Privilege Management System for Timely Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively and securely revoke privileges associated with applications on electronic devices in a timely manner, particularly when applications pass privileges between each other, leading to potential security vulnerabilities and user inconvenience.
Innovation Solution
Implement a system that tracks application privileges usage, shuts down applications accessing revoked privileges, and resets devices only when necessary, ensuring that revoked privileges are denied and maintaining a secure known state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional privilege checking is performed only on first access, then the system is easier to operate, but privilege revocation is not timely and security is compromised
Solution Approach 1:
The system performs preliminary actions by establishing privilege monitoring mechanisms before privilege revocation scenarios occur. Application registry monitors are pre-configured to track privilege usage, and the system proactively identifies when revoked privileges are being accessed, enabling timely response before security breaches can occur.
Solution Approach 2:
The patent introduces intermediary components including application registry monitors that act as mediators between applications and the privilege management system. These monitors intercept and track privilege access requests, providing the system with visibility into privilege usage without requiring direct modification of application code, thus balancing security with system complexity.
2Reliability
If device reset is performed frequently to ensure privilege revocation, then security is improved, but user convenience deteriorates
Solution Approach 1:
Instead of performing full device resets for all privilege revocation scenarios, the system applies partial action by targeting only the specific applications that accessed revoked privileges. The monitoring system identifies and terminates only the problematic applications, leaving the rest of the device state intact, thus maintaining security while minimizing user inconvenience.
Solution Approach 2:
The system applies local quality by making privilege revocation effects localized to specific applications rather than globally affecting the entire device. The monitoring mechanism tracks which specific applications access revoked privileges and applies corrective actions only to those applications, preserving the normal operation of unaffected applications and user experience.
3Loss of time
If the system tracks all privilege accesses to enable timely revocation, then privilege revocation becomes more effective, but the complexity of tracking and monitoring increases
Solution Approach 1:
The system implements self-service by having applications automatically register themselves with the monitoring system through standard application registry interfaces. Applications provide their own identification information without requiring manual configuration, enabling the system to track privilege accesses with minimal overhead and without increasing overall system complexity.
Solution Approach 2:
The patent employs universal monitoring mechanisms that serve multiple functions: tracking privilege accesses, identifying revoked privilege usage, and enabling rapid response. The application registry monitor structure is designed to handle various privilege types and revocation scenarios through a unified approach, reducing complexity compared to specialized tracking systems for each scenario.
Data Source
AI summary
The present disclosure relates generally to the management of privileges associated with certain applications that are accessible by users of electronic equipment, such as, for example, networked computers, mobile wireless communications devices, and the like. In particular, the disclosure is directed to systems and methods for managing privileges associated with particular applications and for revoking these privileges in a timely and robust manner. For example, the device keeps track of which applications get access to which privileges. When policies or application control changes, the system detects which privileges have been revoked for which applications. This can be accomplished by simply comparing the old set of privileges with the new set of privileges. For each revoked privilege for a given application, the system determines if the application has ever accessed that privilege in the past. If an application has accessed a privilege that is now revoked at any time in the past, the device is reset. To ensure that privileges that may be passed between applications are not overlooked, the device is arranged to perform a reset if any revoked privilege accessible by the device is one that may be passed between applications.