Resource Restriction Enforcement via System Call Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively enforce resource restrictions on computer devices, as users can circumvent restrictions by generating system calls for restricted resources, allowing unauthorized access.
Innovation Solution
A system comprising a data store, a resource restriction service, and a resource agent that determines whether system calls are restricted based on user identifiers, intercepts execution calls, and grants or denies access accordingly, ensuring that resource restrictions are enforced at the operating system level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If resource restrictions are implemented by preventing menu items and desktop icons, then ease of operation is improved for restricted users, but reliability of restriction enforcement deteriorates because users can still access resources through system calls
Solution Approach 1:
The patent introduces an intermediary component (restriction enforcement mechanism) that sits between the user and the resource, intercepting system calls and preventing access to restricted resources. This mediator blocks execution calls, file operations, and other system-level access attempts, ensuring that restrictions cannot be circumvented through alternative methods like HTML links or programmatic calls.
Solution Approach 2:
The system performs preliminary actions by pre-defining restriction rules and establishing the enforcement mechanism before any resource access attempts occur. The restriction criteria are set in advance, and the system proactively monitors and blocks potential violations before they can execute, rather than reacting to breaches after they occur.
2Reliability
If resource restrictions are enforced by blocking application launches, then reliability of restriction enforcement is improved, but device complexity increases due to additional system components
Solution Approach 1:
The restriction enforcement mechanism is designed as a universal system that handles multiple types of resource access through a single unified approach. It can block application launches, file access, network connections, and other resource operations using the same underlying enforcement architecture, eliminating the need for separate restriction mechanisms for each resource type and reducing overall system complexity.
Solution Approach 2:
The system uses parameter-based restriction rules that can be configured to control different resources without changing the core enforcement mechanism. By modifying restriction parameters (such as specifying different applications, files, or resource types), the system can enforce various restriction scenarios using the same structural framework, thereby maintaining simplicity while achieving comprehensive control.
Data Source
AI summary
Resource restrictions are associated with a user identifier. A resource restriction agent receives operating system calls related for resources and provides resource request data to a resource agent. The resource agent determines whether the resource is restricted based on the resource request data and resource restriction data and generates access data based on the determination. The resource restriction agent grants or denies the system call based on the access data.