Stack-based access control

• US 20020174224A1
• Filed: 05/13/2002
• Published: 11/21/2002
• Est. Priority Date: 12/11/1997
• Status: Active Grant

• Current Assignee: Li Gong, Robert W. Scheifler
• Original Assignee: Li Gong, Robert W. Scheifler
• Inventors: Scheifler, Robert W., Gong, Li
• Granted Patent: US 6,934,758 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 12/0261 using reference counting
• CPC Class Codes: G06F 16/289 Object oriented databases
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 9/4411 Configuring for operating with peripheral devices; Loading of device drivers
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/5011 the resources being hardware resources other than CPUs, Servers and Terminals
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services
• CPC Class Codes: H04L 67/133 Protocols for remote procedure calls [RPC]
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system regulates access to resources requested by an operation executing on a computer. The operation invokes a plurality of methods that operate upon code during execution. The system includes a policy file, a call stack, and an execution unit. The policy file stores permissions for each of the resources. The permissions authorize particular types of access to the resource based on a source of the code and an executor of the code. The call stack stores representations of the methods and executors in an order of invocation by the operation. The execution unit grants access to the resource when the types of access authorized by the permissions of all of the methods and executors on the call stack encompass the access requested by the operation.

Claims

1. A system that regulates access to resources requested by an operation executing on a computer, the operation invoking a plurality of methods that operate upon code during execution, the system comprising:

a policy file that stores permissions for each of the resources, the permissions authorizing types of access to the resource based on a source of the code and an executor of the code;

a call stack that stores the methods and executors in an order of invocation by the operation; and

an execution unit that grants access to the resource when the types of access authorized by the permissions of all of the methods and executors on the call stack encompass the access requested by the operation.