Kernel Process Authentication Before Execution to Block Unauthorized Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing role-based access control (RBAC) techniques in computing devices are vulnerable to attacks such as password theft and session hijacking, necessitating improved methods to protect devices from suspicious and unauthorized computer processes.
Innovation Solution
Implementing a pre-execution multi-factor authentication process that involves a software entity associated with the operating system kernel to intercept and authenticate processes before execution, using a trusted platform module to store process metadata and a multi-factor authentication module to verify the process identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access control (RBAC) techniques are used to restrict access to devices, then user access control is improved, but vulnerability to attacks such as password theft and session hijacking increases
Solution Approach 1:
The patent implements pre-execution authentication that occurs before the process actually runs. The kernel intercepts the process execution request, performs multi-factor authentication verification, and only allows execution if authentication succeeds. This preliminary security check prevents unauthorized processes from executing in the first place, addressing the vulnerability to attacks while maintaining access control reliability.
Solution Approach 2:
The patent introduces a multi-factor authentication module as an intermediary between the process and the operating system kernel. This module acts as a mediator that performs additional verification beyond standard RBAC, evaluating multiple factors including process metadata, device state, and authentication credentials. This intermediary layer blocks attack vectors like password theft and session hijacking that would otherwise bypass traditional RBAC.
2Reliability
If pre-execution multi-factor authentication is implemented, then device security is improved, but process execution speed decreases
Solution Approach 1:
The patent applies partial authentication action by performing multi-factor authentication only for processes that require elevated privileges or access sensitive resources, rather than authenticating every single process execution. The kernel evaluates whether a process needs pre-execution authentication based on its requested permissions and the current device state. This selective approach maintains device security for critical operations while minimizing the impact on overall process execution speed.
3Reliability
If multi-factor authentication evaluation is performed before process execution, then unauthorized process prevention is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal authentication framework that handles multiple authentication methods and process types through a single multi-factor authentication module. This module can evaluate various factors including process metadata, device state, user credentials, and security policies using a unified authentication flow. By consolidating multiple authentication functions into one modular component integrated with the kernel, the system achieves comprehensive unauthorized process prevention while managing complexity through code reusability and standardized interfaces.
Data Source
AI summary
Techniques are provided for device protection using pre-execution multi-factor authentication of a process. One method comprises obtaining, by a software entity associated with an operating system kernel of a processing device, a request to execute a process on the processing device; performing, by the software entity, a first authentication of the process that evaluates a first set of information of the process; performing, by the software entity, a second authentication of the process to obtain a verification result, wherein the second authentication of the process evaluates a second set of different information of the process; and allowing the process to execute on the processing device based at least in part on the verification result. The second set of different information may comprise a name of the process, an identifier of the process and/or an identifier of a given processing device that will execute the process.