Enforcing runtime policies in a networked computing environment

• US 9,479,398 B2
• Filed: 07/03/2013
• Issued: 10/25/2016
• Est. Priority Date: 07/03/2013
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Abuelsaad, Kelly, DeLuca, Lisa Seacat, Jang, Soobaek, Krook, Daniel C.
• Primary Examiner(s): Thieu, Benjamin M
• Application Number:
  US13/934,338
• Publication Number:
  US 20150012630A1
• Time in Patent Office: 1,210 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

Embodiments of the present invention provide approaches for enforcing runtime policies in a networked computing environment (e.g., a cloud computing environment). Specifically, in a typical embodiment, computer code and data of an application is annotated with metadata defining a set of runtime policies for executing the computer code and data. Once a request is received to run the application, a set of parameters (e.g., geographic location) corresponding to the execution of the computer code and data of the application is dynamically determined, and compared to the runtime policies. The runtime policies for executing the computer code and data are then enforced at runtime. This includes either running the application, or preventing the running of the application in the case that the set of parameters corresponding to the execution of the computer code and data of the application do not satisfy the runtime policies.

Claims

1. A computer-implemented method for enforcing runtime policies in a networked computing environment, comprising:

identifying an application having computer code comprising;

a first portion of the computer code corresponding to a first component of the application, and

a second portion of the computer code corresponding to a second component of the application;

applying a first annotation to the first portion of the computer code, the first annotation comprising metadata defining a set of runtime policies for executing the first portion of computer code and data;

applying a second annotation to the second portion of the computer code, the second annotation comprising metadata defining a set of runtime policies for executing the second portion of computer code and the data;

receiving a request to run the application;

dynamically determining a set of parameters corresponding to the execution of the computer code and the data of the application, wherein the set of parameters comprises a geographic location for executing the computer code and data;

comparing the set of parameters corresponding to the execution of the computer code and the data of the application with the set of runtime policies for executing each of the first portion of computer code, the second portion of computer code, and the data; and

enforcing, at a runtime of the application, the set of runtime policies for executing each of the first portion of the computer code, the second portion of the computer code, and the data by running the first portion of the application without running the second portion of the application.

2. The computer-implemented method of claim 1, further comprising performing at least one of the following:

preventing running of the second portion of the application, and generating an alert relating to the second portion of the application.

3. The computer-implemented method of claim 1, the set of parameters corresponding to the execution of the computer code and data of the application further comprising at least one of:

time, industry regulations, government regulations, and financial limits on computing power.

4. The computer-implemented method of claim 1, further comprising determining the geographic location for executing the computer code and data using a global positioning system.

5. The computer-implemented method of claim 1, the networked computing environment comprising a cloud computing environment.

6. The computer-implemented method of claim 5, further comprising receiving a set of annotations from an annotation library, each annotation of the library capable of operating in the cloud computing environment.

7. A system for enforcing runtime policies in a networked computing environment, comprising:

a memory medium comprising instructions;

a bus coupled to the memory medium; and

a processor coupled to the bus that when executing the instructions causes the system to;

identify an application having computer code comprising;

a first portion of the computer code corresponding to a first component of the application, and

a second portion of the computer code corresponding to a second component of the application;

apply a first annotation to the first portion of the computer code, the first annotation comprising metadata defining a set of runtime policies for executing the first portion of computer code and data;

apply a second annotation to the second portion of the computer code, the second annotation comprising metadata defining a set of runtime policies for executing the second portion of computer code and the data;

receiving a request to run the application;

dynamically determine a set of parameters corresponding to the execution of the computer code and the data of the application, wherein the set of parameters comprises a geographic location for executing the computer code and data;

compare the set of parameters corresponding to the execution of the computer code and the data of the application with the set of runtime policies for executing each of the first portion of computer code, the second portion of computer code, and the data; and

enforce, at a runtime of the application, the set of runtime policies for executing each of the first portion of the computer code, the second portion of the computer code, and the data by running the first portion of the application without running the second portion of the application.

8. The system of claim 7, the instructions further causing the system to perform at least one of the following in the case that the set of parameters corresponding to the computer code and data of the application fails to satisfy the set of runtime policies for executing the computer code and data:

preventing running of the second portion of the application, and generating an alert relating to the second portion of the application.

9. The system of claim 7, the set of parameters corresponding to the execution of the computer code and data of the application further comprising at least one of:

time, industry regulations, government regulations, and financial limits on computing power.

10. The system of claim 7, the instructions further causing the system to determine the geographic location for executing the computer code and data using a global positioning system.

11. The system of claim 7, the networked computing environment comprising a cloud computing environment.

12. The system of claim 11, the instructions further causing the system to receive a set of annotations from an annotation library, each annotation of the library capable of operating in the cloud computing environment.

13. A computer program product for enforcing runtime policies in a networked computing environment, the computer program product comprising a computer readable hardware storage device, and program instructions stored on the computer readable storage media, to:

identify an application having computer code comprising;

a first portion of the computer code corresponding to a first component of the application, and

a second portion of the computer code corresponding to a second component of the application;

apply a first annotation to the first portion of the computer code, the first annotation comprising metadata defining a set of runtime policies for executing the first portion of computer code and data;

apply a second annotation to the second portion of the computer code, the second annotation comprising metadata defining a set of runtime policies for executing the second portion of computer code and the data;

receive a request to run the application;

dynamically determine a set of parameters corresponding to the execution of the computer code and the data of the application, wherein the set of parameters comprises a geographic location for executing the computer code and data;

compare the set of parameters corresponding to the execution of the computer code and the data of the application with the set of runtime policies for executing each of the first portion of computer code, the second portion of computer code, and the data; and

enforce, at a runtime of the application, the set of runtime policies for executing each of the first portion of the computer code, the second portion of the computer code, and the data by running the first portion of the application without running the second portion of the application.

14. The computer program product of claim 13, the computer readable hardware storage device further comprising instructions to perform at least one of the following in the case that the set of parameters corresponding to the computer code and data of the application fails to satisfy the set of runtime policies for executing the computer code and data:

preventing running of the second portion of the application, and generating an alert relating to the second portion of the application.

15. The computer program product of claim 13, the set of parameters corresponding to the execution of the computer code and data of the application further comprising at least one of:

time, industry regulations, government regulations, and financial limits on computing power.

16. The computer program product of claim 13, the networked computing environment comprising a cloud computing environment.

17. The system of claim 16, the computer readable hardware storage device further comprising instructions to receive a set of annotations from an annotation library, each annotation of the library capable of operating in the cloud computing environment.