Security Module for Exception Handling in Software Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current apparatus security systems face challenges in effectively detecting and responding to security threats, such as buffer overruns and execution of malicious instructions in non-executable memory regions, which can lead to unauthorized access and attacks.
Innovation Solution
Incorporating a security module that communicates with exception handlers to detect and manage security exceptions, allowing for policy-driven operations based on risk levels, thereby reducing the complexity and memory requirements of programs and enhancing threat mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If programs implement their own exception handling for security threats, then they can respond to security exceptions, but program complexity and memory requirements increase
Solution Approach 1:
The patent extracts security exception handling functionality from individual programs and consolidates it into a separate security module. The security module receives security exceptions from exception handlers and determines appropriate operations, thereby reducing program complexity while maintaining security response capability. This is achieved by having the security module independently analyze policy information and determine operations without requiring programs to implement their own complex security logic.
Solution Approach 2:
The security module acts as an intermediary between exception handlers and the operating system or other system components. Exception handlers forward security exceptions to the security module, which then determines and executes appropriate operations based on policy information. This intermediary approach allows programs to remain simple while still benefiting from comprehensive security exception handling.
2Reliability
If programs implement their own exception handling for security threats, then they can respond to security exceptions, but memory consumption increases
Solution Approach 1:
The patent extracts security exception handling functionality from individual programs and consolidates it into a separate security module. The security module receives security exceptions from exception handlers and determines appropriate operations, thereby reducing program complexity while maintaining security response capability. This is achieved by having the security module independently analyze policy information and determine operations without requiring programs to implement their own complex security logic.
Solution Approach 2:
The security module provides universal security exception handling services to multiple programs simultaneously. Instead of each program implementing its own security exception handling code (which would duplicate functionality and increase total memory consumption), a single security module serves all programs, reducing overall memory usage while maintaining comprehensive security coverage.
3Reliability
If security exceptions are monitored and policy information is enforced, then system security is enhanced, but processing time and operational complexity increase
Solution Approach 1:
The patent implements preliminary action by having the security module receive and analyze policy information in advance, before security exceptions occur. Policy information is established beforehand, allowing the security module to quickly determine appropriate operations when security exceptions are detected, rather than having to analyze and decide in real-time during threat events. This pre-prepared policy framework reduces processing time during actual security incidents.
4Reliability
If a security module is introduced to manage security exceptions, then security management becomes more robust, but system complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the security management system into distinct functional components: exception handlers that detect security exceptions, a security module that analyzes policy information and determines operations, and the underlying operating system or application programs. This segmentation allows each component to have a specific, well-defined responsibility, making the overall system more manageable and maintainable despite the added robustness of centralized security management.
Data Source
Figure 1A~2A
Figure 2B~3A
Figure 3B~3C
AI summary
Technologies are provided in embodiments for receiving policy information associated with at least one security exception, the security exception relating to execution of at least one program, determining an operation associated with the security exception based, at least in part, on the policy information, and causing the operation to be performed, based at least in part, on a determination that the at least one security exception occurred.