RPC Server Security via Segmented Client Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems cannot differentiate between Universal Windows Platform (UWP) and Win32 applications, allowing less-secure Win32 applications to access system objects they are not authorized to, posing a security threat as the operating system cannot prevent Win32 applications from accessing RPC interfaces.
Innovation Solution
Implementing custom UWP security identifiers and access control lists to restrict Win32 applications' access, ensuring that only authorized applications can connect to system objects by analyzing the access control list of client applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional client identifiers (e.g., Client PID) are used to identify applications to an RPC server, then the system maintains compatibility with legacy Win32 applications, but the operating system cannot differentiate between UWP and Win32 applications, allowing unauthorized Win32 applications to access system objects
Solution Approach 1:
The patent segments the client identifier system into two distinct parts: the original Client PID for Win32 application identification and a new custom UWP application identifier for UWP application identification. This segmentation allows the RPC server to differentiate between application types while maintaining backward compatibility. The server can now process identifiers differently based on type, enabling security differentiation without breaking legacy Win32 application support.
2Reliability
If the operating system implements security measures to prevent unauthorized UWP applications from communicating over RPC interfaces, then security for UWP applications is improved, but Win32 applications remain vulnerable because the OS cannot distinguish them from authorized applications
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a custom UWP application identifier that acts as a mediator between the RPC server and client applications. This intermediary identifier enables the server to recognize and differentiate UWP applications from Win32 applications, allowing the OS to apply appropriate security measures to each type. The identifier serves as a bridge that translates application type information into security authorization decisions.
3Reliability
If custom UWP security identifiers and access control lists are implemented to restrict Win32 applications' access, then security against unauthorized Win32 applications is improved, but the system complexity increases due to additional security checks
Solution Approach 1:
The patent implements preliminary action by establishing access control lists (ACLs) and custom UWP security identifiers before RPC connections are made. The RPC server pre-configures security permissions and identifier mappings, so that when connection requests arrive, the server can quickly verify authorization without complex runtime analysis. This preliminary setup reduces the complexity of real-time security checks while maintaining strong security posture.
Data Source
AI summary
An information handling system may identify a process identifier of a client application that has requested a connection with the information handling system. The information handling system may obtain an access control list of a process associated with the process identifier. The information handling system may determine whether to establish a connection between the client application and the information handling system based, at least in part, on analysis of the access control list.