Kernel-Level Document Access Control for Cross-Platform Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Content Management Systems (CMSs) lack effective controls for securing documents when shared outside of or between different CMS platforms, leading to security issues and document version confusion.
Innovation Solution
A system that provides access controls and protections for documents across multiple operating systems, allowing controlled sharing without requiring specific applications, and enabling users to access documents using any application while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If documents are shared outside of CMS using email or cloud storage, then ease of sharing is improved, but security controls are lost
Solution Approach 1:
The patent introduces an intermediary layer (permission interface and permission check functions) between the document and the user/application. This intermediary enforces security permissions at the kernel level, allowing documents to be shared freely through email or cloud storage while maintaining security controls. The intermediary translates high-level permission requirements into low-level kernel enforcement without restricting sharing mechanisms.
Solution Approach 2:
The patent replaces application-level security mechanisms with kernel-level security enforcement. Instead of relying on application software to control document access, the security controls are embedded in the operating system kernel, providing more reliable and consistent security enforcement across all applications and sharing scenarios.
2Reliability
If encryption is used to protect shared documents, then security is improved, but ease of access and editing is reduced
Solution Approach 1:
The patent implements selective permission enforcement rather than universal encryption. Instead of encrypting all documents and requiring decryption for access, the system applies permission checks only where necessary based on the specific document and user context. This allows users to access and edit documents easily when permissions are granted while maintaining security when needed.
Solution Approach 2:
The permission check functions automatically enforce security rules without requiring user intervention for encryption/decryption operations. The kernel-level permission system handles security transparently, allowing users to access documents through their chosen applications without manual security management.
3Reliability
If kernel level permission check functions are implemented, then security enforcement is improved, but device complexity increases
Solution Approach 1:
The patent segments the security enforcement mechanism into distinct components: permission interface functions that define security rules and kernel-level permission check functions that enforce them. This segmentation allows the complex security system to be built from manageable, independent modules that can be developed and maintained separately.
Solution Approach 2:
The kernel-level permission check functions serve multiple purposes: they enforce document access permissions, control editing rights, and manage sharing restrictions across different applications and scenarios. This multi-functionality reduces overall system complexity by providing a unified security enforcement mechanism rather than separate controls for each use case.
4Reliability
If users must use specific applications to access secure documents, then security control is improved, but adaptability and user choice are reduced
Solution Approach 1:
The patent introduces an intermediary permission checking layer between the document and any application attempting to access it. This intermediary translates application requests into permission checks against the kernel-level security system, allowing any application to access secure documents as long as it has the necessary permissions, without requiring users to install specific applications.
Solution Approach 2:
The kernel-level permission system provides universal security enforcement that works across all applications and operating systems. Instead of requiring application-specific security implementations, the system provides a universal permission checking mechanism that any application can utilize, greatly improving adaptability and user choice.
Data Source
AI summary
Methods, systems, and apparatuses, including computer programs encoded on computer-readable media, for secure document management including receiving, at a kernel level of an operating system, a document access instruction for a document from a user level application. A document identifier associated with the document is retrieved. Document access permissions associated with the document identifier are determined. Whether the document access instruction for the document is allowable is determined based on the document access permissions. The document access instruction is allowed to proceed if the document access instruction is allowable. The document access instruction is denied if the document access instruction is not allowable.