Transactional Log Security Model via Protected Subsystem
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Transactional logging systems face challenges in maintaining security semantics and preventing unintended access between real and virtual log files, especially in multiplexed environments, where a malicious or accidental access can compromise data integrity.
Innovation Solution
A security model is implemented within a protected subsystem of the transactional logging infrastructure, using a machine-wide principal to manage access and enforce consistent security semantics across both dedicated and virtual logs, separating log file security from container security and utilizing cryptographically-secure signatures for access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If virtual log streams share the same multiplexed physical log to improve resource utilization and reduce storage overhead, then storage efficiency is improved, but security isolation between different log streams deteriorates, allowing potential malicious or accidental access to other streams
Solution Approach 1:
The patent segments the multiplexed log file into multiple virtual log streams, where each stream is logically isolated despite sharing the same physical storage. The log file is divided into distinct streams (e.g., Stream 0, Stream 1, Stream 2) with separate security descriptors, allowing efficient storage utilization while maintaining security boundaries through structured segmentation of the log data
Solution Approach 2:
The patent introduces security descriptors as an intermediary layer between the multiplexed log streams and access requests. These descriptors act as mediators that enforce security policies, validating access permissions for each stream independently. The security descriptor includes stream-specific access control information that prevents unauthorized cross-stream access while allowing legitimate operations within each stream
2Object-affected harmful factors
If dedicated log files are used for each log stream to maintain security and isolation, then security isolation is improved, but storage efficiency and resource utilization deteriorate due to duplication
Solution Approach 1:
The patent merges multiple virtual log streams into a single multiplexed physical log file, eliminating redundant storage while preserving security through logical separation. Instead of maintaining separate physical files for each log stream, the system combines them into one file with internal stream identifiers and security descriptors that enforce isolation, achieving both storage efficiency and security
3Productivity
If log clients have direct access to the underlying file system containers to improve operation speed and reduce abstraction overhead, then operational efficiency is improved, but security control deteriorates, allowing bypass of security checks
Solution Approach 1:
The patent introduces a protected subsystem as an intermediary layer between log clients and the file system containers. This subsystem acts as a security gatekeeper that all access requests must pass through, preventing direct client access to containers. The protected subsystem validates security descriptors and enforces access policies, maintaining security control while allowing efficient log operations through the intermediary layer
4Object-affected harmful factors
If a protected subsystem with security descriptors is implemented to enforce security semantics, then security control is improved, but system complexity increases due to additional validation and management overhead
Solution Approach 1:
The patent applies homogeneous security descriptors to all virtual log streams within the multiplexed log file. Each stream uses the same security descriptor structure and validation mechanism, creating a uniform security model that simplifies implementation and management. This homogeneous approach allows the system to enforce security consistently across all streams without requiring complex stream-specific security logic
Data Source
AI summary
A security model is provided in a transactional logging infrastructure that is arranged as a protected subsystem built on an underlying secure file system. Files in the underlying file system used by virtual log streams are protected from direct user writes, and are written-to only through the protected subsystem that is brokered by a machine-wide principal so that virtual log files sharing the same multiplexed physical log are kept secure from each other. Log file handles and user- and kernel-mode objects are exposed to log clients through interfaces using consistent security semantics for both dedicated and virtual logs. Log clients are agnostic of the underlying secure file system and can only manipulate file system containers—abstract objects that implement the physical log and used to virtualize the file system by normalizing input/output operations—by using the interfaces brokered by the principal in the protected subsystem.