Source: http://www.google.com/patents/US20080109876?dq=7634659
Timestamp: 2018-01-22 16:24:49
Document Index: 643553589

Matched Legal Cases: ['Application No. 60', 'art 100', 'art 1100', 'art 1100', 'art 1100', 'art 1100']

Patent US20080109876 - Rule-based application access management - Google Patents
A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The...http://www.google.com/patents/US20080109876?utm_source=gb-gplus-sharePatent US20080109876 - Rule-based application access management
Publication number US20080109876 A1
Application number US 11/977,187
Also published as US8261345, US8752128, US8782778, US9054962, US9054963, US9380063, US9571501, US9699194, US20120324530, US20120331570, US20140325610, US20150067149, US20150249671, US20160255085, US20170111361, US20170257371
Publication number 11977187, 977187, US 2008/0109876 A1, US 2008/109876 A1, US 20080109876 A1, US 20080109876A1, US 2008109876 A1, US 2008109876A1, US-A1-20080109876, US-A1-2008109876, US2008/0109876A1, US2008/109876A1, US20080109876 A1, US20080109876A1, US2008109876 A1, US2008109876A1
Inventors Arthur Hitomi, Robert Tran, Peter Kammer, Doug Pfiffner, Huy Nguyen
Original Assignee Endeavors Technologies, Inc.
Patent Citations (99), Referenced by (39), Classifications (12), Legal Events (4)
US 20080109876 A1
encapsulating resources in a software container;
establishing a DMZ to control access to the resources;
receiving from the application a request for one of the resources;
providing the resource in response to the request if access is granted to the application at the DMZ.
2. The method of claim 1, wherein establishing a DMZ includes managing rule-based access to the resources.
receiving the request at the DMZ;
granting access to the application at the DMZ.
receiving the request at the DMZ, wherein the resource is not managed the DMZ;
providing the requested resource.
receiving the request at the DMZ, wherein rule-based access is not granted;
restricting access to the requested resource.
executing a first software application in a first runtime environment;
pausing the first software application;
running a second software application to completion;
resuming execution of the first software application in the first runtime environment.
managing rule-based access to protected resource until the timer expires;
providing altitude for a set of the resources;
providing access control rules for the set of resources at the altitude;
9. The method of claim 8, wherein the resources include files and registry keys, further comprising:
10. The method of claim 9, further comprising, while the current altitude is greater than zero, setting up registry hooks for registry keys at the current altitude in accordance with the altitude for registry keys of the set of resources where the altitude equals the current altitude.
11. The method of claim 9, further comprising, while the current altitude is greater than zero, simulating an environment at the current altitude.
12. The method of claim 9, further comprising, while the current altitude is greater than zero, decrementing the current altitude.
13. The method of claim 8, further comprising, when the altitude is zero:
looking up the process ID and resource ID in a requestor-specific access control table for the first altitude to determine access control.
16. The method of claim 14, further comprising executing an altitude-specific procedure if the access control is Pause.
looking up the process ID and resource ID in a requestor-specific access control table for the second altitude to determine access control if the second altitude is greater than zero;
18. The method of claim 14, further comprising denying the request if the access control is Deny.
19. The method of claim 8, wherein the altitude and access control rules for the set of the resources are stored in a table, further comprising:
providing a file object and a path in a table entry associated with a resource of the set of resources, wherein the table entry further includes the altitude and an access control rule of the access control rules;
populating a runtime table with the altitude, the access control rule, and the process ID if the process ID is associated with the file object and the path.
20. The method of claim 19, further comprising populating a runtime table with the altitude, a Pass Through access control rule, and the process ID if the process ID is not associated with the file object and the path.
This application claims the benefit of U.S. Application No. 60/853,941 filed Oct. 23, 2006, which is incorporated herein by reference.
For the purposes of this application, a DMZ is a virtual area in which resource requests of resources kept in or associated with a container are honored or refused. The resource requests may succeed if virtualization associated with a relevant container does not include the requested resource (e.g., the resource is not virtualized at all), or if the requestor is allowed to pierce the container (e.g., the requestor is allowed access to the resource through a hole poked in the container). It should be noted that in some cases in this application, for the purpose of example, it is assumed that a requestor requests a resource that exists, and that the rule-based determination as to whether to honor the request is made at the DMZ. The rule-based determination can be affirmative or negative depending upon the requester.
FIGS. 2A and 2B depict conceptual diagrams of an example of a system 200 for rule-based access to resources in a container. In the example of FIGS. 2A and 2B, the system 200 includes a requestor 202, a DMZ 204, and a software container 206. In an embodiment, the requestor 202 is identifiable as a user, a process, or a combination of user and process. The DMZ 204 includes, for illustrative purposes only, a table that correlates the requestor to a resource. Instead of a table, a known or convenient structure could be used to manage access rules. The DMZ may include rules associated with multiple requesters, resources inside the container 206 or another container (not shown) and may have rules other than accept/deny (as shown in the FIGS. 2A and 2B), such as “read-only,” “verify,” or other rules. The container 206 includes resource 208-1 to 208-N (collectively referred to as resources 208). Resources may include a known or convenient software, firmware, or hardware component. In an embodiment, the resources include software components such as software drivers for driving hardware components. When specifically referring to a container that includes software resources, including software drivers and the like, the container may be referred to as a software container.
In the example of FIG. 3, the process 306 is depicted as accessing the rule engine 304. For illustrative purposes, the access to the rule engine 304 is represented as a unidirectional arrow from the process 306 to the rule engine 304, which implies the process 306 provides data to the rule engine 304. The rule engine 304 determines whether the data is sufficient to determine that access to the resources 308 is allowed, and sends permission to the software container 302-1, which can allow access to the resources 308.
In the example of FIG. 3, the process 306 is depicted as accessing one or more of the resources 308 that are located within the software container 302-1. For illustrative purposes, access to one or more of the resources 308 is represented as a unidirectional arrow from the resources 308 to the process 306. While this may imply a read access, it should be noted that, depending upon the process, resource, rules, and/or implementation, the access could be read, write, or read/write access.
In an example of an implementation, the communications between the rule engine 304 and the process 306 could be interception-based. In such an embodiment, the rule engine 304 may use a file system hook to intercept a request for resources 308 from the process 306. (One example of an implementation of a file system hook is a filter driver.) In this embodiment, the unidirectional arrow from the process 306 to the rule engine 304 represents the interception of a request for the resources 308 from the process 306. Another example of an interception based technique may incorporate a virtual drive, as described in U.S. Pat. No. 6,453,334, issued on Sep. 17, 2002, to Vinson et al., which is incorporated herein by reference. Any known or convenient interception-based technique could potentially be used.
If, on the other hand, it is determined that the altitude is not 0 (1004-N), then the flowchart 100 continues to module 1012 where selective hooks are set up for files. Advantageously, the hooks are selective depending upon the altitude, resource, and requester. For example, a requestor may have access to a resource at a given altitude, but not at some other altitude. Or a resource may only allow certain types of access at a given altitude, regardless of requestor ID.
In the example of FIG. 11, the flowchart 1100 continues to decision point 1110 where it is determined whether the access control is “accept.” If it is determined that the access control associated with the request is “accept” (1110-Y), the flowchart 1100 continues to module 1112 where the resource ID is looked up in a resource-specific access control table for the altitude. The resource-specific access control table may also be considered part of the selective hook table. The resource-specific access control table has requestor-agnostic security rules for each resource. For example, some resources at the given altitude may grant find access (allowing a requester to know that the resource exists, and perhaps where, but not be able to access the resource itself), read-only access, or write access. Then the flowchart 1100 continues to module 1114 where the appropriate access is granted at the altitude, and the flowchart 1100 ends, having granted the appropriate access to a resource for a request that was accepted.
US20050091534 * Apr 2, 2004 Apr 28, 2005 Itay Nave Security features in on-line and off-line delivery of applications
US20050114472 * Oct 27, 2003 May 26, 2005 Wai-Tian Tan Methods and systems for dynamically configuring a network component
US20060031165 * Aug 1, 2005 Feb 9, 2006 Exent Technologies, Ltd. Security features in on-line and off-line delivery of applications
US20070038642 * Aug 9, 2006 Feb 15, 2007 Scott Durgin Method for providing extensible software components within a distributed synchronization system
US8997089 * Mar 10, 2009 Mar 31, 2015 Pivotal Software, Inc. Computer system and a method of deploying an application in a computer system
US9047451 * Sep 23, 2011 Jun 2, 2015 Blackberry Limited Method and apparatus for differentiated access control
US9560425 * Sep 4, 2013 Jan 31, 2017 Free Stream Media Corp. Remotely control devices over a network without authentication or registration
US9767273 Nov 26, 2008 Sep 19, 2017 Red Hat, Inc. Reliably terminating processes in a system with confined execution environments
US9781124 * Jun 11, 2015 Oct 3, 2017 International Business Machines Corporation Container-based system administration
US20090276769 * Mar 10, 2009 Nov 5, 2009 Springsource Limited Computer System and a Method of Deploying an Application in a Computer System
US20120079586 * Sep 23, 2011 Mar 29, 2012 Research In Motion Limited Method and apparatus for differentiated access control
US20140002247 * Sep 4, 2013 Jan 2, 2014 David Harrison Zero-configuration remote control of a device coupled to a networked media device through a client side device communicatively coupled with the networked media device
US20160026496 * Oct 7, 2015 Jan 28, 2016 Code Systems Corporation Method and system for profiling virtual application resource utilization patterns
US20160366104 * Jun 11, 2015 Dec 15, 2016 International Business Machines Corporation Container-based system administration
Cooperative Classification H04L41/145, H04L63/108, H04L63/10, H04L41/0813, H04L43/0823, G06F21/6218, G06F9/468, G06F2221/2141
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HITOMI, ARTHUR S.;TRAN, ROBERT;KAMMER, PETER J.;AND OTHERS;REEL/FRAME:020401/0846;SIGNING DATES FROM 20080122 TO 20080123
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HITOMI, ARTHUR S.;TRAN, ROBERT;KAMMER, PETER J.;AND OTHERS;SIGNING DATES FROM 20080122 TO 20080123;REEL/FRAME:020401/0846