Partial grant set evaluation from partial evidence in an evidence-based security policy manager

• US 20030041267A1
• Filed: 06/05/2002
• Published: 02/27/2003
• Est. Priority Date: 06/21/2000
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Pratt, Brian, Fee, Gregory D., Lange, Sebastian, Kohnfelder, Loren
• Granted Patent: US 7,207,064 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

An evidence-based policy manager generates a permission grant set for a code assembly received from a resource location. The policy manager executes in a computer system (e.g., a Web client or server) in combination with the verification module and class loader of the run-time environment. The permission grant set generated for a code assembly is applied in the run-time call stack to help the system determine whether a given system operation by the code assembly is authorized. The policy manager may determine a subset of the permission grant set based on a subset of the received code assembly'"'"'s evidence, in order to expedite processing of the code assembly. When the evidence subset does not yield the desired permission subset, the policy manager may then perform an evaluation of all evidence received.

Claims

1. In an evidence based security model that evaluates multiple pieces of evidence using a security policy to determine a set of granted permissions, and wherein one piece of the multiple pieces of evidence is likely to determine whether a first permission is granted, a method for determining a subset of the permissions, comprising steps of:

(a) prior to receiving a request to determine whether the first permission is granted, evaluating the one piece of evidence using the security policy, based on the possible values of the one piece of evidence, to determine resultant permissions, and storing the results; and

(b) upon receiving a request to determine whether the first permission is granted, wherein the request comprises an instance of the one piece of evidence, querying the stored results to determine whether the first permission is granted.

2. The method of claim 1, wherein step (a) comprises the step of, for each possible value of the piece of evidence:

(i) evaluating the one piece of evidence using the security policy; and

(ii) recording in a bitmap a result corresponding to the one piece of evidence,

wherein each bit in the bitmap corresponds to a combination of one of the permissions and a possible value of the one piece of evidence.

3. The method of claim 2, wherein each result comprises a first value when the permission is granted, and second value when the permission is either not granted or unknown.

4. The method of claim 1, further comprising the step of, when the first permission is not granted in step (b), performing a full evaluation of the multiple pieces of evidence based on the security policy.

5. The method of claim 1, wherein the one piece of evidence comprises a zone indicator.

6. The method of claim 5, wherein the set of possible values of the one piece of evidence includes a local computer, the Internet, a local intranet, trusted web sites, and untrusted web sites.

7. The method of claim 1, wherein the first permission comprises the right of a code assembly to execute.

8. The method of claim 1, wherein the first permission comprises the right of a code assembly to skip verification.

9. The method of claim 1, wherein the first permission comprises the right of a code assembly to call unmanaged code.

10. The method of claim 1, wherein the first permission comprises full trust rights.

11. A data processing system, comprising:

a policy manager using an evidence based security model that evaluates multiple pieces of evidence using a security policy to determine a set of granted permissions; and

an oracle for determining whether a first permission is granted based on a subset of the multiple pieces of evidence,

wherein the policy manager, upon receiving a request for the first permission, queries the oracle to determine whether the first permission is granted based on the subset of the multiple pieces of evidence.

12. The system of claim 11, wherein the oracle comprises a bitmap, and wherein the bitmap comprises bits corresponding to a combination of the first permission and a possible value of a single piece of evidence.

13. The system of claim 12, wherein each bit in the bitmap comprises a first value when the first permission is granted, and a second value when the first permission is either not granted or unknown.

14. The system of claim 11, wherein, when the oracle indicates that the first permission is not granted or unknown, the policy manager performs a full security policy evaluation based on the multiple pieces of evidence.

15. The system of claim 11, wherein the subset comprises a zone indicator value.

16. The system of claim 15, wherein the possible values for the zone indicator value includes a local computer, the Internet, a local intranet, trusted web sites, and untrusted web sites.

17. The system of claim 11, wherein the first permission comprises the right of a code assembly to execute.

18. The system of claim 11, wherein the first permission comprises the right of a code assembly to skip verification.

19. The system of claim 11, wherein the first permission comprises the right of a code assembly to call unmanaged code.

20. The system of claim 11, wherein the first permission comprises full trust rights.

21. The system of claim 11, wherein the subset of the multiple pieces of evidence comprises one piece of evidence.

22. In an evidence based security model that evaluates, using a security policy, multiple pieces of evidence to determine a set of granted permissions, and wherein a piece of evidence is likely to determine whether a first permission is granted, a data structure stored in a computer memory, comprising:

a first portion corresponding to a first value of the piece of evidence and a plurality of permissions; and

a second portion corresponding to a second value of the piece of evidence and the plurality of permissions,

wherein the data structure indicates, for each value/permission pair, that the permission is granted, or that the permission is either not granted or unknown.

23. The data structure of claim 22, wherein the data structure comprises a bitmap, and the first portion comprises a first plurality of bits in the bitmap, and the second portion comprises a second plurality of bits in the bitmap, wherein each bit corresponds to a value/permission pair.

24. A computer readable medium storing computer readable instructions that, when executed, perform a method for determining whether a desired permission is granted, comprising steps of:

(a) prior to receiving a request to determine whether a desired permission is granted, evaluating a security policy for each of a set of possible values of one piece of evidence from a plurality of pieces of evidence to determine resultant permissions, and storing the results; and

(b) upon receiving a request to determine whether the desired permission is granted, wherein the request comprises an instance of the one piece of evidence, querying the stored results to determine whether the desired permission is granted.

25. The computer readable medium of claim 24, wherein step (a) comprises the step of, for each possible value of the one piece of evidence, recording in a bitmap a result corresponding to the first piece of evidence,

wherein each bit in the bitmap corresponds to a combination of the desired permission and a possible value of the one piece of evidence.

26. The computer readable medium of claim 25, wherein each bit comprises a first value when the desired permission is granted, and a second value when the desired permission is either not granted or unknown.

27. The computer readable medium of claim 24, wherein the computer executable instructions further comprise the step of, when the desired permission is not granted in step (b), performing a full evaluation of the multiple pieces of evidence based on the security policy.

28. In an evidence based security model that evaluates multiple pieces of evidence using a security policy to determine a set of granted permissions, and wherein one piece of evidence is likely to determine whether a first permission is granted, and wherein prior to receiving a request to determine whether the first permission is granted, possible values of the one piece of evidence have been evaluated using the security policy to determine resultant permissions, and the results have been stored in a memory, a method for determining a subset of the permissions, comprising the step of, upon receiving a request to determine whether the first permission is granted, wherein the request comprises an instance of the one piece of evidence, querying the stored results to determine whether the first permission is granted.

29. In an evidence based security model that evaluates multiple pieces of evidence using a security policy to determine a set of granted permissions, and wherein a code assembly'"'"'s zone of origin is likely to determine whether a first permission is granted, and wherein prior to receiving a request to determine whether the first permission is granted, possible values of the zone of origin have been evaluated using the security policy to determine resultant permissions, and the results have been stored in a bitmap, a method for determining a subset of the permissions, comprising steps of:

(a) upon receiving a request to determine whether the first permission is granted, wherein the request comprises an instance of the zone of origin, determining whether the first permission is granted based on data stored in the bitmap; and

(b) when the first permission is not granted in step (a), performing a full evaluation of the multiple pieces of evidence based on the security policy.

30. The method of claim 29, wherein the set of possible values of the zone of evidence comprises a local computer, the Internet, a local intranet, trusted web sites, and untrusted web sites.

31. The method of claim 29, wherein the first permission comprises the right of the code assembly to execute.

32. The method of claim 29, wherein the first permission comprises the right of the code assembly to skip verification.

33. The method of claim 29, wherein the first permission comprises the right of a code assembly to call unmanaged code.

34. The method of claim 29, wherein the first permission comprises full trust rights.

35. The method of claim 29, wherein each bit of the stored results corresponds to a combination of one of the permissions and a possible value of the zone of origin.

36. In an evidence based security model that evaluates multiple pieces of evidence using a security policy to determine a set of granted permissions, and wherein a subset of the multiple pieces of evidence is likely to determine whether a subset of permissions is granted, a method for determining the subset of permissions, comprising steps of:

(a) prior to receiving a request to determine whether the subset of permissions is granted, evaluating the subset of evidence using the security policy, based on the possible values of evidence contained in the subset of evidence, to determine resultant permissions;

(b) storing the results from step (a); and

(c) upon receiving a request to determine whether the subset of permissions is granted, wherein the request comprises an instance of the subset of evidence, querying the stored results to determine whether the subset of permissions is granted.

37. The method of claim 36, wherein the subset of evidence comprises one piece of evidence.

38. The method of claim 36, wherein the subset of permissions comprises one permission.