Process-Level Privilege Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption solutions for computing devices are inadequate in protecting sensitive information from both physical loss and theft, as well as malicious access by insiders or software, as they do not restrict access based on process privileges rather than user or group permissions.
Innovation Solution
Implementing a method where processes are assigned privilege levels independent of user or group permissions, with a security manager controlling access to data based on these policies, using OS API overrides to enforce security policies on a per-application and per-process basis, and establishing trust between systems to restrict access to encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption solutions (Full Disk Encryption, Volume Based Encryption, Folder Based Encryption) are implemented, then data protection against physical loss and theft is improved, but the ability to restrict access from malicious users or processes within the same computing environment is not enhanced
Solution Approach 1:
The patent segments access control by introducing process-level privilege levels that divide permissions beyond user/group boundaries. Each process is assigned a privilege level (e.g., Level 1 for standard users, Level 2 for administrators) that independently controls access to encrypted data, preventing even authenticated users from accessing data they shouldn't see based on their process privileges.
Solution Approach 2:
The patent introduces a security manager as an intermediary component between the encryption system and accessing processes. This security manager evaluates the privilege levels of requesting processes and mediates access decisions to encrypted data, acting as a gatekeeper that prevents malicious or unauthorized processes from accessing sensitive information regardless of user authentication.
2Object-affected harmful factors
If process privilege levels are introduced to control access to encrypted data, then protection against malicious processes is improved, but system complexity increases
Solution Approach 1:
The patent makes the privilege level system universal by integrating it into the existing operating system's process execution model. The same privilege evaluation mechanism works for all encrypted data access requests, whether from users, applications, or system processes. The security manager uses a unified approach to evaluate privilege levels across different contexts, reducing the need for separate access control mechanisms for each scenario.
Data Source
AI summary
Disclosed is a method of supporting security policies and security levels associated with processes and applications. A security level is associated with a process independent of a user executing the process. When secure data is to be accessed, the security level of the process is evaluated to determine whether data access is to be granted. Optionally, the security level of a user of the process is also evaluated prior to providing data access.