Method and system of plug-in privilege control

• US 8,370,906 B2
• Filed: 07/20/2010
• Issued: 02/05/2013
• Est. Priority Date: 07/22/2009
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Wen, Bo, Zhang, Liming
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): TRUONG, THONG P
• Application Number:
  US12/804,437
• Publication Number:
  US 20110023092A1
• Time in Patent Office: 931 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A plug-in privilege control includes authorizing a plug-in, including assigning a plug-in identification number (PIN) to the plug-in wherein the PIN is used to identify an identification (ID) of the corresponding plug-in; notifying the plug-in about the PIN; storing information about the plug-in and a plug-in accessible service to a mapping of services; receiving a request for a service from the plug-in, wherein the request includes the PIN; retrieving the ID of the plug-in according to the PIN; and determining whether to allow the plug-in to access the service that it requested.

Claims

1. A plug-in privilege control method implemented by a computer, comprising:

authorizing a plug-in that is a software plug-in, including assigning a plug-in identification number (PIN) to the plug-in wherein the PIN is used to identify an identification (ID) of the corresponding plug-in;

notifying the plug-in about the PIN;

storing information about the plug-in and a plug-in accessible service to a mapping of services;

receiving a request for a service from the plug-in, wherein the request includes the PIN;

retrieving the ID of the plug-in according to the PIN;

determining whether to allow the plug-in to access the service that it requested; and

in the event that the plug-in is allowed to access the service requested;

determining whether the service that the plug-in requested satisfies a conditional accessibility requirement;

disabling the plug-in'"'"'s access to the service in the event that the conditional accessibility requirements are not satisfied;

wherein the conditional accessibility includes a threshold of access frequency;

removing the service from the list of services which is accessible to the plug-in in the event that a frequency or a total number of the plug-in'"'"'s service accesses exceeds the threshold; and

recalculating the frequency or the total number of the plug-in'"'"'s service accesses in the event that the threshold is not exceeded.

2. The method of claim 1, wherein the PIN is derived by:

randomly assigning a storage location to the ID;

storing the ID in the storage location; and

using a byte address of the storage space as the PIN.

3. The method of claim 2, wherein retrieving the ID further includes:

reading the PIN;

retrieving the byte address where the ID is stored; and

retrieving the ID according to the byte address.

4. The method of claim 1, wherein the conditional accessibility includes total number of the plug-in'"'"'s service accesses.

5. The method of claim 1, further comprising:

setting a list of sensitive services; and

monitoring plug-in accesses to the sensitive services.

6. The method of claim 1, further comprising updating the mapping of services in the event that the accessible service is modified or deleted, or that a new accessible service is added.

7. A plug-in privilege control system, comprising:

one or more processors coupled to an interface, are configured to;

authorize a plug-in that is a software plug-in, including to assign a plug-in identification number (PIN) to the plug-in wherein the PIN is used to identify an identification (ID) of the corresponding plug-in;

notify the plug-in about the PIN;

store information about the plug-in and a plug-in accessible service to a mapping of services;

receive a request for a service from the plug-in, wherein the request includes the PIN;

retrieve the ID of the plug-in according to the PIN;

determine whether to allow the plug-in to access the service that it requested; and

in the event that the plug-in is allowed to access the service requested;

determine whether the service that the plug-in requested satisfies a conditional accessibility requirement;

disable the plug-in'"'"'s access to the service in the event that the conditional accessibility requirements are not satisfied;

wherein the conditional accessibility includes a threshold of access frequency;

remove the service from the list of services which is accessible to the plug-in in the event that a frequency or a total number of the plug-in'"'"'s service accesses exceeds the threshold; and

recalculate the frequency or the total number of the plug-in'"'"'s service accesses in the event that the threshold is not exceeded;

one or more memories coupled to one or more processors, configured to provide the processors with instructions.

8. The system of claim 7, wherein the PIN is derived by:

randomly assigning a storage location to the ID;

storing the ID in the storage location; and

using a byte address of the storage space as the PIN.

9. The system of claim 8, wherein retrieving the ID further includes:

reading the PIN;

retrieving the byte address where the ID is stored; and

retrieving the ID according to the byte address.

10. The system of claim 7, wherein the conditional accessibility includes total number of the plug-in'"'"'s service accesses.

11. The system of claim 7, wherein the one or more processors are further configured to:

set a list of sensitive services; and

monitor plug-in accesses to the sensitive services.

12. The system of claim 7, wherein the one or more processors are further configured to update the mapping of services in the event that the accessible service is modified or deleted, or that a new accessible service is added.