Rule-based application access management

• US 9,054,962 B2
• Filed: 06/04/2014
• Issued: 06/09/2015
• Est. Priority Date: 10/23/2006
• Status: Active Grant

• Current Assignee: Numecent Holdings Incorporated
• Original Assignee: Numecent Holdings Incorporated
• Inventors: Hitomi, Arthur S., Tran, Robert, Kammer, Peter, Pfiffner, Doug, Nguyen, Huy
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US14/296,342
• Publication Number:
  US 20150067149A1
• Time in Patent Office: 370 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The engine uses a combination of embedded and configurable rules. It may be desirable to assign and manage rules per process, per resource (e.g. file, registry, etc.), and per user. Access rules may be altitude-specific access rules.

Claims

1. A method comprising:

receiving a request to access a resource with an altitude, the resource used in executing a first streaming application;

managing rule-based access to the resource based on the altitude of the resource comprising;

determining whether the resource is associated with a DMZ;

if it is determined that the resource is associated with the DMZ, the managing the rule-based access to the resource based on the altitude of the resource further comprising;

determining access control rules for accessing the resource based on the altitude of the resource;

providing access to the resource based on the access control rules for the resource;

executing the first streaming application using the resource;

setting a timer for the first streaming application;

determining if the timer has expired, and if it is determined that the timer has expired, the method further comprising;

pausing execution of the first streaming application;

executing a second streaming application to completion;

resuming execution of the first streaming application after the second streaming application is executed to completion;

resetting the timer.

2. The method of claim 1, wherein the resource includes files and registry keys, the method further comprising setting up selective hooks for the files at the altitude of the resource.

3. The method of claim 1, wherein the resource includes files and registry keys, the method further comprising setting up registry hooks for registry keys at the altitude of the resource.

4. The method of claim 1, wherein the first streaming application is at least partially virtualized in a software container such that the resource is associated with the software container.

5. The method of claim 1, wherein the resource includes a plurality of blocks of the first streaming application, the providing access to the resource based on the access control rules for the resource further comprising sending at least a first block of the plurality of blocks of the first streaming application to a streaming client in accordance with the access control rules for the resource.

6. The method of claim 5, further comprising:

determining if the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client;

if it is determined that the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client, beginning execution of the first streaming application on the streaming client;

if it is determined that the first block of the plurality of blocks is insufficient to begin execution of the first streaming application on the streaming client, sending at least a second block of the plurality of blocks of the first streaming application to the streaming client in accordance with the access control rules for the resource.

7. The method of claim 6, further comprising:

determining whether a trigger event occurs during execution of the first streaming application on the streaming client;

if it is determined that the trigger event occurs, the method further comprising;

pausing execution of the first streaming application on the streaming client;

executing an alternative application on the streaming client;

resuming execution of the first streaming application on the streaming client using blocks of the plurality of blocks of the first streaming application sent to the streaming client in accordance with the access control rules for the resource after the alternative application is executed on the streaming client.

8. The method of claim 1, further comprising, if the altitude for the resource is zero:

writing files included as part of the resource on a streaming client;

changing a registry of the streaming client;

updating environment variables of the streaming client.

9. The method of claim 1, wherein the request includes a resource ID of the resource and a process ID of a process that the resource is associated with, the method further comprising using the resource ID and the process ID to look up, in a requestor-specific access control table, the altitude of the resource and the access control rules for accessing the resource.

10. The method of claim 1, wherein the access control rules for the resource include one of Accept, Pause, or Deny.

11. A system comprising:

at least one processor;

memory storing instructions configured to instruct the at least one processor to perform;

receiving a request to access a resource with an altitude, the resource used in executing a first streaming application;

managing rule-based access to the resource based on the altitude of the resource comprising;

determining whether the resource is associated with a DMZ;

if it is determined that the resource is associated with the DMZ, the managing the rule-based access to the resource based on the altitude of the resource further comprising;

determining access control rules for accessing the resource based on the altitude of the resource;

providing access to the resource based on the access control rules for the resource;

executing the first streaming application using the resource;

setting a timer for the first streaming application;

determining if the timer has expired, and if it is determined that the timer has expired, the instructions further configured to instruct the at least one processor to perform;

pausing execution of the first streaming application;

executing a second streaming application to completion;

resuming execution of the first streaming application after the second streaming application is executed to completion;

resetting the timer.

12. The system of claim 11, wherein the resource includes files and registry keys, the instructions further configured to instruct the at least one processor to perform setting up selective hooks for the files at the altitude of the resource.

13. The system of claim 11, wherein the resource includes files and registry keys, the instructions further configured to instruct the at least one processor to perform setting up registry hooks for registry keys at the altitude of the resource.

14. The system of claim 11, wherein the first streaming application is at least partially virtualized in a software container such that the resource is associated with the software container.

15. The system of claim 11, wherein the resource includes a plurality of blocks of the first streaming application, the instructions further configured to instruct the at least one processor to perform sending at least a first block of the plurality of blocks of the first streaming application to a streaming client in accordance with the access control rules for the resource.

16. The system of claim 15, wherein the instructions are further configured to instruct the at least one processor to perform:

determining if the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client;

if it is determined that the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client, beginning execution of the first streaming application on the streaming client;

if it is determined that the first block of the plurality of blocks is insufficient to begin execution of the first streaming application on the streaming client, sending at least a second block of the plurality of blocks of the first streaming application to the streaming client in accordance with the access control rules for the resource.

17. The system of claim 16, wherein the instructions are further configured to instruct the at least one processor to perform:

determining whether a trigger event occurs during execution of the first streaming application on the streaming client;

if it is determined that the trigger event occurs, the instructions further configured to instruct the at least one processor to perform;

pausing execution of the first streaming application on the streaming client;

executing an alternative application on the streaming client;

resuming execution of the first streaming application on the streaming client using blocks of the plurality of blocks of the first streaming application sent to the streaming client in accordance with the access control rules for the resource after the alternative application is executed on the streaming client.

18. The system of claim 11, wherein if the altitude for the resource is zero, the instructions are further configured to instruct the at least one processor to perform:

writing files included as part of the resource on a streaming client;

changing a registry of the streaming client;

updating environment variables of the streaming client.

19. The system of claim 11, wherein the request includes a resource ID of the resource and a process ID of a process that the resource is associated with, the instructions further configured to instruct the at least one processor to perform using the resource ID and the process ID to look up, in a requestor-specific access control table, the altitude of the resource and the access control rules for accessing the resource.

20. The system of claim 11, wherein the access control rules for the resource include one of Accept, Pause, or Deny.