Mandatory Access Control Module for Java Virtual Machines

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing security control methods, such as Discretionary Access Control, are inadequate for virtual machines like Java Virtual Machines (JVM), as they fail to distinguish between malicious and legitimate activities, and Mandatory Access Control implementations are inefficient in enforcing security policies within virtual machines.

Innovation Solution

A Mandatory Access Control model is introduced for virtual machines, which configures a mandatory access control module to apply access policies by adding labels to objects based on language types and instance numbers, using a reference monitor to block or allow method invocations and variable member accesses, and an external decision engine to enforce security decisions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If Discretionary Access Control (DAC) is used in virtual machines, then ease of operation is improved, but security reliability deteriorates because root/admin access cannot be blocked and all access control becomes useless if compromised

Engineering Contradiction:
Improveaccess control operationVSAvoidsecurity reliability
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent introduces a Mandatory Access Control module as an intermediary layer between the JVM and the system. This module acts as a reference monitor that intercepts and validates all access requests, including those from root/admin users. The MAC module uses security labels and policies to make authorization decisions independently of user identity, preventing compromised credentials from bypassing security controls.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If Mandatory Access Control is implemented at system level (e.g., SELinux), then security reliability is improved by blocking illegitimate root access, but device complexity increases and it is not efficient for ensuring security within virtual machines

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the security control mechanism by creating a dedicated Mandatory Access Control module specifically for the JVM environment. Rather than applying system-wide MAC that affects the entire operating system, the invention isolates MAC functionality within the JVM context. This segmentation reduces the scope of complexity while maintaining security effectiveness for the virtual machine.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The MAC module serves as an intermediary layer between the JVM and the system, acting as a reference monitor that intercepts method invocations and variable accesses. This intermediary approach allows security enforcement without requiring deep modifications to JVM internals or system-level complexity.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Ease of operation

If Java Authentication and Authorization Service (JAAS) is used, then ease of operation is improved as it provides perimeter protection, but security reliability deteriorates because it is not mandatory and cannot distinguish between malicious and legitimate activities within the JVM

Engineering Contradiction:
Improvesecurity configurationVSAvoidsecurity enforcement
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent implements dynamic security labeling where security labels are assigned to JVM objects based on their language types and instance numbers. The MAC module dynamically evaluates access requests by comparing security labels of caller and callee objects against access policies. This dynamic approach enables fine-grained control over individual method invocations and variable accesses, allowing the system to distinguish between legitimate and malicious activities on a per-operation basis rather than relying on static perimeter protection.

Inventive Principle:
Principle #15Dynamics

4Reliability

If Mandatory Access Control is implemented with fine-grained object level control in JVM, then security reliability is improved, but device complexity increases due to the need for labeling engines and decision engines

Engineering Contradiction:
Improvesecurity enforcementVSAvoidcontrol mechanism complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent makes the MAC module a universal component that handles all security decisions for the JVM. The labeling engine and decision engine are designed to work with any JVM object regardless of its type or function. By creating a universal security framework that applies uniformly across all JVM operations, the invention reduces the need for separate security mechanisms for different object types, thereby managing complexity through standardization.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2696303B1Mandatory access control (MAC) in virtual machines
Publication Date: 2017.05.10 ALCATEL LUCENT SA
  • EP2696303B1 patent drawingFigure 1
  • EP2696303B1 patent drawingFigure 2

AI summary

The present invention relates to a method (100) for ensuring Mandatory Access Control (MAC) in a virtual machine (VM) adapted for running object oriented programs and based on strongly typed language, by means of a mandatory access control module (Instr_module), said method comprising: - configuring the mandatory access control module (Instr_module) with an access policy (Acc_pol); - upon event reception indicating a method invocation (Meth_entry) or an access request to a variable member, adding an access control label (LabE, LabR) to the object calling the method (Meth) or requesting the access, named "caller" (CalR), and the object called by the method (Meth) or whose access is requested, named "callee" (CalE), according to the caller and callee language types (Typ_CalR, Typ_CalE); - making a decision (Dec) of blocking the execution of the method (Meth) or the access to the variable member, named "negative decision", or a decision (Dec) of letting the virtual machine (VM) run the method (Meth) or access the variable member, named "positive decision", according to said access control labels (LabE, LabR), the instance numbers of the caller and the callee (Inst_Num), the access policy (Acc_pol), and the access permissions; - transmitting said decision (Dec) to the virtual machine (VM) for blocking or granting the corresponding access attempt.