HPI Software Access Control via Intermediary Library
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current implementations of the Hardware Platform Interface (HPI) specification lack effective access control mechanisms, leading to unrestricted access by user application programs, which can negatively impact system performance and portability across different platforms, especially when resources and domains are distributed over networks.
Innovation Solution
A system and computer program product that implements HPI specifications using a user library, domain program, and bridge program, with defined access restrictions, allowing controlled access to resources and domains, and enabling communication across remotely connected computer systems while maintaining portability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access restrictions are implemented using conventional mechanisms (non-standard calls or administrator-maintained tables), then access control is provided, but portability across different platforms is reduced and device complexity increases
Solution Approach 1:
The HPI library is designed to provide universal access control mechanisms that work across multiple platforms and implementations. The library implements a standardized interface that can identify and authenticate user application programs regardless of the underlying platform, eliminating the need for platform-specific access control mechanisms while maintaining portability.
Solution Approach 2:
The HPI library acts as an intermediary between user application programs and the domain/resources system. It implements the access control logic within the library itself, mediating between the application program and the HPI specification implementation. This intermediary approach allows the access control mechanism to be independent of both the application program and the underlying platform, resolving the contradiction between reliability and portability.
2Reliability
If access restrictions are implemented using conventional mechanisms (non-standard calls or administrator-maintained tables), then access control is provided, but device complexity and difficulty of maintenance increase
Solution Approach 1:
The HPI library implements self-service access control by automatically identifying user application programs through standard HPI calls and managing authentication without requiring external administrator-maintained tables or complex configuration. The library maintains its own access control state and makes decisions based on the identity of the calling program, eliminating the need for external complexity.
Solution Approach 2:
The access control functionality is merged directly into the HPI library implementation rather than being separated into external mechanisms. The library combines the functions of identification, authentication, and access decision-making into a single integrated component, reducing overall system complexity while maintaining reliable access control.
3Ease of operation
If any user application program is permitted to access the library, then ease of operation is improved, but system performance deteriorates due to unwanted programs
Solution Approach 1:
The HPI library implements local quality access control by providing different levels of access to different user application programs based on their identity. Rather than a uniform allow-all or deny-all approach, the library can grant specific capabilities to specific programs, allowing legitimate programs full access while blocking unwanted programs, thus maintaining both ease of operation for authorized users and system performance.
4Productivity
If access restrictions are implemented to block unwanted programs, then system performance is improved, but ease of operation is reduced due to restricted access
Solution Approach 1:
The access control mechanism in the HPI library is dynamic, adapting its behavior based on the identity and credentials of the calling user application program. The library can dynamically grant or deny access to different resources and domains based on the specific program requesting access, allowing legitimate programs to operate freely while blocking unwanted programs, thus maintaining both performance and ease of operation for authorized users.
Data Source
AI summary
A computer program product and a system are provided for implementing the Hardware Platform Interface (HPI) specification for platform management of computer systems. Software, implemented by the computer program product includes a user library, a resource program, a domain program and a bridge program. The user library accepts calls from user application programs for accessing management data and management capabilities incorporated in a running instance of the resource program. The running instance of the resource program provides access to the management data and the management capabilities. This access is through restrictions to a set of running instances of the domain program. In addition, access to the user application programs is indirect through a set of running instances of the domain program. A running instance of the domain program provides access of a set of running instances of the resource program to a pre-defined set of user application programs, based on access restrictions defined for the domain program. The bridge program enables communication with remotely-connected computer systems.