Kernel-Level Command Interception for Pre-Execution Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing role-based access control (RBAC) techniques in computing devices are vulnerable to attacks such as password theft and session hijacking, necessitating improved methods to protect devices from suspicious and unauthorized computer operations.
Innovation Solution
Implementing pre-execution command interception and multi-factor authentication, where a software entity associated with the operating system kernel intercepts commands before execution, and requires multi-factor authentication for designated command types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If role-based access control (RBAC) techniques are used to restrict access to devices, then access control is simplified and users can only access resources needed for their jobs, but the system becomes vulnerable to attacks such as password theft and session hijacking
Solution Approach 1:
The system performs preliminary actions by intercepting commands before execution and evaluating them against a protected list. The kernel-level software entity captures commands at the kernel interface, determining whether they match designated command types before allowing execution. This preliminary evaluation prevents unauthorized operations from succeeding, addressing the security vulnerability of RBAC while maintaining ease of access control.
Solution Approach 2:
The patent introduces an intermediary layer between the user and the device operations through kernel-level software entities that act as mediators. These entities intercept commands at the kernel interface, evaluate them against protected lists, and determine whether to allow execution. This intermediary mechanism enhances security by adding a verification layer without complicating the user's access control experience.
2Reliability
If pre-execution command interception and multi-factor authentication are implemented, then device protection is enhanced and unauthorized commands are prevented, but the system complexity increases
Solution Approach 1:
The system segments the command execution process into distinct phases: command capture at the kernel interface, determination of whether the command matches a protected list entry, multi-factor authentication verification, and final execution decision. This segmentation allows each security function to be implemented independently through separate software entities, managing complexity through modular design while providing comprehensive device protection.
3Reliability
If commands are evaluated before execution to determine if they are designated command types, then unauthorized operations are blocked, but the processing time increases
Solution Approach 1:
The system applies partial action by evaluating only commands that match designated command types against the protected list, rather than scrutinizing every command. The kernel-level software entity determines whether a captured command corresponds to a protected command type, and only then proceeds with multi-factor authentication. This selective evaluation approach maintains security for critical operations while minimizing processing overhead for routine commands.
Data Source
AI summary
Techniques are provided for device protection using pre-execution command interception and user authentication. One method comprises obtaining, by a software entity associated with an operating system kernel of a device, a request from a user to execute a command; determining, by the software entity associated with the operating system kernel, prior to an execution of the command, whether the command is a command of a designated command type; initiating a multi-factor authentication of the user in response to determining that the command is a command of the designated command type; and initiating an execution of the at least one command based on a result of the multi-factor authentication of the user. The determination of whether the command comprises the command of the designated command type evaluates command properties and/or command criteria. The command may be compared to a protected list of commands of the designated command type.