Kernel Thread Security Policy Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mandatory access control systems in computer systems face challenges in efficiently updating security policies to address unknown vulnerabilities without overburdening administrators, and automatic updates can be compromised by malicious actors.
Innovation Solution
An information processing apparatus with a mandatory access control function that uses a kernel thread to analyze access logs and update or generate security policies, preventing unauthorized access by operating without a user interface and thus reducing the risk of malicious interference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the policy is updated frequently in accordance with vulnerability information, then security strength is maintained, but administrator workload increases significantly
Solution Approach 1:
The system performs automatic policy updates using a kernel thread that independently obtains vulnerability information, analyzes access logs, and generates updated security policies without requiring administrator intervention. This self-service mechanism maintains security strength while eliminating the manual workload burden on administrators.
Solution Approach 2:
The system implements a feedback loop where access logs are continuously analyzed against known vulnerability information, and security policies are automatically adjusted based on this feedback. The kernel thread monitors vulnerability databases and updates policies in response to new threat information, creating a dynamic security system that adapts to emerging threats.
2Ease of operation
If the policy is automatically updated by a specific application with user interface, then administrator workload is reduced, but security strength decreases due to potential malicious takeover
Solution Approach 1:
The invention introduces a kernel thread as an intermediary between the vulnerability information and the security policy update process. This kernel thread operates at the operating system level without requiring user interface interactions, serving as a trusted mediator that automatically updates policies based on vulnerability data while preventing malicious interference that could occur through user interface applications.
Solution Approach 2:
The invention extracts the policy update function from user space applications and relocates it to the kernel space. By taking out the automatic update mechanism from the application layer and implementing it directly in the kernel, the system eliminates the security risks associated with user interface applications while maintaining automatic update capabilities.
3Reliability
If manual policy update process is used, then security strength is maintained through administrator control, but productivity decreases due to time-consuming updates
Solution Approach 1:
The kernel thread performs self-service by automatically obtaining vulnerability information from databases, analyzing system access logs, and generating updated security policies without requiring administrator time or effort. This automation dramatically improves policy update efficiency while maintaining security strength through the trusted kernel-level implementation.
Solution Approach 2:
The system performs preliminary actions by continuously monitoring vulnerability databases and analyzing access logs in advance of actual security threats. The kernel thread proactively identifies potential vulnerabilities and updates policies before attacks occur, improving both efficiency and security strength by preventing issues rather than reacting to them.
Data Source
AI summary
An information processing apparatus, including a function of mandatory access control, includes a storage unit that stores a security policy for managing access by the mandatory access control, an obtaining unit that obtains information on vulnerability of an application, and an updating unit that updates the security policy by a function of a kernel thread in accordance with the information obtained by the obtaining unit.