Local Security Filter for Downloaded Code Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures are inadequate for enforcing fine-grained access controls on native code, such as C, C++, and Visual Basic, as they do not prevent malicious applications from bypassing security filters and directly accessing the operating system kernel.
Innovation Solution
Implementing a local security filter that generates a unique digital signature for resource requests, ensuring that only authorized requests pass through the security filter before being processed by the kernel, thereby enforcing a specified security policy and preventing unauthorized access to system resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a modified library is used to enforce fine-grained access control, then security control is improved, but application compatibility deteriorates because applications are not required to link with the modified library
Solution Approach 1:
The patent introduces a security filter as an intermediary component between applications and the modified library. The security filter intercepts and validates system calls before they reach the library, ensuring that even applications not linked with the modified library must pass through the security filter's validation. This mediator approach maintains security control while preserving application compatibility.
Solution Approach 2:
The security filter performs preliminary validation of system calls before they are processed by the modified library. By checking the legitimacy of system calls in advance and generating appropriate digital signatures, the security filter ensures that only authorized operations proceed to the library, thereby enforcing security controls proactively without requiring application modification.
2Speed
If direct kernel access is allowed for performance, then system speed is improved, but security deteriorates because malicious applications can bypass security filters
Solution Approach 1:
The security filter serves as a mandatory intermediary between applications and the kernel, intercepting all system calls regardless of performance requirements. The filter validates each system call, generates digital signatures, and only allows legitimate calls to proceed to the kernel. This ensures that even performance-critical operations maintain security controls while still achieving efficient kernel access through the validation process.
Solution Approach 2:
The security filter implements a feedback mechanism where system calls are validated, digital signatures are generated based on the validation results, and only properly signed calls are allowed to access the kernel. This feedback loop ensures continuous security monitoring and control, preventing malicious applications from bypassing security filters even when attempting direct kernel access for performance optimization.
3Reliability
If fine-grained access policy is enforced through Java byte code interpreter, then security control is improved, but adaptability deteriorates because controls are not enforceable for native code
Solution Approach 1:
The patent creates a universal security filter that handles system calls from multiple programming languages and execution environments uniformly. The filter intercepts system calls from native code, Java applications, and other sources, applying the same fine-grained access control policies and digital signature validation to all of them. This universal approach extends Java-like security controls to native code and other languages without requiring language-specific implementations.
Data Source
AI summary
Embodiments of the present invention include a system and method for making it safe to execute downloaded code. The method includes accessing an application, the application making a system call to a library of a computer system for a resource, establishing a requesting thread. The method further includes the library sending a request message to a local security filter; the local security filter validating the requesting thread and returning a digital signature, that uniquely identifies the requesting thread, to the application. The application making a system call to a kernel of the computer system wherein the kernel uses the digital signature from the security filter to validate the requesting thread before allowing access to the requested resource.