ACCESS CONTROL BASED ON PROGRAM PROPERTIES

• US 20080282354A1
• Filed: 05/07/2007
• Published: 11/13/2008
• Est. Priority Date: 05/07/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Abadi, Martin, Wobber, Edward P., Birrell, Andrew
• Granted Patent: US 8,239,954 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A pattern matching access control system determines whether a principal should be granted access to use a resource based on properties of applications comprised by the principal. The principal name may be created when an application is loaded, invokes other applications (or programs) and/or assumes a new role context. Access is provided based on whether, for each application, the publisher is authorized by system policy to grant privilege as requested by the application. When a resource which requires the privilege is requested by a principal, an access control list (ACL) for the resource is expanded with a list of applications that have been authorized through their publisher to assert the privilege. The expanded ACL is compared to the principal name to determine resource access.

Claims

1. A computer implemented method, comprising:

generating a disjunction of application names based on manifests associated with one or more applications and a publisher for each of the one or more applications;

receiving a request for a resource from a principal associated with a requesting application;

retrieving an access control pattern associated with the resource;

identifying a privilege sub-expression in the access control pattern;

expanding the privilege sub-expression in the access control pattern with the disjunction of application names; and

matching the expanded access control pattern to the principal name.

2. The computer implemented method of claim 1, further comprising:

wherein the principal is a compound entity.

3. The computer implemented method of claim 1, wherein the disjunction of application names includes applications provided by publishers which are allowed by system policy to grant the privilege associated with the privilege sub-expression.

4. The computer implemented method of claim 3, wherein a publisher that provides an application and an endorser that asserts a privilege for the application are not the same entity.

5. The computer implemented method of claim 1, wherein said step of generating includes:

accessing a manifest associated with an application which comprises at least a portion of the principal;

identifying one or more privileges asserted by the application according to the manifest; and

confirming that a publisher of the application may grant the privileges asserted in the manifest to the application.

6. The computer implemented method of claim 1, wherein the principal includes a publisher name and the privilege sub-expression may be expanded to include an application provided by the publisher associated with the publisher name.

7. The computer implemented method of claim 1, wherein said step of matching includes:

comparing the principal name to the access control pattern expanded using a subset of the application names, the subset limited to names of applications on the list which are running or are otherwise included in a principal name.

8. The computer implemented method of claim 1, further comprising:

invoking the requesting application; and

updating the application list for a privilege asserted by the requesting application if the requesting application publisher has authority to grant the privilege.

9. The computer implemented method of claim 1, wherein said step of updating includes:

accessing an access control pattern for the privilege;

determining whether the requesting application publisher matches a publisher in the privilege access control pattern.

10. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising:

determining an application asserts at least one privilege;

determining the publisher of the application;

accessing an access control pattern for the privilege;

comparing the application publisher to the access control pattern for the privilege; and

adding the application to an application pattern for the privilege based on said step of comparing.

11. The one or more processor readable storage devices of claim 10, wherein said step of determining the application asserts a privilege includes:

accessing a set of program properties from a manifest for the application; and

determining if the program properties indicate the application asserts a privilege.

12. The one or more processor readable storage devices of claim 10, wherein said step of determining the application asserts a privilege includes:

deriving manifest information from the application from either program annotation or deduction.

13. The one or more processor readable storage devices of claim 10, wherein the access control pattern for the privilege describes one or more publishers having authority to grant the privilege.

14. The one or more processor readable storage devices of claim 13, wherein the access control pattern is controlled by system policy.

15. The one or more processor readable storage devices of claim 10, wherein said step of comparing includes:

expanding the access control pattern with one or more publishers by access permission logic.

16. The one or more processor readable storage devices of claim 10, further comprising:

assuming a new context role by the application.

17. The one or more processor readable storage devices of claim 10, further comprising:

receiving a request for a resource by a principal comprised of an application;

accessing a second access control pattern for the resource; and

expanding a privilege sub-expression in the second access control pattern with a disjunction of elements included in the application list.

18. The one or more processor readable storage devices of claim 10, further comprising:

determining if a name of the principal matches the second access control list for the resource after the second access control list is expanded with the application list.

19. A computer implemented method, comprising:

generating an application list comprising a disjunction of application names, wherein said step of generating includes;

accessing a manifest associated with an application which comprises at least a portion of the principal,

identifying one or more privileges asserted by the application according to the manifest, and

confirming that a publisher of the application may grant the privileges asserted in the manifest to the application;

receiving a request for a resource from a principal associated with a requesting application;

retrieving an access control pattern associated with the resource;

identifying a group in the access control pattern;

expanding the group in the access control pattern with the application list;

comparing each disjunction application name in the expanded access control pattern to the principal name; and

determining if the principal name is a match for one of the disjunction application names.

20. The computer implemented method of claim 19, wherein the principal is a single word entity.