Multi-Table I/O Security Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems face security risks due to inadequate utilization of privilege levels, allowing unauthorized access to I/O devices, which can lead to system destruction or data loss, as most drivers operate at the most privileged level, security level 0, and popular operating systems like Microsoft Windows do not fully leverage the available security levels.
Innovation Solution
A method and apparatus for performing targeted I/O device access using a multi-table security scheme, where a software object is executed with a specified security level, and a multi-level table I/O space access is performed using at least one security level, incorporating an I/O access interface that provides memory access based on security levels, utilizing an I/O access table and a secondary I/O table to restrict access to I/O devices and memory locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If drivers operate at security level 0 (most privileged level), then device access and control capability is maximized, but security vulnerability increases allowing unauthorized access to I/O devices
Solution Approach 1:
The patent segments the I/O address space into multiple tables (first I/O table, second I/O table, third I/O table) with different security levels. Each table controls access to specific I/O devices, allowing fine-grained security management. This segmentation enables the system to maintain both security and device access capability by assigning different security levels to different device access paths.
Solution Approach 2:
The patent introduces a new dimension of security management by implementing multi-level security tables that map I/O addresses to physical devices through hierarchical tables. This dimensional approach allows the system to control I/O access not just through single-level privilege rings but through multiple layers of table-based security checks, enhancing both security and accessibility.
2Device complexity
If operating systems do not fully utilize privilege levels, then system simplicity is maintained, but security protection against rogue programs is insufficient
Solution Approach 1:
The patent segments the security protection mechanism into multiple independent tables, each handling specific security functions. The first I/O table handles basic access control, the second I/O table provides additional security layers, and the third I/O table manages privileged access. This segmentation allows the system to enhance security without creating a monolithic complex security system.
Solution Approach 2:
The patent introduces I/O tables as intermediary structures between the privilege level system and the actual I/O device access. These tables act as mediators that translate privilege level requests into controlled physical access, adding a layer of security inspection without fundamentally changing the existing privilege level architecture.
3Manufacturing precision
If multiple I/O tables are implemented with different security levels, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent divides the I/O address space into distinct segments, each managed by separate tables with specific security levels. The first I/O table manages basic I/O access, the second I/O table handles secured access, and the third I/O table controls privileged access. This segmentation achieves precise access control by creating dedicated pathways for different security requirements.
Solution Approach 2:
The patent implements a hierarchical table structure where not all tables need to be accessed for every I/O operation. The system can use partial table access based on the security level required, avoiding the need to traverse all tables unnecessarily. This partial action approach maintains precision while reducing the practical complexity of table navigation.
Data Source
AI summary
A method and an apparatus for performing an I/O device access using targeted security. A software object is executed. A security level for the software object is established. A multi-table input/output (I/O) space access is performed using at least one of the security levels. The function of the object is executed.