Protected Resource Command Elevation via Process Handshake
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to manage security requirements for commands impacting protected resources, leading to disruptions and potential malicious access, especially in storage environments with multiple hosts and processes.
Innovation Solution
An elevated permission protocol is implemented to grant hosts permission to submit commands that initially fail security checks, ensuring secure access to protected resources by allowing hosts to elevate their permissions through a handshake process with storage controllers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strict security authentication is enforced for commands affecting protected resources, then security protection is improved, but system disruption and operation failure increase when commands cannot satisfy security requirements
Solution Approach 1:
The patent introduces a second process as an intermediary that mediates between the first process and the protected resource. When the first process cannot satisfy security requirements, the second process acts as a proxy to elevate permissions and submit the command on behalf of the first process, thereby maintaining both security protection and operational continuity.
Solution Approach 2:
The system performs preliminary security verification before command execution. When a command fails to meet security requirements, the system proactively initiates a permission elevation process through the second process before the command is discarded, preventing system disruption by resolving the security issue in advance.
2Productivity
If permission elevation is allowed for processes that fail security checks, then operational continuity is improved, but security vulnerability and unauthorized access risk increase
Solution Approach 1:
The system implements a feedback mechanism where the second process receives information about the first process's security verification failure and the specific security requirements. Based on this feedback, the second process determines whether to elevate permissions and submit the command, ensuring that permission elevation occurs only under controlled conditions with full awareness of security implications.
3Reliability
If multiple authentication methods are implemented for protected resources, then security robustness is improved, but system complexity and implementation difficulty increase
Solution Approach 1:
The second process is designed with multi-functionality, serving both as a monitoring process that tracks security verification status and as an execution process that submits commands on behalf of the first process. This universal design reduces the need for separate dedicated components for each function, thereby reducing overall system complexity while maintaining robust security through multiple authentication methods.
Data Source
AI summary
Provided are a computer program product, system, and method for elevating permission to a process to submit a command when the process did not satisfy a security requirement for the command. A command is received from a first computer process to perform an operation effecting a protected resource in the computing system. A determination is made whether the command satisfies a security requirement of the protected resource. In response to determining that the command does not satisfy the security requirement of the protected resource, transmitting information indicating that the command did not satisfy the security requirement for the protected resource to one of the first computer process or a second computer process controlling whether to elevate permission to the protected resource. The first computer process is provided elevated permission to perform the command to affect the protected resource in response to the second computer process providing the elevated permission.