APPROACHES FOR MANAGING RESTRICTIONS FOR MIDDLEWARE APPLICATIONS

• US 20200134213A1
• Filed: 09/27/2019
• Published: 04/30/2020
• Est. Priority Date: 10/24/2018
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Ding, James, Santos, Goncalo Silva, Helzberg, Richard, Playford, Thomas
• Granted Patent: US 11,138,342 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 8/36 Software reuse
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Systems and methods are provided for determining an access request provided by an application that seeks to interact with one or more backend systems through a computing system. One or more predefined restrictions can be enforced on the application, the computing system, or the one or more backend systems.

Claims

1. A computer-implemented method, comprising:

determining, by a computing system, an access request provided by an application that seeks to interact with one or more backend systems through the computing system; and

enforcing, by the computing system, one or more predefined restrictions on the application, the computing system, or the one or more backend systems.

2. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent continuous deployment of new and updated software in compliance with a software dependency matrix, wherein the software dependency matrix includes dependency information for software relied upon by the computing system.

3. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent modifications to data in compliance with a data dependency matrix, wherein the data dependency matrix includes dependency information for data relied upon by the application or the computing system.

4. The computer-implemented method of claim 1, wherein the one or more predefined restrictions require the application to use a predefined software development kit (SDK) or software library.

5. The computer-implemented method of claim 1, wherein the one or more predefined restrictions require the application to use a predefined library for service discovery.

6. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent the application from exceeding a predefined number of access requests to the one or more backend systems over a given period of time.

7. The computer-implemented method of claim 1, wherein the one or more predefined restrictions prevent the computing system from sending an amount of data to the application in excess of a predefined amount.

8. The computer-implemented method of claim 1, wherein the one or more predefined restrictions require the application to be identified in a whitelist of applications that are permitted to interact with the computing system and the one or more backend systems.

9. The computer-implemented method of claim 1, wherein the one or more predefined restrictions isolate logs generated based on interactions between the application, the computing system, and the one or more backend systems from logs generated based on interactions involving other applications.

10. The computer-implemented method of claim 1, wherein the computing system is a middleware applications system.

11. A system, comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the system to perform;

determining an access request provided by an application that seeks to interact with one or more backend systems through the system; and

enforcing one or more predefined restrictions on the application, the system, or the one or more backend systems.

12. The system of claim 11, wherein the one or more predefined restrictions prevent continuous deployment of new and updated software in compliance with a software dependency matrix, wherein the software dependency matrix includes dependency information for software relied upon by the computing system.

13. The system of claim 11, wherein the one or more predefined restrictions prevent modifications to data in compliance with a data dependency matrix, wherein the data dependency matrix includes dependency information for data relied upon by the application or the computing system.

14. The system of claim 11, wherein the one or more predefined restrictions require the application to use a predefined software development kit (SDK) or software library.

15. The system of claim 11, wherein the one or more predefined restrictions require the application to use a predefined library for service discovery.

16. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors of a computing system to perform:

determining an access request provided by an application that seeks to interact with one or more backend systems through the computing system; and

enforcing one or more predefined restrictions on the application, the computing system, or the one or more backend systems.

17. The non-transitory computer readable medium of claim 16, wherein the one or more predefined restrictions prevent continuous deployment of new and updated software in compliance with a software dependency matrix, wherein the software dependency matrix includes dependency information for software relied upon by the computing system.

18. The non-transitory computer readable medium of claim 16, wherein the one or more predefined restrictions prevent modifications to data in compliance with a data dependency matrix, wherein the data dependency matrix includes dependency information for data relied upon by the application or the computing system.

19. The non-transitory computer readable medium of claim 16, wherein the one or more predefined restrictions require the application to use a predefined software development kit (SDK) or software library.

20. The non-transitory computer readable medium of claim 16, wherein the one or more predefined restrictions require the application to use a predefined library for service discovery.