MAPPING PROCESS CHANGES

• US 20170109520A1
• Filed: 12/14/2016
• Published: 04/20/2017
• Est. Priority Date: 06/08/2015
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services Limited (Accenture PLC)
• Inventors: Hassanzadeh, Amin
• Granted Patent: US 9,824,205 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

In one implementation, a computer-implemented method includes receiving a request to run a particular process; determining whether the particular process is to be run in isolation on the computer system; selecting a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process; fetching, according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment; running the particular process is isolation on the computer system by executing the copy object in the isolated environment; applying, according to the particular permission scheme, one or more changes to the copy object; and mapping, according to the particular permission scheme, the one or more changes in the copy object to the actual object.

Claims

1. (canceled)

2. A computer-implemented method comprising:

selecting, by a process manager running on a computer system and in response to determining that a particular process is to be run in an isolated environment, a particular permission scheme that defines a set of permission requirements for applying changes made to isolated copies of actual objects that are not in the isolated environment, by processes that are running in the isolated environment;

obtaining, by the process manager and according to the particular permission scheme, an isolated copy object that (i) is in the isolated environment, and (ii) corresponds to an actual object that is not in the isolated environment;

running the particular process in the isolated environment on the computer system, thereby generating one or more changes to the isolated copy object; and

applying, by the process manager and according to the particular permission scheme, one or more of the changes to the isolated copy object to the actual object that is not in the isolated environment.

3. The computer-implemented method of claim 2, wherein the particular permission scheme comprises a proactive permission scheme in which user permission is obtained in advance of all changes being received for the copy object.

4. The computer-implemented method of claim 2, wherein the particular permission scheme comprises a reactive permission scheme in which user permission is obtained in response to each change that is received for the copy object.

5. The computer-implemented method of claim 2, comprising:

outputting, by the computer system and before obtaining the isolated copy object, information to prompt a user to provide permission for changes to the isolated copy object in advance of any changes being made; and

receiving, at the computer system and before obtaining the isolated copy object, user input comprising permission for changes to the isolated copy object,

wherein the copy object is obtained in response to the user input being received.

6. The computer-implemented method of claim 2, comprising:

outputting, by the computer system after obtaining the isolated copy object and before applying the one or more changes to the copy object, information to prompt a user to provide permission for each of the one or more changes to the isolated copy object; and

receiving, at the computer system and before applying the one or more changes to the isolated copy object, user input comprising permission for each of the one or more changes to the isolated copy object,

wherein the one or more changes are applied to the isolated copy object in response to the user input being received.

7. The computer-implemented method of claim 2, comprising:

receiving, at the process manager, a request to run the particular process on the computer system; and

determining, by the process manager, that the particular process is to be run in isolation on the computer system.

8. The computer-implemented method of claim 2, wherein the particular permission scheme is selected from among multiple permission schemes that define a set of permission requirements for applying changes made to isolated copies of actual objects that are not in the isolated environment, by processes that are running in the isolated environment.

9. A non-transitory computer-readable medium having stored thereon instructions, which, when executed by one or more computers, cause the one or more computers to perform operations comprising:

selecting, by a process manager running on a computer system and in response to determining that a particular process is to be run in an isolated environment, a particular permission scheme that defines a set of permission requirements for applying changes made to isolated copies of actual objects that are not in the isolated environment, by processes that are running in the isolated environment;

obtaining, by the process manager and according to the particular permission scheme, an isolated copy object that (i) is in the isolated environment, and (ii) corresponds to an actual object that is not in the isolated environment;

running the particular process in the isolated environment on the computer system, thereby generating one or more changes to the isolated copy object; and

applying, by the process manager and according to the particular permission scheme, one or more of the changes to the isolated copy object to the actual object that is not in the isolated environment.

10. The medium of claim 9, wherein the particular permission scheme comprises a proactive permission scheme in which user permission is obtained in advance of all changes being received for the copy object.

11. The medium of claim 9, wherein the particular permission scheme comprises a reactive permission scheme in which user permission is obtained in response to each change that is received for the copy object.

12. The medium of claim 9, wherein the operations comprise:

outputting, by the computer system and before obtaining the isolated copy object, information to prompt a user to provide permission for changes to the isolated copy object in advance of any changes being made; and

receiving, at the computer system and before obtaining the isolated copy object, user input comprising permission for changes to the isolated copy object,

wherein the copy object is obtained in response to the user input being received.

13. The medium of claim 9, wherein the operations comprise:

outputting, by the computer system after obtaining the isolated copy object and before applying the one or more changes to the copy object, information to prompt a user to provide permission for each of the one or more changes to the isolated copy object; and

receiving, at the computer system and before applying the one or more changes to the isolated copy object, user input comprising permission for each of the one or more changes to the isolated copy object,

wherein the one or more changes are applied to the isolated copy object in response to the user input being received.

14. The medium of claim 9, wherein the operations comprise:

receiving, at the process manager, a request to run the particular process on the computer system; and

determining, by the process manager, that the particular process is to be run in isolation on the computer system.

15. The medium of claim 9, wherein the particular permission scheme is selected from among multiple permission schemes that define a set of permission requirements for applying changes made to isolated copies of actual objects that are not in the isolated environment, by processes that are running in the isolated environment.

16. A system comprising:

one or more processors and one or more computer storage media storing instructions that are operable, when executed by the one or more processors, to cause the one or more processors to perform operations comprising;

selecting, by a process manager running on a computer system and in response to determining that a particular process is to be run in an isolated environment, a particular permission scheme that defines a set of permission requirements for applying changes made to isolated copies of actual objects that are not in the isolated environment, by processes that are running in the isolated environment;

obtaining, by the process manager and according to the particular permission scheme, an isolated copy object that (i) is in the isolated environment, and (ii) corresponds to an actual object that is not in the isolated environment;

running the particular process in the isolated environment on the computer system, thereby generating one or more changes to the isolated copy object; and

applying, by the process manager and according to the particular permission scheme, one or more of the changes to the isolated copy object to the actual object that is not in the isolated environment.

17. The system of claim 16, wherein the particular permission scheme comprises a proactive permission scheme in which user permission is obtained in advance of all changes being received for the copy object.

18. The system of claim 16, wherein the particular permission scheme comprises a reactive permission scheme in which user permission is obtained in response to each change that is received for the copy object.

19. The system of claim 16, wherein the operations comprise:

outputting, by the computer system and before obtaining the isolated copy object, information to prompt a user to provide permission for changes to the isolated copy object in advance of any changes being made; and

receiving, at the computer system and before obtaining the isolated copy object, user input comprising permission for changes to the isolated copy object,

wherein the copy object is obtained in response to the user input being received.

20. The system of claim 16, wherein the operations comprise:

outputting, by the computer system after obtaining the isolated copy object and before applying the one or more changes to the copy object, information to prompt a user to provide permission for each of the one or more changes to the isolated copy object; and

receiving, at the computer system and before applying the one or more changes to the isolated copy object, user input comprising permission for each of the one or more changes to the isolated copy object,

wherein the one or more changes are applied to the isolated copy object in response to the user input being received.

21. The system of claim 16, wherein the operations comprise:

receiving, at the process manager, a request to run the particular process on the computer system; and

determining, by the process manager, that the particular process is to be run in isolation on the computer system.