Detecting, enforcing and controlling access privileges based on sandbox usage

• US 8,856,864 B2
• Filed: 09/27/2012
• Issued: 10/07/2014
• Est. Priority Date: 09/27/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Li, Hong, Kohlenberg, Tobias M., Wouhaybi, Rita H., Ross, Alan D.
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US13/628,221
• Publication Number:
  US 20140090008A1
• Time in Patent Office: 740 Days
• Field of Search: 726/1, 726/2, 726/3, 726/4, 726/27, 726/29, 713/151, 713/152, 713/170, 713/171, 713/187
• US Class Current: 726/1
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies

Abstract

Systems and methods may provide for receiving web content and detecting an access control attribute associated with the web content. Additionally, the access control attribute may be monitored for a disablement condition. In one example, the disablement condition may be detected, an access policy may be determined in response to the disablement condition, and the access policy may be implemented.

Claims

1. A method comprising:

receiving web content;

detecting an access control attribute associated with the web content, wherein the access control attribute is a Hypertext Markup Language 5 (HTML5) sandbox attribute; and

monitoring the access control attribute for a disablement condition, wherein monitoring the access control attribute includes;

periodically testing one or more functions associated with the web content;

determining whether a user action has occurred with respect to the access control attribute;

determining whether a browser configuration current setting of the access control attribute has changed to a setting that is different than the current setting; and

documenting activity regarding the access control attribute.

2. The method of claim 1, further including:

detecting the disablement condition;

determining an access policy in response to the disablement condition; and

implementing the access policy.

3. The method of claim 2, wherein implementing the access policy includes enabling the access control attribute.

4. The method of claim 2, wherein implementing the access policy includes:

generating a user notification, wherein the user notification includes an identification of the disablement condition and a recommended action;

receiving a response to the user notification; and

determining whether to modify the access control attribute based on the response.

5. The method of claim 2, further including:

identifying one or more functions associated with the web content; and

using the one or more functions to retrieve at least a portion of the access policy from a policy repository.

6. The method of claim 2, further including:

identifying a requestor application identity associated with the disablement condition; and

using the requestor application identity to retrieve at least a portion of the access policy from a profile repository.

7. At least one non-transitory computer readable storage medium comprising a set of instructions which, if executed by a processor, cause a computing device to:

receive web content;

detect an access control attribute associated with the web content, wherein the access control attribute is to be a Hypertext Markup Language 5 (HTML5) sandbox attribute; and

monitor the access control attribute for a disablement condition, wherein the computing device is further to;

periodically test one or more functions associated with the web content;

determine whether a user action has occurred with respect to the access control attribute;

determine whether a browser configuration current setting of the access control attribute has changed to a setting that is different than the current setting; and

document activity regarding the access control attribute.

8. The at least one non-transitory computer readable storage medium of claim 7, wherein the instructions, if executed, cause a computing device to:

detect the disablement condition;

determine an access policy in response to the disablement condition; and

implement the access policy.

9. The at least one non-transitory computer readable storage medium of claim 8, wherein the instructions, if executed, cause a computing device to enable the access control attribute.

10. The at least one non-transitory computer readable storage medium of claim 8, wherein the instructions, if executed, cause a computing device to:

determine that the access control attribute cannot be enabled without impacting the web content; and

disallow the web content.

11. The at least one non-transitory computer readable storage medium of claim 8, wherein the instructions, if executed, cause a computing device to generate a user notification, and wherein the user notification is to include an identification of the disablement condition and a recommended action.

12. The at least one non-transitory computer readable storage medium of claim 11, wherein the instructions, if executed, cause a computing device to:

receive a response to the user notification; and

determine whether to modify the access control attribute based on the response.

13. The at least one non-transitory computer readable storage medium of claim 8, wherein the instructions, if executed, cause a computing device to:

identify one or more functions associated with the web content; and

use the one or more functions to retrieve at least a portion of the access policy from a policy repository.

14. The at least one non-transitory computer readable storage medium of claim 8, wherein the instructions, if executed, cause a computing device to:

identify a requestor application identity associated with the disablement condition; and

use the requestor application identity to retrieve at least a portion of the access policy from a profile repository.

15. An apparatus comprising:

a memory;

one or more processors operatively coupled with the memory;

a browser module, implemented using the one or more processors to receive web content; and

a security manager, implemented using the one or more processors to detect an access control attribute associated with the web content, and monitor the access control attribute for a disablement condition, wherein the access control attribute is to be a Hypertext Markup Language 5 (HTML5) sandbox attribute, and wherein the security manager is further to periodically test one or more functions associated with the web content, determine whether a user action has occurred with respect to the access control attribute, determine whether a browser configuration current setting of the access control attribute has changed to a setting that is different than the current setting, and document activity regarding the access control attribute.

16. The apparatus of claim 15, wherein the security manager is further to detect the disablement condition, determine an access policy in response to the disablement condition, and implement the access policy.

17. The apparatus of claim 16, wherein security manager is further to enable the access control attribute.

18. The apparatus of claim 16, wherein the security manager is further to determine that the access control attribute cannot be enabled without impacting the web content, and disallow the web content.

19. The apparatus of claim 16, wherein the security manager is further to generate a user notification, and wherein the user notification is to include an identification of the disablement condition and a recommended action.

20. The apparatus of claim 19, wherein the security manager is further to receive a response to the user notification and determine whether to modify the access control attribute based on the response.

21. The apparatus of claim 16, further including a policy repository, wherein the security manager is further to identify one or more functions associated with the web content, and use the one or more functions to retrieve at least a portion of the access policy from the policy repository.

22. The apparatus of claim 16, further including a profile repository, wherein security manager is further to identify a requestor application identity associated with the disablement condition, and use the requestor application identity to retrieve at least a portion of the access policy from the profile repository.

23. The apparatus of claim 15, further including a network interface to receive the web content.