Kernel Driver Protection for Signed Process Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computer operating systems face challenges in protecting user processes and their resources from unauthorized access, particularly in the face of malicious threats that exploit existing security methods.
Innovation Solution
A kernel driver is employed to enforce protection policies, validate digital signatures, manage decryption keys, and control access to objects based on valid signatures, ensuring secure execution of first-party applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If simple prevention of access by other user processes is used, then basic security is maintained, but security is insufficient against malicious threats
Solution Approach 1:
A kernel driver acts as an intermediary between user processes and protected objects. The kernel driver intercepts access requests, validates digital signatures, and enforces protection policies, providing an additional security layer between potentially malicious user processes and critical system objects
Solution Approach 2:
The system performs preliminary validation of digital signatures before allowing access to protected objects. By checking the authenticity and integrity of executable files in advance, the system prevents malicious code from executing or accessing protected resources
2Reliability
If digital signature validation is implemented, then access control security is improved, but system complexity increases
Solution Approach 1:
The kernel driver automatically validates digital signatures and enforces protection policies without requiring manual intervention from users or administrators. The system self-manages the complexity of signature validation and key management internally
Solution Approach 2:
The kernel driver serves multiple functions: it validates digital signatures, manages protection policies, controls access to objects, and handles decryption keys. By consolidating these security functions into a single component, the system manages complexity while providing comprehensive security
3Reliability
If decryption keys are managed by the kernel driver, then security of cryptographic operations is improved, but key management complexity increases
Solution Approach 1:
The kernel driver serves as a secure intermediary for decryption key management. It receives, stores, and distributes decryption keys only to processes with valid digital signatures, ensuring cryptographic operations are performed securely while the driver manages the complexity of key distribution and access control
4Adaptability or versatility
If protection policies are made dynamic and modifiable, then adaptability to different security requirements is improved, but security enforcement complexity increases
Solution Approach 1:
Protection policies are made dynamic and modifiable based on digital signature validation results. The kernel driver can adjust protection levels, access permissions, and security requirements in real-time according to the authenticity and integrity of the executing process, allowing flexible security enforcement without manual reconfiguration
Data Source
AI summary
Computer security apparatus including a kernel driver configured to be executed by a computer in a kernel mode and to thereupon perform protecting a process of a first computer software application executed by the computer, where the protecting is performed in accordance with a protection policy, receiving an instruction from the process to modify the protection policy, modifying the protection policy in accordance with the instruction, and protecting the process in accordance with the protection policy after it has been modified in accordance with the instruction.