Security Attribute Masking Privileged Command Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Role-based Access Control (RBAC) systems, traditional access permissions assigned to users rather than roles create security vulnerabilities, allowing unauthorized access to objects created by privileged commands, leading to potential information leaks and security breaches due to manual errors in permission settings.
Innovation Solution
Introducing a security attribute, such as a umask, that masks default access permissions of objects created by privileged commands, allowing authorized users to customize and apply these attributes based on the type of privileged command, thereby modifying access permissions to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional access permissions are assigned to users individually, then ease of operation is improved, but security is worsened due to security vulnerabilities and unauthorized access
Solution Approach 1:
The patent introduces a security attribute as an intermediary layer between the user and the object access permissions. This security attribute acts as a mediator that enforces role-based access control by blocking certain default permissions, thereby preventing unauthorized access while maintaining the simplicity of traditional permission assignment. The security attribute serves as a protective barrier that automatically applies security policies without requiring manual intervention.
Solution Approach 2:
The patent applies preliminary anti-action by pre-configuring security attributes that block harmful default access permissions before unauthorized access can occur. Instead of reacting to security breaches after they happen, the system proactively prevents them by automatically applying restrictive permissions based on user roles, thereby countering potential security threats in advance.
2Adaptability or versatility
If manual permission setting is required, then adaptability is improved, but reliability is worsened due to manual errors and inconsistencies
Solution Approach 1:
The patent implements self-service by enabling the system to automatically manage and enforce access permissions based on user roles and security attributes. Instead of relying on manual administrative intervention, the system autonomously applies security policies, blocks inappropriate permissions, and ensures consistency across all objects. This automated approach eliminates human errors while maintaining adaptability to different security requirements.
Solution Approach 2:
The patent utilizes parameter changes by dynamically modifying access permission parameters based on user roles and security attributes. The system automatically adjusts permission levels, blocking certain default permissions for specific user categories, thereby ensuring consistent security enforcement across different contexts without requiring manual reconfiguration.
3Reliability
If uniform access permissions are enforced, then security is improved, but ease of operation is worsened due to reduced flexibility
Solution Approach 1:
The patent applies local quality by implementing differentiated security attributes for different user roles and object types. Instead of applying a single uniform permission set system-wide, the system tailors security restrictions to specific local contexts - different roles receive different levels of permission blocking based on their security requirements. This ensures both security and operational flexibility by allowing appropriate variations in permission enforcement.
Solution Approach 2:
The patent introduces dynamics by making access permissions flexible and adaptable based on user roles and security attributes. The system dynamically determines which permissions to block and which to allow, rather than enforcing rigid uniform restrictions. This dynamic approach maintains security by blocking harmful permissions while preserving operational flexibility by allowing necessary access for authorized users.
Data Source
AI summary
A method and system for restricting access to objects created by privileged commands. In an RBAC environment, execution of certain privileged commands creates objects, which typically, have traditional access permissions based on the user ID and not the role. To enhance security of these objects, a new security attribute is introduced. The security attribute can be associated to the privileged command. Therefore, whenever a privileged command creates an object, the security attribute associated with the privileged command is applied on the object. The security attribute can mask the traditional access permissions of the object, and modify the access permissions, which can be stored along with the object. An AND operation can be performed on the traditional access permissions and the security attribute, to determine the modified permissions of the object. Further, an authorized user can modify, add, delete, or customize the security attribute at any time.