Flexible and dynamic derivation of permissions

• US 6,044,466 A
• Filed: 11/25/1997
• Issued: 03/28/2000
• Est. Priority Date: 11/25/1997
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jaeger, Trent Ray, Giraud, Frederique-Anne, Islam, Nayeem, Anand, Rangachari, Liedtke, Jochen
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Elmore, Stephen C.
• Application Number:
  US08/979,807
• Time in Patent Office: 854 Days
• Field of Search: 713/200, 713/201, 709/225, 709/229, 364/222.5, 364/286.4, 364/286.5, 711/163, 707/9
• US Class Current: 726/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A dynamic derivation mechanism is defined which enables limited permissions to be dynamically and flexibly derived for executables based upon their authenticated description. The dynamic derivation mechanism uses the authenticated description to determine the maximal permissions that individual principals can delegate to the content. A principal'"'"'s maximal permissions for content define a superset of the rights that that principal will actually delegate to that content. Although the maximal permissions are derived from predefined specifications, the specifications can be sensitive to runtime state on the downloader'"'"'s system or previous delegations to enable the dynamic (i.e., runtime) derivation. Multiple principals can delegate a subset of their maximal permissions for the executable content. The mechanism uses policy for combining the delegated permissions into the content'"'"'s runtime permissions.

Claims

1. A method for deriving current and maximal permissions for executable content using:

a. one or more executable content descriptions;

b. one or more sets of permissions (access rights) that describe the operations that executable content can perform on objects;

c. one or more permission equations that compute a set of permissions from one or more other sets of permissions;

d. one or more permission propositions that specify conditions under which associated modifications to permissions apply;

e. one or more policy graphs that associate permissions, permission equations, and/or permission propositions with graph nodes;

wherein the method for deriving current and maximal permissions comprises the following steps;

f. deriving one or more permission equations and one or more permission propositions from policy graphs;

g. deriving one or more maximal sets of permissions from policy graphs;

h. selecting granted permissions from within an associated maximal set of permissions;

i. combining one or more maximal sets of permissions into the maximal permissions using one permission equation and one or more permission propositions;

j. combining one or more granted permissions into one current set of permissions which are a subset of the maximal permissions using one permission equation and one or more permission propositions.

2. A method as claimed in claim 1, wherein the content descriptions comprise attribute-value pairs.

3. A method as claimed in claim 2, wherein the attributes in the content description include the content manufacturer, content description author, content application class, content name, and content version.

4. A method as claimed in claim 2, wherein policy graph derivation retrieves the entry that corresponds to the attribute-value pairs in the content description.

5. A method as claimed in claim 1, wherein permissions specify operations that can be performed.

6. A method as claimed in claim 5, wherein permissions grant an operation, such that an authorization mechanism permits its execution.

7. A method as claimed in claim 6, wherein transforms are specified which define events that modify current permissions.

8. A method as claimed in claim 5, wherein permissions are either positive, such that they grant an operation, or negative, such that they preclude an operation.

9. A method as claimed in claim 1, wherein permissions specify operations that can be performed on objects.

10. A method as claimed in claim 9, wherein the objects in permissions refer to one or more objects.

11. A method as claimed in claim 10, wherein the objects are mapped to physical object names at runtime.

12. A method as claimed in claim 1, wherein permissions specify the operations that can be performed on objects and a limit to the number of such operations.

13. A method as claimed in claim 1, wherein permission equations perform set operations on one or more sets of permissions to compute a single set of permissions.

14. A method as claimed in claim 13, wherein permission equations use permissions which are associated with specific principals.

15. A method as claimed in claim 14, wherein specific principals include a system administrator, a downloading principal, and an application for which the content is being used.

16. A method as claimed in claim 1, wherein permission propositions add, remove or restrict a permission.

17. A method as claimed in claim 16, wherein permission propositions specify that the presence of two or more specific permissions results in the removal of one of the permissions.

18. A method as claimed in claim 16, wherein permission propositions specify that the presence of two or more specific permissions results in the restriction of one of the permissions.

19. A method as claimed in claim 16, wherein permission propositions specify that the presence of one or more specific permissions results in the addition of one or more permissions.

20. A method as claimed in claim 1, wherein a policy graph contains one or more linked nodes, and each node is linked to at least one other node in the policy graph.

21. A method as claimed in claim 20, wherein nodes are associated with specific attributes.

22. A method as claimed in claim 20, wherein the attributes are totally ordered.

23. A method as claimed in claim 20, wherein the nodes associate attribute-value pairs with entries.

24. A method as claimed in claim 20, wherein a node is linked to a node of the next lesser attribute in the total order if the entry of the second node is consistent with an extension of the description by that attribute-value pair.

25. A method as claimed in claim 20, wherein access to nodes is authorized based on a node access control list.

26. A method as claimed in claim 20, wherein the policy graph is associated with one or more principals.

27. A method as claimed in claim 20, wherein selection of a next node to access in a policy graph traversal is determined by a traversal method.

28. A method as claimed in claim 20, wherein derivation of the results of a policy graph traversal is specified by a combination method which combines a current node'"'"'s entry with a result derived so far.

29. A method as claimed in claim 28, wherein the combination method combines values of a current node'"'"'s entry before traversing its children/parents.

30. A method as claimed in claim 28, wherein the combination method combines values of a current node'"'"'s entry after traversing its children/parents.

31. A method as claimed in claim 20, wherein access to the policy graph is authorized using an access control list.

32. A method as claimed in claim 20, wherein the policy graph nodes store permission equations as entries.

33. A method as claimed in claim 20, wherein the policy graph nodes store permission propositions as entries.

34. A method as claimed in claim 20, wherein the policy graph nodes store permissions as entries.

35. A method as claimed in claim 20, wherein a node is selected if its value for an attribute is the same as that of the description.

36. A method as claimed in claim 20, wherein a node is selected if its value for an attribute includes the value of that attribute in the description.

37. A method as claimed in claim 20, wherein the policy graph derivation unions the entries that correspond to the nodes selected in graph traversal by the traversal method.

38. A method as claimed in claim 20, wherein the policy graph derivation intersects the entries that correspond to the nodes selected in the graph traversal by the traversal method.

39. A method as claimed in claim 1, wherein site security policy concerning permissions, permission equations, permission propositions, and policy graphs is stored on one or more machines.

40. A method as claimed in claim 39, wherein site security policy is stored on a downloading principal'"'"'s machine.

41. A method as claimed in claim 39, wherein site security policy is stored on a machine that is a secure server.

42. A method as claimed in claim 1, wherein a principal which intends to run the executable is used to derive permission equations, permission propositions, and/or maximal sets of permissions.

43. A method as claimed in claim 1, wherein a principal delegates any rights to content within its maximal permissions for that content.

44. A method as claimed in claim 1, wherein a principal delegates a right to content if it is within its maximal permissions for that content and the right is within the content'"'"'s maximal permissions.