Method and Apparatus for Controlling Access to a Resource in a Computer Device
AssigneeAvecto Limited
InventorMark James Austin
Life of this patent
Estimating the term…
Abstract
A computer device and method are described for controlling access to a resource. An execution environment executes a user process with access privileges according to a user security context. A security unit controls access to resources according to the user security context, with the user process making system calls to the security unit. A proxy hook module embedded within the user process intercepts the system call and generates a proxy resource access request. A proxy service module in a privileged security context validates the proxy resource access request from the proxy hook module and, if validated, obtains and returns a resource handle that permits access to the desired resource by the user process.
Claims20
A method of controlling access to a resource in a computer device, the method comprising:
- executing a user process in an execution environment of the computer device according to a user security context which defines access privileges of the user process;
- controlling access by the user process to a plurality of resources available in the execution environment according to the user security context by a security unit of the computer device, wherein the user process is arranged to request access to a desired resource of the plurality of resources by making a system call to the security unit;
- intercepting the system call made by the user process to request access to the desired resource by a proxy hook module embedded within the user process;
- generating a proxy resource access request by the proxy hook module in response to intercepting the system call and sending the proxy resource access request to a proxy service module executing in a privileged security context different from the user security context of the user process;
- validating the proxy resource access request by the proxy service module and, if validated, obtaining from the security unit a resource handle that permits access to the desired resource;
- and
- returning the resource handle from the proxy service module to the user process via the proxy hook module thereby permitting access by the user process to the desired resource.
A computer device, comprising:
- an execution environment configured to execute a user process according to a user security context which defines access privileges of the user process;
- a security unit configured to selectively control access by the user process to a plurality of resources available in the execution environment according to the user security context, wherein the user process is configured to request access to a desired resource of the plurality of resources by making a system call to the security unit;
- and
- a proxy resource access unit comprising:
- a proxy hook module embedded within the user process, wherein the proxy hook module is configured to intercept the system call made by the user process to request access to the desired resource and to generate a proxy resource access request in response thereto;
- and
- a proxy service module configured to execute in a privileged security context different from the user security context of the user process, wherein the proxy service module is configured to validate the proxy resource access request from the proxy hook module and, if validated, to obtain from the security unit a resource handle that permits access to the desired resource and to return the resource handle to the user process via the proxy hook module thereby permitting access by the user process to the desired resource.
A tangible, non-transient computer readable medium having recorded thereon instructions which, when implemented by a computer device, cause the computer device to perform the steps of:
- executing a user process in an execution environment of the computer device according to a user security context which defines access privileges of the user process;
- controlling access by the user process to a plurality of resources available in the execution environment according to the user security context by a security unit of the computer device, wherein the user process is arranged to request access to a desired resource of the plurality of resources by making a system call to the security unit;
- intercepting the system call made by the user process to request access to the desired resource by a proxy hook module embedded within the user process;
- generating a proxy resource access request by the proxy hook module in response to intercepting the system call and sending the proxy resource access request to a proxy service module executing in a privileged security context different from the user security context of the user process;
- validating the proxy resource access request by the proxy service module and, if validated, obtaining from the security unit a resource handle that permits access to the desired resource;
- and
- returning the resource handle from the proxy service module to the user process via the proxy hook module thereby permitting access by the user process to the desired resource.
Dependencies are inferred from the claim text.