Storage Access Controller Enforcing External Dataset Permissions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Maintaining the security and integrity of a computer system is challenging when an administrator account is compromised or unauthorized, as it can lead to unauthorized access and modification of sensitive data.
Innovation Solution
Implementing a storage access controller (SAC) that independently manages access permissions for datasets on physical storage devices, ensuring that access control is enforced externally to the operating system, thereby preventing unauthorized alterations even if the OS is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access permissions are managed within the operating system, then ease of operation is improved, but security and integrity deteriorate when administrator accounts are compromised
Solution Approach 1:
The patent divides the access control function into two independent parts: the operating system manages user interfaces and basic permissions, while a separate kernel module (loaded from outside the OS) enforces critical security permissions. This segmentation ensures that even if the OS is compromised, the core security controls remain intact and cannot be easily altered by unauthorized users.
Solution Approach 2:
The patent introduces a kernel module as an intermediary between the operating system and the file system. This mediator sits in the call chain (e.g., between openat() and openat64()) and intercepts access requests to verify permissions against a separate permission database, preventing direct OS-level access to critical files even by compromised administrator accounts.
2Ease of operation
If administrator accounts have full access permissions, then ease of operation is improved, but security deteriorates when accounts are compromised
Solution Approach 1:
The patent implements preliminary anti-action by pre-configuring a separate permission database that explicitly denies access to critical system files, even for administrator accounts. The kernel module checks this database before allowing any access operations, effectively pre-blocking potential unauthorized actions before they can occur, regardless of the user's apparent permission level in the OS.
3Device complexity
If access control is enforced by the operating system, then device complexity is reduced, but reliability deteriorates when the OS is compromised
Solution Approach 1:
The patent implements a nested structure where the kernel module (containing critical security logic) is loaded within the operating system environment but operates independently. The kernel module has its own permission database and enforcement logic that is nested within the OS call chain but remains externally managed, allowing the OS to remain relatively simple while embedding robust security controls.
Data Source
AI summary
A method and system for controlling access to data. Each dataset of L datasets is stored, via storage access controller (SAC) software external to an operating system, on at least one physical storage device. Each dataset is independently accessible in accordance with an access permission type assigned to each dataset independently selected for each dataset from N unique access permission types. N≥2 and L≥N. The L datasets and a file integrity table (FIT) are stored in a file system of the operating system. The FIT includes the L datasets, a path that locates each dataset in the file system, and an access permission type assigned to each dataset. Control of access to each dataset stored on the at least one physical storage device is configured in the SAC to enforce, by the SAC, access to each dataset in accordance with the access permission type assigned to each dataset.