Associating runtime objects with a set and controlling access to resources as a function thereof

• US 20050091655A1
• Filed: 09/10/2004
• Published: 04/28/2005
• Est. Priority Date: 10/24/2003
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Li, Eric, Rector, John Austin, Probert, David B.
• Application Number:
  US10/938,126
• Publication Number:
  US 20050091655A1
• Time in Patent Office: Days
• US Class Current: 719/315
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 8/62 Uninstallation

Abstract

Maintaining a set of runtime objects. A method of the invention detects creation of a runtime object by an application program or operating system. The method evaluates a predicate for a set associated with the runtime object to determine membership of the runtime object in the set. Further, one or more properties of the set may be applied to the determined runtime object members of the set (e.g., to control access to a resource).

Claims

1. A method for dynamically associating one or more runtime objects with a set, said method comprising:

detecting creation of a runtime object;

identifying a set associated with the detected runtime object, said set representing a collection of runtime objects having a common property;

determining a predicate associated with the identified set;

evaluating the determined predicate as a function of the runtime object; and

modifying the identified set as a function of the evaluated predicate.

2. The method of claim 1, wherein detecting creation of the runtime object comprises detecting creation of a process.

3. The method of claim 1, wherein detecting creation of the runtime object comprises detecting creation of a thread.

4. The method of claim 1, wherein detecting creation of the runtime object comprises detecting creation of a fiber or work item.

5. The method of claim 1, wherein evaluating the determined predicate comprises evaluating the determined predicate as a function of the runtime object.

6. The method of claim 1, wherein modifying the identified set comprises adding the runtime object to the identified set.

7. The method of claim 6, further comprising applying one or more rules associated with the set to the runtime object.

8. The method of claim 7, wherein applying the one or more rules comprises controlling access by the runtime object to a resource.

9. The method of claim 7, wherein applying the one or more rules comprises controlling allocation by the runtime object of a resource.

10. The method of claim 7, wherein applying the one or more rules comprises applying one or more of the following:

absolute allocation, usage rate rules, and priority policies.

11. The method of claim 1, further comprising determining an identity for the detected runtime object.

12. The method of claim 11, wherein identifying the set associated with the detected runtime object comprises identifying a set associated with the determined identity.

13. The method of claim 11, wherein determining the identity for the detected runtime object comprises determining an identity of an application program.

14. The method of claim 11, wherein determining the identity for the detected runtime object comprises determining an identity of a runtime object associated with execution of an application program.

15. The method of claim 11, wherein determining the identity for the detected runtime object comprises determining an identity of a code execution object comprising one or more of the following:

a process, a thread, a fiber, or a work item associated with execution of the application program.

16. The method of claim 11, wherein evaluating the determined predicate comprises evaluating the determined predicate as a function of the determined identity.

17. The method of claim 1, wherein one or more computer-readable media have computer-executable instructions for performing the method recited in claim 1.

18. One or more computer-readable media having computer-executable components for dynamically associating one or more runtime objects with a set, said components comprising:

a filter component for detecting creation of a runtime object;

a set component for identifying a set associated with the runtime object detected by the filter component, said set representing a collection of runtime objects having a common property, said set component further determining a predicate associated with the identified set;

a test component for evaluating the predicate determined by the set component as a function of the runtime object; and

a maintenance component for modifying the identified set as a function of the predicate evaluated by the test component.

19. The computer-readable media of claim 18, further comprising an attribute component for applying one or more rules associated with the set to the runtime object.

20. The computer-readable media of claim 19, wherein the attribute component controls access by the runtime object to a resource.

21. The computer-readable media of claim 19, wherein the attribute component controls allocation by the runtime object of a resource.

22. The computer-readable media of claim 19, wherein the attribute component control allocation by the runtime object of a resource by one or more of the following:

absolute allocation, usage rate rules, and priority policies.

23. The computer-readable media of claim 18, further comprising an identity component for determining an identity for the runtime object detected by the filter component.

24. The computer-readable media of claim 23, wherein the set component identifies a set associated with the identity determined by the identity component.

25. The computer-readable media of claim 23, wherein the identity component determines an identity of an application program as the determined identity for the runtime object.

26. The computer-readable media of claim 23, wherein the identity component determines an identity of a runtime object associated with execution of an application program as the determined identity for the runtime object.

27. The computer-readable media of claim 23, wherein the identity component determines an identity of a code execution object as the determined identity for the runtime object, said code execution object comprising one or more of the following:

a process, a thread, a fiber, or a work item associated with execution of the application program.

28. The computer-readable media of claim 23, wherein the test component evaluates the predicate determined by the set component as a function of the identity determined by the identity component.

29. A method for providing resource security based on application identity, said method comprising:

receiving a request from an application program for access to a resource;

determining an identifier associated with the application program;

identifying a set associated with the determined identifier;

determining one or more attributes associated with the identified set; and

providing access to the requested resource as a function of the determined attributes.

30. The method of claim 29, wherein determining the one or more attributes comprises determining a security profile associated with the identified set.

31. The method of claim 29, wherein determining the one or more attributes comprises determining an access control list associated with the identified set.

32. The method of claim 29, further comprising prompting a user to alter at least one of the one or more attributes.

33. The method of claim 29, further comprising providing a user interface to a user for creating the one or more attributes.

34. The method of claim 29, wherein determining the one or more attributes associated with the identified set comprises determining a list of capabilities associated with the application program.

35. The method of claim 34, further comprising comparing the request to the list of capabilities.

36. The method of claim 29, wherein providing access to the requested resource comprises providing access as a function of comparing the request to the list of capabilities.

37. The method of claim 29, wherein one or more computer-readable media have computer-executable instructions for performing the method recited in claim 29.

38. A system for providing security for a resource based on membership of a runtime object in a set, said system comprising:

a memory area for storing;

a predicate defining membership in a set of runtime objects; and

one or more properties defining access by the set of runtime objects to a resource; and

a processor configured to execute computer-executable instructions for;

receiving a request from a runtime object;

evaluating the predicate stored in the memory area as a function of the runtime object to determine membership of the runtime object in the set;

applying at least one of the properties stored in the memory area to the runtime object to provide access to the resource as a function of the determined membership.

39. The system of claim 38, wherein the one or more properties comprise one or more rules for accessing the resource.