SECURE SERVICE COMPUTATION

• US 20080083031A1
• Filed: 12/20/2006
• Published: 04/03/2008
• Est. Priority Date: 12/20/2006
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: MacLaurin, Matthew B., Meijer, Henricus Johannes Maria, Ozzie, Raymond E., Flake, Gary W., Brumme, Christopher W., Gounares, Alexander G., Mital, Amit, Mishra, Debi P., Dani, Nishant V., Gates, William H.
• Application Number:
  US11/613,925
• Publication Number:
  US 20080083031A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/629 to features or functions of an application

Abstract

Systems and methods for managing cloud service applications are provided. In particular, a security component can regulate such applications to prevent undesirable behavior. In one instance, applications can be restricted to use of designated network resources to thereby contain application activities. Additionally or alternatively, the applications can be monitored and prohibited from executing malicious code such as that associated with a virus, worm and/or Trojan horse, among other things.

Claims

1. A secure computation system, comprising:

an execution component that executes a cloud service application; and

a security component that prevents execution of prohibited behavior by the application.

2. The system of claim 1, further comprising an analyzer component that identifies the prohibited behavior.

3. The system of claim 2, the analyzer component identifies prohibited behavior as a function of a proof provided by the application.

4. The system of claim 2, further comprising a match component that matches application code to a plurality of signatures representative of prohibited behavior.

5. The system of claim 2, further comprising an action component that blocks access to at least one application requested resource upon identification of prohibited behavior by the analyzer component.

6. The system of claim 5, the analyzer component monitors resource usage during execution of the application.

7. The system of claim 6, the action component blocks allocation of resources to the application beyond a quota.

8. The system of claim 1, the execution component regulates resource access of the application.

9. The system of claim 8, the execution component schedules execution of a long running or resource intensive application at periodic intervals to mitigate potential harm.

10. The system of claim 8, the execution component regulates the resource access based on acquired resource rights, wherein the price of rights increases progressively with the amount of resources or resources are allocated to a highest bidder.

11. The system of claim 1, the security component prevents access to resources outside those associated with the execution environment, thereby sandboxing the application.

12. A method of secure computing, comprising the following computer-implemented acts:

analyzing a cloud service application for prohibited activity; and

regulating execution of the application to prevent identified prohibited activity.

13. The method of claim 12, analyzing the cloud service comprising examining a proof associated with the application.

14. The method of claim 12, further comprising identifying prohibited behavior by locating patterns indicative of insecure activity.

15. The method of claim 12, regulating execution comprising provisioning resources in accordance with a maximum limit.

16. The method of claim 12, regulating execution comprises affording resources in accordance with purchased rights.

17. The method of claim 16, further comprising acquiring additional and/or selling excess resource rights.

18. The method of claim 12, regulating execution comprising scheduling execution at ever-increasing intervals to mitigate potential damage.

19. A system for secure information processing with respect to network service applications, comprising:

means for analyzing a distributed network service application to identify malicious activity; and

means for regulating execution to prevent the malicious activity.

20. The system of claim 19, the means for regulating prevents resource allocation in excess of a maximum limit.