Userspace Permissions Service for Granular Security Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing devices face challenges in managing application permissions effectively, leading to potential security risks due to broad permission requests from applications, confusion for users, and difficulties in reviewing malicious behavior, which can result in privacy issues and security flaws.
Innovation Solution
A userspace security service that intercepts permission requests, provides granular permissions, and allows users to specify preferences and blacklists, enabling informed decision-making and rapid security updates without modifying the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the operating system's security module controls all permissions, then security control is comprehensive, but the system complexity increases and updates require OS modification
Solution Approach 1:
The patent segments the security control system into two independent parts: the operating system's security module that provides comprehensive security control, and the userspace security service that handles permission management independently. This segmentation allows the userspace service to manage permissions without requiring OS modification, thus maintaining security control while reducing system complexity.
Solution Approach 2:
The userspace security service acts as an intermediary between applications and the operating system's security module. It receives permission requests from applications, makes security decisions based on user preferences and blacklists, and only passes approved requests to the OS security module. This intermediary approach simplifies the overall system by handling security logic in userspace rather than requiring direct OS integration.
2Adaptability or versatility
If applications request broad permissions, then application functionality is comprehensive, but security risks and privacy issues increase
Solution Approach 1:
The patent implements local quality by allowing different permission levels for different applications based on their specific needs and user-defined preferences. Instead of applying a uniform permission policy, the userspace security service evaluates each application's requests individually against user preferences and blacklists, granting only the necessary permissions for that specific application's functionality while maintaining security.
Solution Approach 2:
The system applies partial action by granting applications only the specific permissions they need rather than broad permissions. The userspace security service intercepts permission requests and selectively approves only those that align with user preferences and security policies, preventing applications from obtaining excessive permissions even if they request them.
3Ease of operation
If users are presented with permission requests, then user control is provided, but user confusion increases due to multiple requests
Solution Approach 1:
The userspace security service performs preliminary action by pre-evaluating permission requests against user preferences and blacklists before presenting them to users. This filtering mechanism reduces the number of permission requests users need to review by automatically approving or denying requests that clearly align with or violate established security preferences, thereby reducing user confusion while maintaining control.
4Reliability
If security updates are integrated into the operating system, then security patches are comprehensive, but update speed is reduced due to OS update requirements
Solution Approach 1:
The patent extracts the permission management security functionality from the operating system and places it in a separate userspace security service. This extraction allows security updates to be applied independently to the userspace service without requiring full OS updates, significantly increasing update speed while maintaining comprehensive security patching capability.
Data Source
AI summary
In one example, a method includes intercepting, by a first security module, a request from a software application executing on the computing device to access a resource of the computing device. The first security module may include a first group of permissions received from a second security module included in an operating system. The second security module may control access by software applications executing on the computing devices to resources of the computing device based upon permissions granted to the software applications. The method may also include identifying a second group of permissions granted to the software application. The second group of permissions may be a subset of the first group of permissions. The method may also include determining, based upon the first group of permissions, whether the software application is allowed to access the resource. The method may also include controlling access to the resource, based on the determining.