Terminal Permission Segmentation for Root Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Smartphone users face security risks due to the ability of malicious applications to obtain root permission by exploiting vulnerabilities and installing the SU command in system directories, which allows unauthorized access to system files, compromising terminal security.
Innovation Solution
Implementing a terminal and method that store a list of authorized applications for manager permission, using a processor to determine and manage permissions, and employing shared memory to bridge modem and application processors, ensuring only authorized applications receive manager permission, thereby restricting malicious rooting attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SU execution file is removed from system directories for security protection, then terminal security is improved, but the ability to legally customize the terminal and access system files is worsened
Solution Approach 1:
The patent segments the permission system into two distinct types: manager permission and general user permission. Manager permission is restricted to a predefined list of authorized applications for system customization, while general user permission is granted to other applications with limited access. This segmentation resolves the contradiction by maintaining security through restricted access while preserving legitimate customization capabilities for authorized applications.
Solution Approach 2:
The patent applies local quality by differentiating permission levels based on application identity. Authorized applications receive manager permission with enhanced access rights for customization, while unauthorized applications receive only general user permission. This localized differentiation of qualities allows the system to maintain both security and adaptability simultaneously.
2Adaptability or versatility
If root permission is granted to all applications for system access, then adaptability is improved, but security is worsened due to malicious rooting attempts
Solution Approach 1:
The patent segments application permissions into manager permission and general user permission. Only applications included in the predefined authorized list receive manager permission, while all other applications are limited to general user permission. This segmentation prevents malicious applications from obtaining root access while still allowing authorized applications to customize the terminal.
Solution Approach 2:
The patent implements preliminary action by pre-defining and storing an authorized application list before any permission granting occurs. The system checks whether an application is included in this pre-established list before granting manager permission, thereby preventing malicious rooting attempts in advance while ensuring legitimate customization capabilities.
3Ease of operation
If the SU command is made executable for general users, then ease of operation is improved, but security is worsened due to unauthorized root access
Solution Approach 1:
The patent segments execution permissions based on application authorization status. The SU command remains executable for authorized applications needing customization, but is blocked for unauthorized applications. This segmentation maintains ease of operation for legitimate use cases while preventing unauthorized root access.
Solution Approach 2:
The patent introduces an intermediary mechanism - the permission determination system that mediates between the SU command and application execution. This intermediary checks whether an application is authorized before allowing SU command execution, thereby maintaining operational ease for authorized applications while blocking unauthorized access.
Data Source
AI summary
A terminal to assign permission to an application includes a storage device to store an application list including information of applications authorized to receive manager permission, and an application processor to receive a request for the manager permission from the application and to determine to allow the manager permission to the application in response to a determination that the application is included in the application list. A method that uses a processor to assign permission to an application includes receiving a request for manager permission from the application, determining, using the processor, whether the application is included in an application list including information of applications authorized to receive manager permission, and determining whether to allow the manager permission to the application if the application is included in the application list.