Patent ID: 9443081
Filing Date: 2016-09-13
CPC Classification: G06F

Claim Text:
1. A method, implemented by a processor of a computing device, of controlling access to a resource in the computer device, the method comprising: executing processes in an execution environment of the computer device supported by an operating system of the computer device, wherein the processes include a user process which executes according to a user security context set by the operating system and which defines a first set of access privileges of the user process; making a system call to the operating system of the computer device by the user process to request access to a particular resource, the particular resource being amongst a plurality of resources which are available in the execution environment of the computer device, and wherein access to the plurality of resources is controlled by the operating system, and wherein the first set of access privileges of the user process do not permit access to the particular resource; intercepting the system call made by the user process to request access to the particular resource, the intercepting being performed by a proxy hook function embedded within the user process; generating a proxy resource access request, the proxy resource access request being generated by the proxy hook function embedded within the user process in response to the intercepting the system call by the proxy hook function embedded within the user process; sending the proxy resource access request from the proxy hook function embedded within the user process to a proxy service function executing in a privileged security context in the execution environment of the computer device, wherein the privileged security context of the proxy service function has a second set of access privileges which are different from the first set of access privileges of the user security context of the user process, and wherein the second set of access privileges of the proxy service function permit access to the particular resource; validating the proxy resource access request by the proxy service function and, if validated, obtaining, by the proxy service function, a resource handle, having an associated level of access, issued by an object manager of the operating system that permits access to the particular resource according to the level of access; returning the resource handle issued by the object manager of the operating system from the proxy service function to the user process via the proxy hook function embedded in the user process; and accepting a request from the user process by the object manager to access the particular resource wherein when the request includes a name of the particular resource and not the resource handle, accessing the particular resource using the name if additional security checks are performed successfully and wherein when the request includes the resource handle of the particular resource and not the name of the particular resource, and if the request does not require access which exceeds the level of access, accessing the particular resource using the resource handle without performing the additional security checks.