OS Process Secure Communication via Message Authentication Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems lack a suitable security mechanism for secure communication between the operating system (OS) and processes, as existing techniques like SSL and TLS are not applicable, leaving the system vulnerable to unauthorized access and data integrity issues.
Innovation Solution
An information processing apparatus is designed with a processor configured to generate and manage message authentication keys using process unique data, enabling secure communication between the OS and processes through message authentication codes, thereby establishing secure data exchange without the need for authenticated key exchange processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL and TLS techniques are used for communication security, then communication data integrity and prevention of spoofing are improved, but the techniques are not suitable for OS-process communications and cannot be properly configured
Solution Approach 1:
The patent extracts the essential security function from SSL/TLS and creates a simplified version specifically for OS-process communication. It uses message authentication codes (MAC) with shared keys between the OS and processes, eliminating the complexity of SSL/TLS handshakes while maintaining security for the specific use case of system process communication.
Solution Approach 2:
Instead of having the process initiate security authentication toward the OS (as in traditional client-server models), the patent inverts the approach by having the OS provide security services to processes. The OS generates and distributes authentication keys to processes, making the OS the security authority rather than the process.
2Device complexity
If no security function is implemented for OS-process communication, then device complexity is reduced, but the system becomes vulnerable to unauthorized access and data integrity issues
Solution Approach 1:
The patent uses disposable message authentication codes with short-lived keys. Each communication session uses a fresh MAC key that is discarded after use, eliminating the need for complex key management infrastructure while providing strong security. The keys are generated on-demand and never stored permanently.
Solution Approach 2:
The process itself generates and manages its own authentication key using its process ID, without requiring external key distribution infrastructure. The process computes the MAC key locally from its PID and the shared secret, making the security mechanism self-contained and process-specific.
3Reliability
If authenticated key exchange processing is implemented, then communication security is improved, but communication overhead increases
Solution Approach 1:
The patent performs preliminary key derivation during process creation rather than during communication. The OS generates a shared secret key when creating the process and stores it securely. When communication occurs, the process simply uses its pre-computed MAC key without needing to perform authentication handshakes, eliminating time-consuming key exchange operations.
Data Source
AI summary
According to an embodiment, an information processing apparatus includes one or more processor. The processor is configured to run a process and a process manager to manage the process. The process includes a first key generator, a first authentication code generator, and a first output unit. The first key generator is configured to generate a first message authentication key by using process unique data assigned by the process manager. The first authentication code generator is configured to generate a first message authentication code by using the first message authentication key and a first message. The first output unit is configured to transmit the first message and the first message authentication code to the process manager.