Kernel Interface Segmentation for Process Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional operating system kernel interfaces fail to adequately distinguish between local and peer kernel objects, leading to security vulnerabilities due to indiscriminate access and misuse of kernel object identifiers, which can result in accidental or malicious alteration of process states.
Innovation Solution
The kernel interface is redesigned to categorize kernel objects into local and peer objects, using distinct identifiers to prevent a calling process from altering the state of other processes, thereby isolating in-process data and ensuring secure access through separate sets of functions for local and peer kernel objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a conventional kernel interface uses a unified access control pattern for all kernel objects, then it simplifies the interface design, but it leads to security vulnerabilities due to inability to distinguish between local and peer objects
Solution Approach 1:
The patent segments the unified kernel interface into two distinct interfaces: a local kernel interface for local objects and a peer kernel interface for peer objects. This segmentation allows each interface to have specialized access control patterns appropriate to its security requirements, eliminating the security vulnerabilities of the unified approach while maintaining design simplicity within each segmented interface.
Solution Approach 2:
The patent applies local quality by giving different security properties to different parts of the kernel interface. Local kernel objects receive access control through security principals and access control lists, while peer kernel objects receive capability-based access control. This localized differentiation of security mechanisms resolves the contradiction by providing appropriate security for each object type without complicating the overall interface design.
2Adaptability or versatility
If a conventional kernel interface allows processes to access any kernel object through unified identifiers, then it provides flexibility in object access, but it enables accidental or malicious alteration of process states
Solution Approach 1:
The patent segments kernel object identifiers into local identifiers and peer identifiers with distinct formats. Local identifiers can only be used with the local kernel interface, and peer identifiers can only be used with the peer kernel interface. This segmentation maintains access flexibility while preventing harmful cross-interface access that could alter process states.
Solution Approach 2:
The patent introduces the kernel interface itself as an intermediary that validates and enforces the relationship between identifier types and interface types. The kernel interface acts as a mediator that prevents direct misuse of identifiers, ensuring that local identifiers are only used for local objects and peer identifiers only for peer objects, thereby preventing accidental or malicious process state alterations.
3Ease of operation
If access control lists are used for all kernel objects, then it provides centralized security management, but it becomes unmanageable with thousands of objects and hundreds of security principals
Solution Approach 1:
The patent segments the access control system into two parts: access control lists for local kernel objects and capabilities for peer kernel objects. This segmentation allows each security mechanism to be applied only where appropriate, reducing the overall complexity of the access control system while maintaining centralized security management for local objects and simplified capability-based management for peer objects.
Solution Approach 2:
The patent applies access control lists only to local kernel objects where centralized management is needed, and uses the simpler capability pattern only for peer kernel objects where it suffices. This partial application of different security mechanisms avoids the complexity of applying access control lists to all objects while maintaining security management effectiveness.
4Device complexity
If capabilities are used for all kernel objects, then it simplifies access control, but it leads to security vulnerabilities due to difficulty of revoking capabilities once distributed
Solution Approach 1:
The patent segments the use of capabilities to apply only to peer kernel objects where their simplicity is advantageous and revocation is less critical. For local kernel objects, access control lists are used instead, which provide stronger security guarantees with revocation capabilities. This segmentation resolves the contradiction by applying each mechanism in the context where it is most appropriate.
Data Source
AI summary
Described herein are one or more implementations that separate kernel interfaces functions into those that act on kernel objects owned by a process and accessed exclusively by that process—described herein as local kernel objects—from access to kernel objects owned by a process and accessible by other active processes.