Access authorization having embedded policies

• US 20060075462A1
• Filed: 10/01/2004
• Published: 04/06/2006
• Est. Priority Date: 10/01/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Vayman, Mark, Golan, Gilad
• Granted Patent: US 8,181,219 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules

Abstract

A facility for receiving an embedded policy is provided. The facility checks an application program image for the presence of an embedded policy. If an embedded policy is detected, the facility extracts the policy from within the application program image. The facility may then apply the extracted policy to the application program image before the application program image is loaded and/or executed. Moreover, the facility may check the application program image'"'"'s integrity prior to extracting the embedded policy.

Claims

1. A computer-readable storage medium whose contents cause a computer to:

receive a request to load an application program image;

determine whether a policy is embedded within the application program image, and responsive to determining that a policy is embedded within the application program image;

extract the policy from the application program image;

load the application program image on the computer; and

apply the extracted policy to the application program image.

2. The computer-readable storage medium of claim 1, wherein the extracted policy is stored in a policy repository.

3. The computer-readable storage medium of claim 1, wherein the embedded policy is indicated by a flag in the application program image.

4. The computer-readable storage medium of claim 1, wherein the embedded policy is indicated by a key set in a registry by an application installer for the application program image.

5. The computer-readable storage medium of claim 1, wherein the embedded policy is indicated by an entry in a field in a portable executable header field of the application program image.

6. The computer-readable storage medium of claim 1 further comprising contents that cause the computer to verify the integrity of the application program image prior to extracting the embedded policy, loading the application program image, and applying the extracted policy to the application program image.

7. One or more computer memories collectively containing an application program image, the application program image having an embedded policy delimited within the application program image, such that the embedded policy is extracted and applied to the application program image prior to loading the application program image on a computer.

8. The one or more computer memories of claim 7, wherein the embedded policy is declared in a human-readable format.

9. The one or more computer memories of claim 7, wherein the embedded policy is coded using a programming language.

10. A computer-readable storage medium whose contents cause a computer to:

receive a request to load a policy applicable to an application program, the request made by a process executing on the computer other than an instance of the application program;

store the policy in a policy repository; and

associate the policy with the corresponding application program,

such that the stored policy is subsequently applied to an instance of the application program executing on the computer.

11. The computer-readable storage medium of claim 10 further comprising contents that cause the computer to:

receive a request to load the application program on the computer;

determine whether a policy applicable to the application program exists in the policy repository, and responsive to determining that a policy applicable to the application program exists;

load the application program on the computer; and

apply the applicable policy to the application program.

12. The computer-readable storage medium of claim 11 further comprising contents that cause the computer to:

determine whether a policy applicable to the application program exists in the policy repository; and

responsive to determining that a policy applicable to the application program does not exist, not load the application program on the computer.

13. One or more computer memories in a computing system collectively containing a policy applicable to an application program, the policy delivered by a process executing on the computing system, wherein the process is other than a process of the application program, such that the policy is applied to an instance of the application program executing on the computing system.

14. A method in a computing system for receiving an embedded policy, the method comprising:

receiving a request to load an application program image;

determining whether a policy is embedded within the application program image;

responsive to determining that a policy is embedded in the application program image;

extracting the policy from the application program image;

loading the application program image; and

applying the extracted policy to the loaded application program image.

15. The method of claim 14, wherein the embedded policy is declared using XML.

16. The method of claim 14, wherein the embedded policy is coded in a programming language.

17. The method of claim 14 further comprising:

verifying the integrity of the application program image prior to extracting the embedded policy, loading the application program image, and applying the extracted policy to the application program image; and

extracting the embedded policy, loading the application program image, and applying the extracted policy to the application program image subsequent to verifying the integrity of the application program image.

18. The method of claim 14 further comprising storing the extracted policy in a policy repository.

19. A method in a computing system for receiving a policy applicable to an application program, the method comprising:

receiving from a first process executing on a computing system a request to load a policy applicable to an application program, wherein the first process is not a process of the application program;

storing the policy in a policy repository; and

associating the policy to the application program,

such that the policy is applied to a subsequent instance of the application program executing on the computing system.

20. The method of claim 19 further comprising:

receiving a request to load an image of the application program on the computing system;

determining whether the policy applicable to the application program exists in the policy repository; and

responsive to determining that the policy applicable to the application program exists, loading the image of the application program and applying the policy to the application program.

21. The method of claim 20 further comprising, responsive to determining that the policy applicable to the application program does not exist, denying the request to load the image of the application program.

22. A system for applying an embedded policy, the system comprising:

a means for receiving a request to load an image of an application program;

a means for determining whether a policy is embedded within the image of the application program;

responsive to determining that a policy is embedded within the image of the application program;

a means for extracting the policy from the image of the application program;

a means for loading the image of the application program on the computer; and

a means for applying the extracted policy to the image of the application program executing on the computer.

23. The system of claim 22, wherein the extracted policy is stored in a policy table on the computer.

24. The system of claim 22, wherein the embedded policy is declared in a human-readable form.

25. The system of claim 22, wherein the embedded policy is coded in a programming language.

26. The system of claim 22 further comprising a means for verifying the integrity of the image of the application program prior to extracting the embedded policy, loading the image of the application program, and applying the extracted policy to the image of the application program executing on the computer.

27. The system of claim 22 further comprising a means for embedding the policy within the image of the application program.

28. A system for receiving from a process a policy applicable to another process, the system comprising:

an update process operable to deliver a policy applicable to a legacy application program, the update process not a process of the legacy application program; and

a policy loader component operable to receive the policy applicable to the second process from the first process, the policy loader component also operable to store the received policy in a policy repository and associate the policy with the legacy application program,

such that the stored policy is applied to an instance of the application program.

29. The system of claim 28 further comprising:

a application loader component operable to receive a request to load an image of the legacy application program, and further operable to;

determine whether a policy applicable to the image of the legacy application program exists in the policy repository, and responsive to determining that a policy applicable to the image of the application program exists;

load the image of the application program; and

apply the policy to the image of the application program.

30. The system of claim 29, wherein the loader component is further operable to, responsive to determining that a policy applicable to the image of the application program does not exist, not load the image of the application program.