ServiceKeeper API Authorization via SEInfo Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security solutions, such as SE for Android, face limitations in identifying application callers for signature or system-based permissions, as UID is not unique across devices and PID is not a strong credential for authorization, restricting access to only system services or apps with the same signature.
Innovation Solution
The ServiceKeeper module allows any application to authorize access to services or APIs by querying an embedded authorization policy file, enabling different permissions for various callers and integrating with the SEInfo data structure for secure access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If UID and PID are used to identify the caller for signature or system-based permissions check, then the security mechanism can identify system services or system apps, but the caller identification is limited and cannot uniquely identify application callers across different devices
Solution Approach 1:
The patent introduces SEInfo as an intermediary credential that bridges the gap between traditional UID/PID identification and the need for unique, device-agnostic application identification. SEInfo acts as a mediator that contains both the application identifier and device-specific information, allowing the system to verify caller identity reliably while maintaining versatility across different devices and applications.
Solution Approach 2:
The patent creates a composite identification mechanism by combining multiple elements (application identifier, device identifier, and security credentials) into a unified SEInfo structure. This composite approach allows the system to leverage the strengths of each component: the uniqueness of application identifiers, the device-specific nature of device identifiers, and the security of embedded credentials, thereby resolving the contradiction between reliable and versatile caller identification.
2Device complexity
If the caller is limited to system service or system app with the same signature, then the security check is simplified, but the authorization system lacks flexibility to allow any application to access services
Solution Approach 1:
The patent implements a dynamic authorization system where the SEInfo structure can adapt to different caller types and service requirements. Instead of a static restriction to only system services or apps with matching signatures, the system dynamically evaluates SEInfo credentials to determine appropriate access rights, allowing any application to access services based on its credentials and the service's authorization policy.
Solution Approach 2:
The SEInfo structure serves multiple functions: it acts as a credential for system services, an identifier for applications across devices, and a basis for flexible authorization decisions. This universal structure replaces the need for separate identification mechanisms for different caller types, enabling any application to securely access services while maintaining system security.
3Ease of operation
If PID is used as the credential for authorization, then the identification is simple, but PID changes at run-time and is not a strong credential for authorization
Solution Approach 1:
The patent performs preliminary action by embedding the application identifier and device identifier into the SEInfo structure during application installation or initialization, before runtime PID changes occur. This pre-established credential remains stable throughout the application's lifecycle, providing a reliable basis for authorization decisions regardless of runtime PID variations.
Solution Approach 2:
Instead of relying on the transient PID that changes at runtime, the patent creates a stable copy of the application's identity information (package name, device identifier) within the SEInfo structure. This copied identity information remains constant and can be reliably used for authorization checks throughout the application's execution, eliminating the reliability issues associated with changing PIDs.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An apparatus and method to authorize Application Programming Interface (API) or method level access in system and application services are provided. The method includes receiving a request for access to a service from another service or an application via an interface accessible by the other service or the application, and determining whether to authorize the request based at least in part on a specified policy.