Patent ID: 8595170
Filing Date: 2013-11-26
Classification: G06F,G06N

Abstract:
1. A real-time stateful reference monitor software product comprising, on a non-transitory machine-readable medium, a sequence of instructions defining: a storage area where real-time state information is stored and from which the real-time state information is restored; wherein the real-time state information comprises information that events associated with a first user, occurred within a certain time, and that events associated with a second user occurred at a particular time; and wherein the real-time state information is dynamically updated as the events, associated with the first user and the second user, are received at the storage area; plural interceptors identifying and governing activity of requests, from the first user and the second user, for operating system resources by enforcing a decision to allow or block the activity; a monitor which computes a decision to allow or block a particular activity, from the first user, identified by a particular interceptor comprising: a plurality of rules which define permissible resource references in view of the activity of requests identified by the interceptors, and in view of the real-time state information comprising both the events associated with the first user and the events associated with the second user; a rule interpreter which applies the rules to the real-time state information including both the events associated with the first user and the events associated with the second user, and to the particular activity identified by the particular interceptor; wherein the rules are triggered when the first user and the second user are different users, and the rules are not triggered when the first user and the second user are the same user.