LSA Shim Layer for Conditional Windows Process Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standard Windows authentication and authorization mechanisms lack flexibility, failing to consider conditional permissions and allowing outside access to token creation, which limits customization and management of user permissions based on various conditions such as computer type, software running, and auditing status.
Innovation Solution
Implementing a custom authentication and authorization system that creates conditional process tokens, using an authentication agent, a custom data store, and an LSA shim layer to intercept and override standard Windows authentication, allowing permissions to be defined based on specific computer conditions and enabling external processes to change permissions without re-authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If standard Windows authentication mechanisms are used, then system stability and reliability are maintained, but flexibility and adaptability of permission management are limited
Solution Approach 1:
The patent introduces an LSA shim layer as an intermediary component that sits between the authentication request and the standard Windows LSA module. This shim layer intercepts authentication requests, evaluates conditional rules, and only passes requests meeting the conditions to the standard LSA module. This approach enables flexible conditional permission management while preserving the stability of the core Windows authentication system by not modifying it directly.
2Adaptability or versatility
If custom authentication logic is implemented, then adaptability and customization of permissions are improved, but system complexity increases
Solution Approach 1:
The patent segments the authentication system into distinct functional components: an authentication agent that evaluates conditions, an LSA shim layer that intercepts and routes requests, and a rules database that stores conditional logic. This segmentation allows each component to be developed, maintained, and modified independently, reducing overall system complexity despite the added customization capabilities.
Solution Approach 2:
The LSA shim layer acts as a mediator that handles all interactions between custom authentication logic and the standard Windows authentication system. By centralizing the integration logic in this intermediary layer, the patent reduces the complexity that would otherwise be distributed throughout the entire system, making the custom authentication mechanism more manageable.
3Reliability
If process tokens are created without conditional checks, then authentication speed and productivity are maintained, but security and authorization precision are reduced
Solution Approach 1:
The patent performs conditional rule evaluation as a preliminary action before the standard token creation process. The authentication agent evaluates all conditional rules against the current system state before the LSA module creates the process token. This preliminary filtering ensures that only authenticated requests meeting the conditional criteria proceed to token creation, improving authorization precision without significantly impacting overall authentication speed since the conditional checks are performed in parallel with standard authentication flows.
Data Source
AI summary
A system and method for taking control of process token creation in the Windows operating system to create conditional process tokens that define access to system resources for process running on a Windows computer. The system includes an LSA shim layer that intercepts standard Windows requests for authentication and authorization and an authentication agent that determines context for each request. A custom authentication and authorization (A&A) store determines authentication success and the amount of authorization based on context and supplied credentials. Once the custom A&A store determines a successful log-on and defines authorization for the user, it passes the elements of authorization through the authentication agent to the LSA shim layer, which passes them on to the LSA module, which in turn uses them to request a Windows process token from the Windows kernel. The Windows kernel assigns the token to a user's session on the computer, defining the level of resource access available to processes the user launches.