Intermediary Process for Secure Restricted Object Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In multi-user operating systems, accessing restricted objects while maintaining security is challenging, as granting privileges to one process to access another's object can compromise system security, especially when omnipotent processes are involved.

Innovation Solution

An intermediary process is used to provide secure access to a restricted object by modifying its privileges to match those of the source and destination processes, allowing it to access and copy the object without requiring system administration privileges.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If privileges are granted to a process to access a restricted object, then access capability is improved, but system security deteriorates

Engineering Contradiction:

Improveaccess capabilityVSAvoidsystem security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent introduces a privileged process as an intermediary that mediates access between the unprivileged process and the restricted object. The privileged process temporarily assumes the necessary privileges to access the restricted object on behalf of the unprivileged process, then relinquishes those privileges. This resolves the contradiction by enabling access capability through the intermediary while maintaining system security through controlled, temporary privilege usage rather than permanent grant.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If an omnipotent process is used to access restricted objects, then access flexibility is improved, but vulnerability to malicious exploitation worsens

Engineering Contradiction:

Improveaccess flexibilityVSAvoidvulnerability to malicious exploitation

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements dynamic privilege management where the privileged process assumes only the specific privileges needed for the current operation, rather than maintaining omnipotent privileges continuously. The privileges are temporarily acquired when needed and then relinquished, creating a dynamic state that provides access flexibility only when necessary while minimizing the window of vulnerability to malicious exploitation.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent applies partial action by granting only the specific privileges necessary for accessing the restricted object, rather than using full omnipotent privileges. The privileged process performs the minimal required action with minimal required privileges, reducing the attack surface while maintaining sufficient access flexibility for the intended operation.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS8959616B2System and method for accessing a restricted object

Publication Date: 2015.02.17 MALIKIE INNOVATIONS LTD

AI summary

A system and method wherein an intermediary process provides access to a restricted object associated with a source process on behalf of a destination process. The intermediary process may be a trusted process that is available as a service to other processes on the computing platform. The intermediary process may assume one or more privileges associated with the source process whereby the restricted object may be accessed by the intermediary process on behalf of the destination process. Secure access to the restricted object and the risk of malicious exploitation are mitigated since the intermediary process is a trusted service that is known to provide specific functionality.