Linux Security Policy Module for Downloaded Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security technologies, such as application-layer security measures and Discretionary Access Control methods, are inadequate in preventing unauthorized access and misuse by authorized users, particularly due to the high privileges of the super user in UNIX systems, and struggle with setting customized security policies for downloaded applications.
Innovation Solution
A Linux-based security system that includes a template policy module for setting access control rules, a base policy module for executing these rules, and a template policy module editor to generate custom application policies, allowing users to easily manage security policies without specialized knowledge.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If Discretionary Access Control (DAC) method is used, then ease of operation is improved, but security reliability deteriorates due to excessive super user authority
Solution Approach 1:
The patent segments the access control system into Mandatory Access Control (MAC) for security policy enforcement and Discretionary Access Control (DAC) for user-friendly operation. The MAC layer provides mandatory security policies while the DAC layer maintains ease of operation through user-level permission management, resolving the contradiction between security reliability and ease of operation.
Solution Approach 2:
The patent introduces an intermediary layer between the user and the system resources through the use of security labels and policy modules. This intermediary mechanism enforces security policies without requiring users to directly manage complex access control rules, thereby maintaining ease of operation while improving security reliability.
2Reliability
If SELinux policy control elements are used for downloaded applications, then security reliability is improved, but ease of operation deteriorates due to policy collision and complexity
Solution Approach 1:
The patent applies preliminary action by pre-configuring security policy modules and labels before application installation. The system automatically generates and applies appropriate security policies to downloaded applications, eliminating the need for users to manually configure complex SELinux policies and avoiding policy collisions.
Solution Approach 2:
The patent enables self-service by allowing the system to automatically manage security policies for downloaded applications. The policy management system autonomously handles policy generation, conflict resolution, and enforcement without requiring user intervention or specialized knowledge, thereby improving ease of operation while maintaining security reliability.
3Adaptability or versatility
If kernel modularization is implemented, then adaptability is improved, but security reliability deteriorates due to malicious code insertion vulnerability
Solution Approach 1:
The patent applies preliminary anti-action by implementing security policy modules that prevent malicious code insertion before it can compromise system security. The mandatory access control mechanism and security labeling system detect and block unauthorized modifications to kernel modules, thereby maintaining security reliability while preserving the adaptability benefits of kernel modularization.
Data Source
AI summary
A system for providing security policy for a Linux-based security operating system, which includes a template policy module configured to set an authority using policy information of a downloaded application so that the template policy module can set an access control rule for accessing a system resource of the application, a base policy module executing the access control rule for the system resource in accordance with the access control rule set by the template policy module, and a template policy module editor generating a custom application for the corresponding application using information output from the template policy module.