Source: http://www.google.com/patents/US8181219?dq=7,346,539
Timestamp: 2016-02-08 07:22:55
Document Index: 199067971

Matched Legal Cases: ['Application No. 2005209678', 'Application No. 2005209678', 'Application No. 200510108862', 'Application No. 200510108867', 'Application No. 200510108867', 'Application No. 200510108867', 'Application No. 05108532', 'Application No. 05108532', 'Application No. 05108532', 'Application No. 05108704', 'Application No. 05108704', 'Application No. 05108704', 'Application No. 05', 'Application No. 2005', 'Application No. 2005', 'Application No. 2005290091', 'Application No. 10', 'Application No. 05108532', 'Application No. 200510108867', 'Application No. 200510108867', 'Application No. 05108532', 'Application No. 05108532', 'Application No. 05108532', 'Application No. 2005209678', 'Application No. 05108704', 'Application No. 2005130458']

Patent US8181219 - Access authorization having embedded policies - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsA facility for receiving an embedded policy is provided. The facility checks an application program image for the presence of an embedded policy. If an embedded policy is detected, the facility extracts the policy from within the application program image. The facility may then apply the extracted policy...http://www.google.com/patents/US8181219?utm_source=gb-gplus-sharePatent US8181219 - Access authorization having embedded policiesAdvanced Patent SearchPublication numberUS8181219 B2Publication typeGrantApplication numberUS 10/956,667Publication dateMay 15, 2012Filing dateOct 1, 2004Priority dateOct 1, 2004Fee statusPaidAlso published asCN1808325A, US8453200, US8931035, US9069941, US20060075462, US20110126260, US20120036554, US20130254835Publication number10956667, 956667, US 8181219 B2, US 8181219B2, US-B2-8181219, US8181219 B2, US8181219B2InventorsGilad Golan, Mark VaymanOriginal AssigneeMicrosoft CorporationExport CitationBiBTeX, EndNote, RefManPatent Citations (58), Non-Patent Citations (89), Referenced by (1), Classifications (10), Legal Events (4) External Links: USPTO, USPTO Assignment, EspacenetAccess authorization having embedded policies
US 8181219 B2Abstract
In some embodiments, the facility may include an optional anomaly detection module 214 as depicted by the broken or “dashed” lines in FIG. 2. Anomaly detection module 214 generally functions to monitor the behavior of computer system 100 and the programs executing on computer system 100 in order to detect an anomalous state. In some embodiments, anomaly detection module 214 provides the facility a first notification upon detecting an anomaly and a subsequent, second notification upon detecting the cessation of the previously detected anomaly. This enables the facility to activate the enforcement of policies 206 upon detection of an anomaly, until the anomaly has ended and policies 206 are no longer enforced. Alternatively, the facility may initially impose a less restrictive set of policies until an anomaly is detected, in which case a more restrictive set of policies are enforced, until the anomaly has ended and the less restrictive set of policies are again enforced. Anomaly detection module 214 may detect an anomaly in either a single process executing on computer system 100, a group of processes executing on computer system 100, or the entire computer system 100.
Operating system 1104 returns to controlling process 1202 the results of the request to set a revocable policy on controlled process 1204 (Stage 3). If the revocable policy was successfully set, operating system 1104 returns an identifier in, for example, a “cookie” to controlling process 1202. In one embodiment, the identifier authenticates the process that set the revocable policy, and is used to identify and revoke the revocable policy. Stated another way, the identifier is akin to a privilege or authorization to revoke the revocable policy, and is subsequently submitted to operating system 1104 with a request to revoke the policy. In other embodiments, the cookie may also include state information, such as an identifier that identifies a policy that was previously in effect.
In response to receiving the request to revoke a revocable policy, operating system 1104 uses the identifier contained in the cookie to authenticate the requester as a process having authorization to revoke the indicated revocable policy. Operating system 1104 may also use the identifier to identify the policy that is to be revoked. Subsequent to authenticating the requestor—either controlling process 1202 (Stage 7) or controlled process 1204 (Stage 9),—operating system 1104 revokes the revocable policy currently being applied to controlled process 1202. In another embodiment, operating system 1104 may apply a policy that was being applied to controlled process 1204 prior to the application of the just revoked revocable policy. For example, an identifier that identifies the policy that was previously in effect may be passed to operating system 1104 in the cookie that was sent with the request to revoke a revocable policy. Alternatively, operating system 1104 may have preserved the state information prior to applying the revocable policy, for example, in a persistent storage device on the computer.
Subsequently, for example, after detecting that the macro has finished executing, process 1402 sends, via access control API 1106, a request to revoke my policy, e.g., PolicyA, to operating system 1104 (Stage 5). Process 1402 submits the ‘cookie’ that was previously received from operating system 1104 with the request to revoke my policy. In response to receiving the request to revoke my policy, operating system 1104 uses the identifier contained in the cookie to authenticate process 1402 as a process having authorization to revoke the policy. Subsequent to authenticating process 1402, operating system 1104 revokes PolicyA, and applies the policy identified in the cookie to process 1402 (Stage 6). Operating system 1104 returns to process 1402 the results of the request to revoke my policy (Stage 7), and process 1402 continues processing (Stage 8). In another embodiment, the revoke my policy request may identify a policy that is to be applied subsequent to revoking the current revocable policy.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4584639Dec 23, 1983Apr 22, 1986Key Logic, Inc.Computer security systemUS5187790Apr 21, 1992Feb 16, 1993Digital Equipment CorporationServer impersonation of client processes in an object based computer operating systemUS5974549Mar 27, 1997Oct 26, 1999Soliton Ltd.Security monitorUS6317742Jan 9, 1997Nov 13, 2001Sun Microsystems, Inc.Method and apparatus for controlling software access to system resourcesUS6353886Nov 24, 1998Mar 5, 2002Alcatel Canada Inc.Method and system for secure network policy implementationUS6412070Sep 21, 1998Jun 25, 2002Microsoft CorporationExtensible security system and method for controlling access to objects in a computing environmentUS6480692Mar 13, 2001Nov 12, 2002Bridgestone CorporationToner supply roller and developing apparatusUS6625603Sep 21, 1998Sep 23, 2003Microsoft CorporationObject type specific access controlUS6647388Dec 15, 2000Nov 11, 2003International Business Machines CorporationAccess control system, access control method, storage medium and program transmission apparatusUS6681331May 11, 1999Jan 20, 2004Cylant, Inc.Dynamic software system intrusion detectionUS6691232Aug 5, 1999Feb 10, 2004Sun Microsystems, Inc.Security architecture with environment sensitive credential sufficiency evaluationUS6762764Apr 19, 2002Jul 13, 2004Kabushiki Kaisha ToshibaSystem and method for processing image, and compiler for use in this systemUS6957261Jul 17, 2001Oct 18, 2005Intel CorporationResource policy management using a centralized policy data structureUS7013332Jan 9, 2001Mar 14, 2006Microsoft CorporationDistributed policy model for access controlUS7020645Apr 19, 2001Mar 28, 2006Eoriginal, Inc.Systems and methods for state-less authenticationUS7080077Feb 26, 2001Jul 18, 2006Oracle International CorporationLocalized accessUS7103914Jun 17, 2003Sep 5, 2006Bae Systems Information Technology LlcTrusted computer systemUS7185192Jul 7, 2000Feb 27, 2007Emc CorporationMethods and apparatus for controlling access to a resourceUS7231661Jun 21, 2001Jun 12, 2007Oracle International CorporationAuthorization services with external authenticationUS7251831Apr 19, 2001Jul 31, 2007International Business Machines CorporationMethod and system for architecting a secure solutionUS7506364Oct 1, 2004Mar 17, 2009Microsoft CorporationIntegrated access authorizationUS7685632Oct 1, 2004Mar 23, 2010Microsoft CorporationAccess authorization having a centralized policyUS7818781Oct 1, 2004Oct 19, 2010Microsoft CorporationBehavior blocking access controlUS7853993Jan 5, 2009Dec 14, 2010Microsoft CorporationIntegrated access authorizationUS7904956Oct 1, 2004Mar 8, 2011Microsoft CorporationAccess authorization with anomaly detectionUS20020091798Feb 26, 2001Jul 11, 2002Joshi Vrinda S.Providing data to applications from an access systemUS20020099952Jun 8, 2001Jul 25, 2002Lambert John J.Policies for secure software executionUS20020157015Apr 19, 2001Oct 24, 2002International Business Machines CorporationMethod and system for architecting a secure solutionUS20020188568Jan 8, 2002Dec 12, 2002Center 7, Inc.Systems and methods of containing and accessing generic policyUS20020199109Jun 25, 2001Dec 26, 2002Boom Douglas D.System, method and computer program for the detection and restriction of the network activity of denial of service attack softwareUS20030009675 *Jul 2, 2002Jan 9, 2003Rygaard Christopher A.Mobile application access control list security systemUS20030023873Mar 16, 2001Jan 30, 2003Yuval Ben-ItzhakApplication-layer security method and systemUS20030115179Nov 1, 2002Jun 19, 2003Senthil PrabakaranConfiguration management for group policiesUS20030159070Nov 22, 2002Aug 21, 2003Yaron MayerSystem and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damagesUS20040010519Dec 20, 2002Jan 15, 2004Sinn Richard P.Rule based data managementUS20040128537Dec 30, 2002Jul 1, 2004International Business Machines CorporationRetrospective policy safety netUS20040139202Jan 10, 2003Jul 15, 2004Vanish TalwarGrid computing control systemUS20040181788Mar 14, 2003Sep 16, 2004Websense IncSystem and method of monitoring and controlling application filesUS20050097353Oct 8, 2004May 5, 2005Bea Systems, Inc.Policy analysis toolUS20050177724Jan 14, 2005Aug 11, 2005Valiuddin AliAuthentication system and methodUS20050256664Jun 30, 2004Nov 17, 2005Microsoft CorporationEfficient patchingUS20050257207Jun 30, 2004Nov 17, 2005Microsoft CorporationEfficient patchingUS20050257208Jun 30, 2004Nov 17, 2005Microsoft CorporationEfficient patchingUS20060005227Jul 1, 2004Jan 5, 2006Microsoft CorporationLanguages for expressing security policiesUS20060075461Oct 1, 2004Apr 6, 2006Microsoft CorporationAccess authorization having a centralized policyUS20060075462Oct 1, 2004Apr 6, 2006Microsoft CorporationAccess authorization having embedded policiesUS20060075464Oct 1, 2004Apr 6, 2006Microsoft CorporationAccess authorization APIUS20060075469Oct 1, 2004Apr 6, 2006Microsoft CorporationIntegrated access authorizationUS20060075492Oct 1, 2004Apr 6, 2006Microsoft CorporationAccess authorization with anomaly detectionUS20070143851Jun 13, 2006Jun 21, 2007FiberlinkMethod and systems for controlling access to computing resources based on known security vulnerabilitiesUS20090150990Jan 5, 2009Jun 11, 2009Microsoft CorporationIntegrated access authorizationEP1320010A2Dec 11, 2002Jun 18, 2003Pervasive Security Systems Inc.Secured data format for access controlJP2003233521A Title not availableJP2004192601A Title not availableKR19980070410A Title not availableKR20030096277A Title not availableKR20040019033A Title not availableWO2000056027A1Mar 15, 2000Sep 21, 2000Texar Software CorpComputer security system* Cited by examinerNon-Patent CitationsReference1"Audit-Failed Logon Attempts by Undefined User Accounts," IBM Technical Disclosure Bulletin, IBM Corporation, vol. 37, No. 6A, Jun. 1, 1994.2Advisory Action mailed Oct. 20, 2008, U.S. Appl. No. 10/957,029.3Ashley, P. et al., "Applying Authorization to Intranets: Architectures, Issues and APIs," Computer Communications, Elsevier Science Publishers BV, Amsterdam, NL, vol. 23, No. 17, Nov. 1, 2000.4Ashley, P., et a., "Applying Authorization to Intranets: Architectures, Issues and APIs," Computer Communications, vol. 23, No. 17, Nov. 1, 2000 (pp. 1613-1620).5Australian Communication dated May 18, 2010, in AU Application No. 2005209678.6Australian Notice of Acceptance dated May 23, 2011, in AU Application No. 2005209678.7China Patent Office of the People's Republic of China Notice on First Office Action mailed Apr. 10, 2009, in China Application No. 200510108862.7, 8 pages.8Chinese Notice on First Office Action dated Dec. 12, 2008, in Chinese Application No. 200510108867.X.9Chinese Notice on Grant of Patent Right For Invention dated Jan. 15, 2010, in Chinese Application No. 200510108867.X.10Chinese Second Office Action dated Jun. 26, 2009, in Chinese Application No. 200510108867.X.11European Communication from the Examination Division dated Aug. 6, 2008, in EP Application No. 05108532.2.12European Communication from the Examination Division dated Nov. 19, 2009, in EP Application No. 05108532.2.13European Communication from the Examination Division dated Sep. 10, 2007, in EP Application No. 05108532.2.14European Communication mailed Mar. 10, 2010, in Application No. 05108704.7, 6 pages.15European Communication mailed May 22, 2007, in Application No. 05108704.7, 10 pages.16European Search Report for EP Patent Application No. 05108704.7, Microsoft Corporation, Mar. 3, 2006.17European Search Report, European Patent Application No. 05 10 8704, Microsoft Corporation, Sep. 15, 2006.18Final Office Action mailed Jun. 23, 2008, U.S. Appl. No. 10/957,029.19Final Office Action mailed Jun. 26, 2008, U.S. Appl. No. 10/956,215.20Final Office Action mailed May 12, 2008, U.S. Appl. No. 10/957,314.21Final Office Action mailed May 14, 2008, U.S. Appl. No. 10/957,509.22Final Office Action mailed May 27, 2009, U.S. Appl. No. 10/957,314.23Final Office Action mailed Sep. 15, 2009, U.S. Appl. No. 10/957,029.24Godik S., et al., OASIS, Extensible Access Control Markup Language (XACML), Version 1.0, OASIS Standard, Feb. 18, 2003.25International Telecommunication Union, ITU-T Recommendation X.812, Data Networks and Open System Communications Security, Nov. 1995 (pp. 1-30).26International Telecommunication Union, ITU-T, Data Networks and Open System Communications Security, Information Technology-Open Systems Interconnection-Security Frameworks for Open Systems: Access Control Framework, Nov. 1995.27International Telecommunication Union, ITU-T, Data Networks and Open System Communications Security, Information Technology—Open Systems Interconnection—Security Frameworks for Open Systems: Access Control Framework, Nov. 1995.28Japanese Final Rejection mailed on Oct. 21, 2011, in Japanese Patent Application No. 2005-290091, 5 pages.29Japanese Notice of Rejection in Application 2011-220994, mailed Jan. 13, 2012, 6 pgs.30Japanese Notice of Rejection in Application 2011220995, mailed Dec. 22, 2011, 9 pgs.31Japanese Notice of Rejection in Application 2011220996, mailed Dec. 22, 2011, 9 pgs.32Japanese Notice of Rejection mailed on Jul. 5, 2011, in Japanese Patent Application No. 2005-290091, 4 pages.33Japanese Response filed on Oct. 5, 2011, in Japanese Patent Application No. 2005290091, 7 pages.34Korean Response filed Aug. 2, 2011, filed in Korean Application No. 10-2005-79907, 41 pages.35Microsoft Press Computer Dictionary: The Comprehensive Standard for Business, School, Library, and Home (2d ed., 1994), pp. 43-44.36Non-Final Office Action mailed Apr. 1, 2010, U.S. Appl. No. 10/957,314.37Non-Final Office Action mailed Feb. 5, 2010, U.S. Appl. No. 10/957,029.38Non-Final Office Action mailed Mar. 5, 2009, U.S. Appl. No. 10/957,029.39Non-Final Office Action mailed May 12, 2010 in U.S. Appl. No. 12/348,649.40Non-Final Office Action mailed May 27, 2009, U.S. Appl. No. 10/956,215.41Non-Final Office Action mailed Nov. 13, 2009, U.S. Appl. No. 10/957,314.42Non-Final Office Action mailed Nov. 14, 2007, U.S. Appl. No. 10/957,029.43Non-Final Office Action mailed Nov. 2, 2007, U.S. Appl. No. 10/957,509.44Non-Final Office Action mailed Oct. 17, 2007, U.S. Appl. No. 10/957,314.45Non-Final Office Action mailed Oct. 26, 2007, U.S. Appl. No. 10/956,215.46Non-Final Office Action mailed Oct. 27, 2008, U.S. Appl. No. 10/957,314.47Non-Final Office Action mailed Oct. 29, 2009 in U.S. Appl. No. 12/348,649.48Non-Final Office Action mailed Oct. 31, 2008, U.S. Appl. No. 10/956,215.49Non-Final Office Action mailed Sep. 7, 2011, U.S. Appl. No. 12/944,667, 5 pages.50Notice of Allowance mailed Aug. 23, 2010, in U.S. Appl. No. 10/957,029.51Notice of Allowance mailed Aug. 4, 2010, in U.S. Appl. No. 10/957,314.52Notice of Allowance mailed Jan. 5, 2010, in U.S. Appl. No. 10/957,029.53Notice of Allowance mailed Oct. 3, 2008, in U.S. Appl. No. 10/957,509.54Notice of Allowance mailed Sep. 20, 2010, in U.S. Appl. No. 12/348,649.55Partial European Search Report for EP Application No. 05108532.2, dated Aug. 16, 2006.56Reply to Chinese Notice on First Office Action dated Dec. 12, 2008, in Chinese Application No. 200510108867.X, filed Apr. 22, 2009.57Reply to Chinese Second Office Action dated Jun. 26, 2009, in Chinese Application No. 200510108867.X, filed Aug. 14, 2009.58Reply to European Communication from the Examination Division dated Aug. 6, 2008, in EP Application No. 05108532.2, filed Dec. 9, 2008.59Reply to European Communication from the Examination Division dated Nov. 19, 2009, in EP Application No. 05108532.2, filed Mar. 19, 2010.60Reply to European Communication from the Examination Division dated Sep. 10, 2007, in EP Application No. 05108532.2, filed Jan. 17, 2008.61Response Non-Final Office Action mailed Oct. 17, 2007, U.S. Appl. No. 10/957,314, filed Jan. 17, 2008.62Response to Australian Communication dated May 18, 2010, in AU Application No. 2005209678, filed May 13, 2011.63Response to European Communication mailed May 22, 2007, in Application No. 05108704.7, dated Oct. 8, 2007, 15 pages.64Response to Final Office Action mailed Jun. 23, 2008, U.S. Appl. No. 10/957,029, filed Sep. 23, 2008.65Response to Final Office Action mailed Jun. 26, 2008, U.S. Appl. No. 10/956,215, filed Sep. 26, 2008.66Response to Final Office Action mailed May 12, 2008, U.S. Appl. No. 10/957,314, filed Aug. 12, 2008.67Response to Final Office Action mailed May 14, 2008, U.S. Appl. No. 10/957,509, filed Aug. 14, 2008.68Response to Final Office Action mailed May 27, 2009, U.S. Appl. No. 10/957,314, filed Aug. 27, 2009.69Response to Final Office Action mailed Sep. 15, 2009, U.S. Appl. No. 10/957,029, filed Dec. 15, 2009.70Response to Non-Final Office Action mailed Apr. 1, 2010, U.S. Appl. No. 10/957,314, filed May 27, 2010.71Response to Non-Final Office Action mailed Feb. 5, 2010, U.S. Appl. No. 10/957,029, filed May 5, 2010.72Response to Non-Final Office Action mailed Mar. 5, 2009, U.S. Appl. No. 10/957,029, filed Jun. 5, 2009.73Response to Non-Final Office Action mailed May 12, 2010 in U.S. Appl. No. 12/348,649, filed in Aug. 4, 2010.74Response to Non-Final Office Action mailed May 27, 2009, U.S. Appl. No. 10/956,215, filed Aug. 27, 2009.75Response to Non-Final Office Action mailed Nov. 13, 2009, U.S. Appl. No. 10/957,314, filed Jan. 19, 2010.76Response to Non-Final Office Action mailed Nov. 14, 2007, U.S. Appl. No. 10/957,029, filed Mar. 14, 2008.77Response to Non-Final Office Action mailed Nov. 2, 2007, U.S. Appl. No. 10/957,509, filed Feb. 4, 2008.78Response to Non-Final Office Action mailed Oct. 26, 2007, U.S. Appl. No. 10/956,215, filed Mar. 26, 2008.79Response to Non-Final Office Action mailed Oct. 27, 2008, U.S. Appl. No. 10/957,314, filed Feb. 25, 2009.80Response to Non-Final Office Action mailed Oct. 29, 2009 in U.S. Appl. No. 12/348,649, filed Jan. 29, 2010.81Response to Non-Final Office Action mailed Oct. 31, 2008, U.S. Appl. No. 10/956,215, filed Mar. 2, 2009.82Russian Decision on Grant of A Patent for Invention for Russian Application No. 2005130458, dated Sep. 30, 2005. [English Translation].83Ryutov, Tatyana, et al., "Integrated Access Control and Intrusion Detection for Web Servers," IEEE Transactions on Parallel and Distributed Systems, vol. 14, No. 9, Sep. 2003 (pp. 841-850).84Sandhu, Ravi S., and Samarati, Pierangela, "Access Control: Principles and Practice," IEEE Communications Magazine 32, Sep. 1994, No. 9.85Sandhu, Ravi S., and Samarati, Pierangela, "Access Control: Principles and Practice," IEEE Communications Magazine, 32(Sep. 1994) , No. 9 (pp. 40-48).86The Authoritative Dictionary of IEEE Standards and Terms (7th ed., 2000), pp. 101-102.87U.S. Appl. No. 12/348,649, dated Jan. 2009, Vayman.88U.S. Appl. No. 12/944,667, Amendment and Response filed Dec. 7, 2011, 9 pgs.89U.S. Appl. No. 12/944,667, Office Action mailed Jan. 12, 2012, 5 pgs.Referenced byCiting PatentFiling datePublication dateApplicantTitleUS9069941May 9, 2013Jun 30, 2015Microsoft Technology Licensing, LlcAccess authorization having embedded policiesClassifications U.S. Classification726/1International ClassificationH04L29/06Cooperative ClassificationG06F17/30082, G06F21/30, G06F21/62, G06F21/54, G06F21/554European ClassificationG06F21/62, G06F21/54, G06F21/55BLegal EventsDateCodeEventDescriptionJun 15, 2005ASAssignmentOwner name: MICROSOFT CORPORATION, WASHINGTONFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GOLAN, GILAD;VAYMAN, MARK;SIGNING DATES FROM 20040928 TO20040930;REEL/FRAME:016163/0251Jan 1, 2013CCCertificate of correctionDec 9, 2014ASAssignmentOwner name: MICROSOFT TECHNOLOGY LICENSING, LLC, WASHINGTONFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MICROSOFT CORPORATION;REEL/FRAME:034541/0477Effective date: 20141014Oct 28, 2015FPAYFee paymentYear of fee payment: 4RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services