legacy applications may not function correctly
Solution Approach 1:
The patent implements dynamic privilege management where the privilege level is not fixed but changes based on the task being executed. The system automatically elevates privileges when legacy applications require them and maintains reduced privileges otherwise, making the security model adaptive rather than static
Solution Approach 2:
The system changes the privilege parameter dynamically based on application requirements. Instead of maintaining a constant high or low privilege state, the system adjusts the privilege level parameter in response to different operational contexts, allowing legacy applications to function while maintaining overall security
2Ease of operation
If full administrator privileges are retained on BYOD endpoints, then legacy applications function correctly, but security is compromised as employees expect to retain administrator privileges
Solution Approach 1:
The patent segments the administrator privilege into two distinct modes: elevated mode for legacy applications and reduced mode for general operations. This segmentation allows the system to provide different privilege levels for different purposes, satisfying both security requirements and legacy application needs
3Device complexity
If traditional signature-based antivirus software is used, then malware detection is simple and cost-effective, but zero-day attacks cannot be detected and updates take days to weeks to reach every endpoint
Solution Approach 1:
The system performs preliminary actions by maintaining multiple malware signature versions and preparing detection capabilities in advance. When a zero-day attack occurs, the system can quickly deploy updated signatures without requiring lengthy update cycles, as the infrastructure for rapid deployment is already in place
Solution Approach 2:
The patent introduces a privilege management service as an intermediary between the reduced-privilege user account and legacy applications requiring elevated privileges. This service acts as a mediator that temporarily grants necessary privileges only when needed, rather than maintaining constant high privileges
Data Source
AI summary
An example method of dynamic privilege management in a computer system includes: receiving a task name at a service configured to launch a process corresponding to the task name. The method also includes determining the process is associated with an elevated security context based on a policy that associates the task name with the elevated security context. The method also includes launching, by the service, the process using the elevated security context such that the process runs with elevated privileges.