Computer Security Module Whitelist Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems are ineffective in suppressing and controlling the execution of malicious software, as hackers increasingly attempt to install and run malicious programs on computing systems, compromising their security.
Innovation Solution
A computer security module (CSM) is implemented to control the execution of programs by identifying privileged sources through a whitelist and access control lists, restricting access to resources, and employing secure boot mechanisms to prevent unauthorized execution, especially in safe or maintenance modes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security systems are used to allow program execution, then system usability and flexibility are maintained, but security against malicious software is insufficient
Solution Approach 1:
The patent segments the execution environment into privileged and unprivileged sources, using separate data structures (white list and access control lists) to manage each category. This segmentation allows the system to enforce security policies on specific execution paths without redesigning the entire system, thereby improving security while maintaining manageable complexity.
Solution Approach 2:
The system performs preliminary actions by pre-defining white lists of privileged sources and access control lists for unprivileged sources before execution occurs. These lists are established in advance and used to automatically enforce security policies, eliminating the need for complex runtime analysis and reducing overall system complexity.
2Reliability
If access control lists are implemented to restrict execution, then security is improved, but system complexity increases
Solution Approach 1:
The access control list data structure serves multiple functions: it identifies unprivileged sources, stores executable instructions for controlling access, and enables automatic enforcement of security policies. This multi-functionality reduces the need for separate complex mechanisms, thereby improving security while keeping the added complexity manageable.
Solution Approach 2:
The system uses the access control lists to automatically control program execution without requiring continuous human intervention or complex external validation. The lists self-enforce security policies by automatically comparing program sources against defined rules, improving security while simplifying the operational complexity.
3Reliability
If privileged sources are restricted to white lists, then security is enhanced, but system adaptability decreases
Solution Approach 1:
The system dynamically evaluates program sources against the white list and access control lists at runtime, rather than using static restrictions. This dynamic evaluation allows the system to adaptively control execution based on current conditions while maintaining security, thereby enhancing security without permanently reducing system adaptability.
Solution Approach 2:
The system incorporates feedback mechanisms that allow administrators to update white lists and access control lists based on observed security threats and legitimate execution patterns. This feedback loop enables the system to adapt to new requirements while maintaining security, resolving the contradiction between security and adaptability.
Data Source
AI summary
Computer security techniques are described. One example provides a security module. The security module executes on a computing system and determines whether to allow a user or a program (e.g., native executable, script, etc.) associated with the user to access a resource, such as by reading, writing, or executing a file. This decision is based at least in part on whether an access control list that is associated with the resource specifies that a source (e.g., IP address, hardware address) that is associated with the user is allowed to access the resource. This decision can also or instead be based on whether the computing system is executing in maintenance mode, such as in single-user diagnostic mode.