Privilege Escalation Prevention via API Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems face challenges in preventing privilege escalation attacks, particularly due to kernel mode vulnerabilities and inadequate access control mechanisms, which allow malicious software to gain unauthorized access and control resources.
Innovation Solution
A protection module is implemented to monitor and intercept API calls, enabling a runtime module to detect and prevent privilege escalation by identifying and terminating processes with unauthorized system tokens, thereby blocking potential attacks before they escalate privileges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a protection module monitors and intercepts API calls to detect privilege escalation, then security against privilege escalation attacks is improved, but system performance and operation speed deteriorate due to the overhead of monitoring and intercepting calls
Solution Approach 1:
The patent introduces a protection module as an intermediary component that sits between applications and the operating system kernel. This module intercepts API calls at the user mode/kernel mode boundary, allowing security checks to be performed without modifying the core kernel or requiring kernel-level instrumentation. The intermediary approach enables security monitoring while maintaining relatively good system performance by handling most checks in user mode.
Solution Approach 2:
The protection module performs preliminary security checks by monitoring API calls before they execute privileged operations. By intercepting calls at the boundary and checking for privilege escalation attempts in advance, the system can prevent attacks before they compromise system security, reducing the need for more invasive post-detection measures that would impact performance.
2Measurement precision
If the protection module intercepts API calls at the user mode/kernel mode boundary, then detection precision for privilege escalation attacks is improved, but device complexity increases due to the additional monitoring layer
Solution Approach 1:
The patent segments the security monitoring function into a separate protection module that operates independently from both user applications and the kernel. This segmentation allows the module to focus specifically on intercepting and analyzing API calls at the mode boundary, improving detection precision for privilege escalation attempts without requiring complex integration throughout the entire system stack.
Solution Approach 2:
By positioning the protection module as an intermediary at the user mode/kernel mode boundary, the patent creates a focused monitoring point where privilege escalation attempts are most visible. This intermediary location provides high detection precision for security violations while containing the added complexity to a single modular component rather than distributing complexity throughout the entire system.
Data Source
AI summary
An apparatus, method, computer readable storage medium are provided in one or more examples and comprise accessing an application, identifying an access token of the application, determining if the access token is a system token, and responsive to the access token failing to be a system token, enabling a runtime module.