Method and system of plug-in privilege control

• US 20110023092A1
• Filed: 07/20/2010
• Published: 01/27/2011
• Est. Priority Date: 07/22/2009
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Zhang, Liming, Wen, Bo
• Granted Patent: US 8,370,906 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A plug-in privilege control includes authorizing a plug-in, including assigning a plug-in identification number (PIN) to the plug-in wherein the PIN is used to identify an identification (ID) of the corresponding plug-in; notifying the plug-in about the PIN; storing information about the plug-in and a plug-in accessible service to a mapping of services; receiving a request for a service from the plug-in, wherein the request includes the PIN; retrieving the ID of the plug-in according to the PIN; and determining whether to allow the plug-in to access the service that it requested.

Claims

1. A plug-in privilege control method, comprising:

authorizing a plug-in, including assigning a plug-in identification number (PIN) to the plug-in wherein the PIN is used to identify an identification (ID) of the corresponding plug-in;

notifying the plug-in about the PIN;

storing information about the plug-in and a plug-in accessible service to a mapping of services;

receiving a request for a service from the plug-in, wherein the request includes the PIN;

retrieving the ID of the plug-in according to the PIN; and

to determining whether to allow the plug-in to access the service that it requested.

2. The method of claim 1, wherein the PIN is derived by:

randomly assigning a storage location to the ID;

storing the ID in the storage location; and

using a byte address of the storage space as the PIN.

3. The method of claim 2, wherein retrieving the ID further includes:

reading the PIN;

retrieving the byte address where the ID is stored; and

retrieving the ID according to the byte address.

4. The method of claim 1, in the event that the plug-in is allowed to access the service requested, the method further comprising:

determining whether the service that the plug-in requested satisfies a conditional accessibility requirement; and

disabling the plug-in'"'"'s access to the service in the event that the conditional accessibility requirements are not satisfied.

5. The method of claim 4, wherein the conditional accessibility includes a threshold of access frequency.

6. The method of claim 5, further includes:

removing the service from the list of services which is accessible to the plug-in in the event that the frequency or the total number of the plug-in'"'"'s service accesses exceeds the threshold; and

recalculating the frequency or number of the plug-in'"'"'s service accesses in the event that the threshold is not exceeded.

7. The method of claim 4, wherein the conditional accessibility includes total number of the plug-in'"'"'s service accesses.

8. The method of claim 1, further comprising:

setting a list of sensitive services; and

monitoring plug-in accesses to the sensitive services.

9. The method of claim 1, further comprising updating the mapping of services in the event that the accessible service is modified or deleted, or that a new accessible service is added.

10. A plug-in privilege control system, comprising:

one or more processors coupled to an interface, are configured to;

authorizing a plug-in, including assigning a plug-in identification number (PIN) to the plug-in wherein the PIN is used to identify an identification (ID) of the corresponding plug-in;

notify the plug-in about the PIN;

store information about the plug-in and a plug-in accessible service to a mapping of services;

receive a request for a service from the plug-in, wherein the request includes the PIN;

retrieve the ID of the plug-in according to the PIN; and

determine whether to allow the plug-in to access the service that it requested;

one or more memories coupled to one or more processors, configured to provide the processors with instructions.

11. The system of claim 10, wherein the PIN is derived by:

randomly assigning a storage location to the ID;

storing the ID in the storage location; and

using a byte address of the storage space as the PIN.

12. The system of claim 11, wherein retrieving the ID further includes:

reading the PIN;

retrieving the byte address where the ID is stored; and

retrieving the ID according to the byte address.

13. The system of claim 10, in the event that the plug-in is allowed to access the service requested, the one or more processors further being configured to:

determine whether the service that the plug-in requested satisfies a conditional accessibility requirement; and

disable the plug-in'"'"'s access to the service in the event that the conditional accessibility requirements are not satisfied.

14. The system of claim 13, wherein the conditional accessibility includes a threshold of access frequency.

15. The system of claim 14, wherein the one or more processors are further configured to:

remove the service from the list of services which is accessible to the plug-in in the event that the frequency or the total number of the plug-in'"'"'s service accesses exceeds the threshold; and

recalculate the frequency or number of the plug-in'"'"'s service accesses in the event that the threshold is not exceeded.

16. The system of claim 13, wherein the conditional accessibility includes total number of the plug-in'"'"'s service accesses.

17. The system of claim 10, wherein the one or more processors are further configured to:

set a list of sensitive services; and

monitor plug-in accesses to the sensitive services.

18. The system of claim 10, wherein the one or more processors are further configured to update the mapping of services in the event that the accessible service is modified or deleted, or that a new accessible service is added.