Virtual Machine File System Access Control via Dynamic ID Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data access management in secure runtime environments like Java Card is inefficient due to security restrictions, making it difficult for applications to exchange data securely and leading to data loss when one application is destroyed, and only allowing single application access to file system nodes.
Innovation Solution
A virtual machine (VM) operates over a file system by assigning user-IDs and group-IDs to applications, allowing dynamic access management and reassignment, ensuring secure data exchange and access control, with the VM acting as a master controller and the file system as a slave in the security chain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security restrictions are implemented in Java Card runtime environment to prevent unauthorized data access, then security is improved, but data exchange efficiency between applications deteriorates
Solution Approach 1:
The patent introduces a file system as an intermediary layer between applications and storage, managed by a virtual machine. This mediator enables secure data exchange by controlling access through user-IDs and group-IDs, allowing applications to share data without direct access to each other's memory spaces, thus maintaining security while improving exchange efficiency.
Solution Approach 2:
The virtual machine implements a universal access control mechanism that serves multiple applications simultaneously. By assigning user-IDs and group-IDs to applications and managing file system access rights centrally, the system provides a multi-functional security framework that handles data exchange between any pair of applications without requiring application-specific security implementations.
2Reliability
If CHROOT isolation is used to separate application file system access, then application isolation security is improved, but data sharing capability deteriorates
Solution Approach 1:
The patent replaces static CHROOT isolation with dynamic access control. Instead of permanently isolating applications in separate file system trees, the virtual machine dynamically assigns user-IDs and group-IDs to applications and adjusts file system access rights based on runtime requirements, enabling both isolation and sharing as needed.
Solution Approach 2:
The patent segments access rights into user-IDs and group-IDs, allowing fine-grained control over which applications can access which file system nodes. This segmentation enables partial sharing where applications can access specific files or directories while remaining isolated from others, rather than complete isolation or complete sharing.
3Reliability
If byte array data exchange is used according to Java Card specification, then security is maintained, but data exchange efficiency deteriorates
Solution Approach 1:
The patent eliminates the need for repeated byte array copying by allowing applications to access data directly from the file system through the virtual machine's access control mechanism. Instead of copying data between application memory spaces, the system provides direct file system access with security checks, reducing overhead and improving efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to computer-implemented method for operating a virtual machine (212) over a file system (314), whereby the file system comprises a plurality of file system nodes (FSN1-FSN13) having respectively assigned a first user-ID (U-ID A, U-ID B) and/or a first group-ID (G-ID T), and whereby one or more first application programs (208-209) are running on the virtual machine, the method comprising: - assigning (101) the first application program a second user-ID (U-ID A', U-ID B') and/or a second group-ID (G-ID T'), - accessing (102) at least one of the plurality of file system nodes by the virtual machine for providing read and/or write access for the first application program to said at least one file system node, - evaluating (103) the first user-ID and/or first group-ID and the second user-ID and/or group-ID, whereby the evaluation returns a positive result only if at least one of a set of conditions applies, and whereby the evaluation returns a negative result if none of said condition applies, - granting (104) access to the first application program to said at least one file system node in case the evaluation result is positive, and - prohibiting (105) the access of the first application program to said at least one file system node if the evaluation result is negative.