Symbol-Level Entitlement Enforcement in Application Loaders
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems enforce entitlements at a coarse granularity, leading to security vulnerabilities as applications automatically inherit entitlements from libraries, even if they do not need them, and lack control over entitlements at load/link time.
Innovation Solution
Implementing a loader with entitlement enforcement logic that manages entitlements at a symbol-level granularity, allowing each function to be designated with or without specific entitlements, and using a special API or token for applications to access entitled functions, ensuring precise control over entitlements during the loading process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If entitlements are enforced at process granularity (application level), then ease of operation is improved, but security is worsened due to automatic inheritance of entitlements from libraries
Solution Approach 1:
The patent segments entitlement enforcement from process level to symbol level. Instead of granting entitlements to entire applications or libraries, the system divides entitlements into fine-grained units associated with individual symbols (functions, variables). The loader checks entitlements at each symbol reference point, granting access only when the referring symbol has the required entitlement. This segmentation resolves the contradiction by maintaining operational simplicity while eliminating automatic entitlement inheritance, thereby improving security.
2Reliability
If entitlements are enforced at symbol-level granularity, then security is improved, but device complexity increases due to enhanced entitlement tracking and checking mechanisms
Solution Approach 1:
The patent applies preliminary action by performing entitlement checks at load/link time before applications are fully executed in memory. The loader verifies entitlements for each symbol reference during the loading process, rather than checking at runtime when the application is already running. This advance verification reduces the complexity of runtime entitlement management while maintaining high security, as entitlement violations are caught before execution begins.
Solution Approach 2:
The loader acts as an intermediary between symbols and their referenced entities. It mediates the entitlement verification process by checking whether referring symbols have the necessary entitlements to access referenced symbols, and by resolving symbol references only when entitlement requirements are satisfied. This intermediary role centralizes the complexity of entitlement management in the loader, simplifying the overall system architecture while enabling fine-grained security control.
3Ease of operation
If entitlements are checked at runtime after full loading, then ease of operation is maintained, but loss of time occurs due to delayed security verification
Solution Approach 1:
The patent performs entitlement verification as a preliminary action during the load/link phase, before applications are fully loaded into memory and before execution begins. By checking entitlements for each symbol reference during loading rather than during runtime execution, the system eliminates the time loss associated with runtime security checks. This approach maintains operational simplicity while significantly reducing the time required for security verification.
Data Source
AI summary
A method, apparatus and machine readable medium are described for managing entitlements on a computing device. For example, one embodiment of a method comprises: loading a first application into a system memory of a computing device; for each library value/symbol pair referenced by the first application, determining whether the first application has a correct entitlement to be linked with the library value/symbol pair; wherein if the application does not have the correct entitlement associated with the library value/symbol pair, then denying linking to the library value/symbol pair and/or linking the application to an alternate library value/symbol pair which does not have the entitlement associated therewith; and if the application has the correct entitlement associated with the library value/symbol pair, then linking the application to the library value/symbol pair with the entitlement in the system memory.