Processor Resource Management via Supervisor Module Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing processor systems face security risks due to untrusted applications accessing resources, which can compromise system security.
Innovation Solution
A processor system with a supervisor module that intercepts the launch process to detect trusted or untrusted applications, launching untrusted applications in containers with restricted privileges and dynamically allocating resources, while trusted applications have direct access to resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If untrusted applications are allowed to access resources directly, then application functionality is maintained, but system security is compromised
Solution Approach 1:
A supervisor module is introduced as an intermediary between untrusted applications and system resources. The supervisor intercepts resource access requests, verifies application trust status, and selectively grants or denies access. This mediator approach maintains security by filtering malicious requests while preserving legitimate application functionality through controlled resource delivery.
Solution Approach 2:
The system segments applications into trusted and untrusted categories, and segments resource access into direct access (for trusted apps) and supervised access (for untrusted apps). This segmentation allows the system to apply different security policies to different application groups, maintaining security for untrusted applications while preserving ease of operation for trusted ones.
2Reliability
If all applications are treated as untrusted and launched in containers, then system security is improved, but application performance and resource access efficiency deteriorate
Solution Approach 1:
The system applies different security qualities to different applications based on their trust status. Trusted applications receive direct resource access with high execution efficiency, while untrusted applications receive supervised access with enhanced security. This local differentiation of security policies ensures that security measures are applied only where necessary, maintaining overall system productivity while improving security where needed.
3Reliability
If a supervisor module is introduced to intercept and manage application launches, then system security is enhanced, but system complexity increases
Solution Approach 1:
The supervisor module is designed to perform multiple functions: intercepting application launches, determining trust status, managing containerization, and controlling resource access. By consolidating these security-related functions into a single multi-functional module, the system enhances security without proportionally increasing complexity, as the supervisor replaces what would otherwise require multiple separate security mechanisms.
Data Source
AI summary
A processor system is arranged to execute user selected applications. A manager module is configured to detect a user selection of an application and configured to initiate a launch process. A supervisor module is configured to intercept the launch process initiated by the manager module and detect whether the application is a trusted application or an untrusted application. Trusted applications have a privilege to access resources without authorization, and untrusted applications do not have the privilege. The supervisor module has the privilege to access the resources. When the application is untrusted, the application is launched in a container, and at least one of the resources is delivered to the untrusted application in the container.