Approaches for managing restrictions for middleware applications

• US 10,467,435 B1
• Filed: 12/14/2018
• Issued: 11/05/2019
• Est. Priority Date: 10/24/2018
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Ding, James, Santos, Goncalo Silva, Helzberg, Richard, Playford, Thomas
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US16/221,309
• Time in Patent Office: 326 Days
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/36 Software reuse
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Systems and methods are provided for determining an access request provided by an application that seeks to interact with one or more backend systems through a computing system. One or more predefined restrictions can be enforced on the application, the computing system, or the one or more backend systems.

Claims

1. A computer-implemented method, comprising:

determining, by a management computing system, an access request provided by an application running on a computing device that seeks to interact with one or more backend systems through a middleware application system, wherein the access request is provided through an endpoint associated with the management computing system, and wherein the middleware application system provides a serverless application framework for processing the access request; and

enforcing, by the management computing system, one or more predefined restrictions on the application, the middleware application system, or the one or more backend systems, the enforcing further comprising;

determining, by the management computing system, that the application is performing one or more operations to perform service discovery;

enforcing, by the management computing system, a predefined restriction that requires the application to use a predefined library to perform the service discovery;

logging, by the management computing system, the one or more operations by the application to perform service discovery through the middleware application system in a log associated with the application, wherein the log associated with the application is isolated from logs associated with other applications.

2. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent continuous deployment of new and updated software in compliance with a software dependency matrix, wherein the software dependency matrix includes dependency information for software relied upon by the management computing system.

3. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent modifications to data in compliance with a data dependency matrix, wherein the data dependency matrix includes dependency information for data relied upon by the application or the management computing system.

4. The computer-implemented method of claim 1, wherein the one or more predefined restrictions require the application to use a predefined software development kit (SDK) or software library.

5. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent the application from exceeding a predefined number of access requests to the one or more backend systems over a given period of time.

6. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent the management computing system from sending an amount of data to the application in excess of a predefined amount.

7. The computer-implemented method of claim 1, wherein the one or more predefined restrictions require the application to be identified in a whitelist of applications that are permitted to interact with the management computing system and the one or more backend systems.

8. The computer-implemented method of claim 1, wherein the one or more predefined restrictions isolate logs generated based on interactions between the application, the management computing system, and the one or more backend systems from logs generated based on interactions involving other applications.

9. A system, comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the system to perform;

determining an access request provided by an application running on a computing device that seeks to interact with one or more backend systems through a middleware application system, wherein the access request is provided through an endpoint associated with the system, and wherein the middleware application system provides a serverless application framework for processing the access request; and

enforcing one or more predefined restrictions on the application, the middleware application system, or the one or more backend systems, the enforcing further comprising;

determining that the application is performing one or more operations to perform service discovery;

enforcing a predefined restriction that requires the application to use a predefined library to perform the service discovery;

logging the one or more operations by the application to perform service discovery through the middleware application system in a log associated with the application, wherein the log associated with the application is isolated from logs associated with other applications.

10. The system of claim 9, wherein the one or more predefined restrictions prevent continuous deployment of new and updated software in compliance with a software dependency matrix, wherein the software dependency matrix includes dependency information for software relied upon by the system.

11. The system of claim 9, wherein the one or more predefined restrictions prevent modifications to data in compliance with a data dependency matrix, wherein the data dependency matrix includes dependency information for data relied upon by the application or the system.

12. The system of claim 9, wherein the one or more predefined restrictions require the application to use a predefined software development kit (SDK) or software library.

13. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors of a computing system to perform:

determining an access request provided by an application running on a computing device that seeks to interact with one or more backend systems through a middleware application system, wherein the access request is provided through an endpoint associated with the system, and wherein the middleware application system provides a serverless application framework for processing the access request; and

enforcing one or more predefined restrictions on the application, the middleware application system, or the one or more backend systems, the enforcing further comprising;

determining that the application is performing one or more operations to perform service discovery;

enforcing a predefined restriction that requires the application to use a predefined library to perform the service discovery;

logging the one or more operations by the application to perform service discovery through the middleware application system in a log associated with the application, wherein the log associated with the application is isolated from logs associated with other applications.

14. The non-transitory computer readable medium of claim 13, wherein the one or more predefined restrictions prevent continuous deployment of new and updated software in compliance with a software dependency matrix, wherein the software dependency matrix includes dependency information for software relied upon by the computing system.

15. The non-transitory computer readable medium of claim 13, wherein the one or more predefined restrictions prevent modifications to data in compliance with a data dependency matrix, wherein the data dependency matrix includes dependency information for data relied upon by the application or the computing system.

16. The non-transitory computer readable medium of claim 13, wherein the one or more predefined restrictions require the application to use a predefined software development kit (SDK) or software library.