Privileged Broker Access for Secure System Resources

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Universal platform services executing at a lower privilege level than user accounts are unable to access certain secure system resources, such as hardware and device drivers, limiting the functionality of applications developed by hardware vendors.

Innovation Solution

A broker service operating at a higher privilege level than the universal platform application performs access checks based on defined capabilities, protected status, and user account permissions to facilitate access to secure system resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If universal platform services execute on the operating system using a lower privilege level, then system security is improved, but access to secure system resources deteriorates

Engineering Contradiction:

Improvesystem securityVSAvoidaccess to secure system resources

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

A broker service is introduced as an intermediary component that runs at a higher privilege level than the universal platform service. The broker service receives access requests from the low-privileged universal platform service, performs capability verification and security checks, and then grants access to secure system resources on behalf of the requesting service. This mediator architecture allows the universal platform service to maintain its low privilege level for security while still accessing required resources through the broker's elevated permissions.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If applications run at lower privilege levels, then system security is improved, but the ability to perform hardware access tasks deteriorates

Engineering Contradiction:

Improvesystem securityVSAvoidability to perform hardware access tasks

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The broker service acts as a privileged intermediary that enables hardware access tasks for low-privileged applications. When the universal platform service needs to perform hardware diagnostics or configuration updates, it submits requests through the broker service, which then executes these privileged operations and returns results to the application.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segregates privileges by separating the universal platform service (running at lower privilege level for security) from the broker service (running at higher privilege level for resource access). This segmentation allows each component to operate at the appropriate privilege level, with the broker handling privileged operations that the platform service cannot perform directly.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12632534B2Accessing secure system resources by low privilege processes

Publication Date: 2026.05.19 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Described are examples for enabling low privileged application to access secure system resources. A request from an application executing at a second privilege level can be received by a broker service executing at a first privilege level, where the request corresponds to accessing secure system resources. It can then be determined whether the application has a defined capability for accessing the secure system resources, whether the application has a protected status, and/or whether a user account associated with executing the application is part of a certain group of user accounts. Based on these determinations, access to the secure system resources can be provided to the application by the broker service.