Kernel Subsystem for Application-Specific Policy Support
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional operating systems lack support for application-specific policies, particularly in handling requests that require customized metrics and content management information, due to restrictions on loading code into the kernel and limited interfaces for communication with subsystems.
Innovation Solution
The kernel subsystem is configured to recognize specific application requests and perform tailored actions through sub-modules that define conditions and corresponding actions, allowing for customized handling of requests beyond default actions, enabling the collection of application-specific metrics and content management information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If code is loaded into the kernel to provide customized functionality, then application-specific metrics and content management information can be collected, but system security is compromised due to the risk of malicious code in kernel mode
Solution Approach 1:
The patent introduces an intermediary component that acts as a bridge between user-space applications and kernel-space resources. This intermediary validates and mediates all interactions, allowing customized functionality to be provided through controlled interfaces rather than direct kernel code loading. The intermediary ensures that applications can access kernel resources and obtain customized metrics without compromising system security by maintaining strict access control and validation mechanisms.
2Reliability
If conventional OS interfaces are used for metric collection, then system security is maintained, but application-specific customized views and fine-grained metrics are not available
Solution Approach 1:
The patent segments the metric collection functionality into modular components that can be dynamically configured for different applications. Instead of providing a monolithic kernel interface, the system divides metric collection into separate, manageable units that can be selectively enabled and configured. This segmentation allows customized views and fine-grained metrics to be provided through controlled interfaces while maintaining system security through modular architecture and isolated configuration spaces.
3Ease of operation
If kernel mode is used for unrestricted resource access, then complete control over system resources is achieved, but the risk of system crash and attacker control increases
Solution Approach 1:
The patent employs an intermediary mechanism that allows applications to access kernel resources without directly executing in kernel mode. The intermediary validates all resource access requests, performs necessary checks, and mediates the interaction between user-space applications and kernel resources. This approach provides applications with complete control over system resources through controlled interfaces while minimizing the risk of system crashes and attacker control by preventing direct kernel mode execution from untrusted applications.
Data Source
AI summary
The approaches described herein provide support for application specific policies for conventional operating systems. In an embodiment, a kernel module representing a kernel subsystem is executed within an operating system's kernel. The kernel subsystem may be configured to respond to particular requests with one or more default actions. Additionally, the kernel subsystem may define a number of sub-modules which represent application specific policies that deviate from the default actions. Each sub-module may define one or more sets of conditions which indicate when the sub-module is applicable to a request and one or more sets of corresponding actions to take when the conditions are met. When an application sends a request to the kernel subsystem, the kernel subsystem determines whether the request meets the conditions of a particular sub-module. If the particular sub-module's conditions are met, the kernel subsystem performs the corresponding actions of the particular sub-module.