Kernel-Based Access Control for Shared Hardware Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for controlling access to shared hardware resources in computer systems, particularly in sensitive on-board devices and industrial command and control systems, face challenges in ensuring high security and sequential access, especially in non-privileged mode, which is complex and difficult to assess for safety.
Innovation Solution
A method implemented by the kernel of the operating system that manages access to shared hardware resources through a configuration structure storing authorized transfers between tasks, allowing for the verification and authorization of resource acquisition and transfer, ensuring sequencing and security by using a statically predetermined rule-based access control system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control is implemented at the application level in non-privileged mode, then security and sequential access can be ensured, but the system complexity and difficulty of safety assessment increase
Solution Approach 1:
The patent introduces a kernel-based intermediary system that mediates between software tasks and shared hardware resources. The kernel, running in privileged mode, manages access control by verifying transfer authorization records before allowing resource transfer between tasks. This intermediary approach shifts the complexity from application level to kernel level, where it can be more easily managed and assessed for safety.
Solution Approach 2:
The access control mechanism is segmented into distinct components: a configuration structure storing transfer authorization records, a kernel-based access control module that verifies these records, and the actual resource transfer mechanism. This segmentation allows each component to be independently analyzed and verified, reducing the overall difficulty of safety assessment while maintaining security.
2Ease of operation
If token systems are used to manage shared resource access, then availability control is simplified, but security and sequential access control are insufficient
Solution Approach 1:
The system performs preliminary action by pre-storing transfer authorization records in the configuration structure before resource transfer occurs. These records define the authorized transfer paths between tasks for each shared resource. When a transfer request is made, the kernel verifies the request against these pre-established authorization records, ensuring security and sequential access control while maintaining operational simplicity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to access control for at least one hardware resource of an electronic computing device, shared by a plurality of software tasks to be executed in a predetermined application context, the hardware resource(s) being managed by an operating system with an executable kernel in privileged execution mode. The access control method is implemented by said operating system kernel and includes storing a configuration structure (36) for accessing the shared hardware resources, containing information (42) relating to authorized transfers, including, for each shared hardware resource, at least one indication of an authorized transfer between a first task and a second task for the use of said resource.Following the execution of a first task using the hardware resource, this access configuration structure (36) is used to authorize or not an acquisition of said hardware resource by a second task requiring the use of said hardware resource.