ELF Object Access Control via Verification Daemon
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for restricting access to software portions, such as those subject to export restrictions, often fail to allow both consumers and providers access while preventing unauthorized modifications or additions, especially in cryptographic frameworks where open APIs are restricted.
Innovation Solution
The method involves digitally signing Executable and Linking File (ELF) objects with usage restrictions, using a verification daemon to validate the signature and enforce access controls, allowing only authorized clients to access restricted portions of the software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptography is used to restrict access to software portions, then security and compliance are improved, but access flexibility and ease of operation deteriorate
Solution Approach 1:
The patent implements dynamic access control by allowing usage restrictions to be configured per ELF object and per client certificate. The verification daemon dynamically evaluates client credentials against usage restrictions at runtime, enabling flexible authorization decisions without compromising security. This resolves the contradiction by making the system adaptive rather than static.
Solution Approach 2:
The patent changes the parameter of access control from binary (authorized/not authorized) to multi-dimensional by introducing usage restriction parameters such as allowed client certificates, permitted operations, and time-based constraints. This allows fine-grained control that maintains security while improving operational flexibility.
2Adaptability or versatility
If open API with pluggable implementation is provided, then adaptability and versatility are improved, but compliance with export restrictions deteriorates
Solution Approach 1:
The patent segments the cryptographic framework into distinct components: the core ELF object containing cryptographic functionality, and separate client modules that can be dynamically loaded. Usage restrictions are applied to specific segments (ELF objects) rather than the entire framework, allowing compliant export of restricted portions while maintaining overall system versatility.
Solution Approach 2:
The verification daemon acts as an intermediary between the cryptographic ELF objects and clients. It enforces usage restrictions by verifying client credentials and ELF signatures before allowing access, thus mediating between the need for open pluggable architecture and compliance requirements without blocking legitimate use cases.
3Adaptability or versatility
If third parties are allowed to modify restricted portions, then adaptability is improved, but security and integrity deteriorate
Solution Approach 1:
The patent applies preliminary action by signing ELF objects with digital signatures before distribution and verifying these signatures at runtime. This preliminary cryptographic binding ensures that any modification to restricted portions will be detected, maintaining integrity while allowing third parties to create and load new ELF objects that comply with usage restrictions.
Solution Approach 2:
The patent enables third parties to create copies and variations of cryptographic functionality by allowing them to compile and load their own ELF objects that implement the same interface. The verification system checks signatures and usage restrictions on these copies, ensuring integrity is maintained while enabling adaptability through third-party contributions.
Data Source
AI summary
A method for verifying an Executable and Linking File (ELF) object, that includes receiving a request for an ELF object from a client, obtaining the ELF object, determining whether a signature associated with the ELF object is valid, determining whether a usage restriction is associated with the ELF object, if the signature is valid, and restricting access to the ELF object, if the usage restriction is associated with the ELF object.