A method and system are provided for determining whether a principal (e.g. a thread) may access a particular resource. According to one aspect of the invention, the access authorization determination takes into account the sources of the code on the call stack of the principal at the time the access is desired. Because the source of the code on the call stack will vary over time, so will the access rights of the principal. Thus, when a request for an action is made by a thread, a determination is made of whether the action is authorized based on permissions associated with routines in a calling hierarchy associated with the thread. The determination of whether a request is authorized is based on a determination of whether at least one permission associated with each routine encompasses the permission required to perform the requested action. Support for "privileged" routines is also provided. When a routine in the calling hierarchy is privileged, the determination of whether an... |
Citations|
| US4809160 | Oct 28, 1985 | Feb 28, 1989 | Hewlett-Packard Company | Privilege level checking instruction for implementing a secure hierarchical computer system | | US5311591 | Jun 3, 1993 | May 10, 1994 | | Computer system security method and apparatus for creating and using program authorization information data structures | | US5649099 | Jun 4, 1993 | Jul 15, 1997 | Xerox Corporation | Method for delegating access rights through executable access control program without delegating access rights not in a specification to any intermediary nor comprising server security | | US5720033 | Jul 25, 1995 | Feb 17, 1998 | Lucent Technologies Inc. | Security platform and method using object oriented rules for computer-based systems using UNIX-line operating systems | | US5745678 | Aug 18, 1997 | Apr 28, 1998 | International Business Machines Corporation | Method and system for the secured distribution of multimedia titles | | US5758153 | Oct 24, 1995 | May 26, 1998 | Object Technology Licensing Corp. | Object oriented file system in an object oriented operating system | | US5845129 | Mar 22, 1996 | Dec 1, 1998 | Philips Electronics North America Corporation | Protection domains in a single address space | | US5892904 | Dec 6, 1996 | Apr 6, 1999 | Microsoft Corporation | Code certification for network transmission | | US5915085 | Feb 28, 1997 | Jun 22, 1999 | International Business Machines Corporation | Multiple resource or security contexts in a multithreaded application | | US5987608 | May 13, 1997 | Nov 16, 1999 | Netscape Communications Corporation | Java security mechanism |
Referenced by|
| US6748594 | Sep 29, 1998 | Jun 8, 2004 | International Business Machines Corporation | Object mechanism and method for retrieving attribute values in a object oriented framework | | US6754889 | Oct 4, 2000 | Jun 22, 2004 | Compuware Corporation | Java automation, testing, and analysis | | US6941552 | Jul 30, 1998 | Sep 6, 2005 | International Business Machines Corporation | Method and apparatus to retain applet security privileges outside of the Java virtual machine | | US7020653 | Feb 10, 2003 | Mar 28, 2006 | Oracle International Corporation | Techniques for supporting application-specific access controls with a separate server | | US7073062 | Dec 19, 2000 | Jul 4, 2006 | International Business Machines Corporation | Method and apparatus to mutually authentication software modules | | US7076804 | May 11, 2001 | Jul 11, 2006 | International Business Machines Corporation | Automated program resource identification and association | | US7103644 | Jun 29, 2001 | Sep 5, 2006 | BellSouth Intellectual Property Corp. | Systems for an integrated data network voice-oriented service and non-voice-oriented service converged creation and execution environment | | US7124203 | Feb 26, 2001 | Oct 17, 2006 | Oracle International Corporation | Selective cache flushing in identity and access management systems | | US7181017 | Mar 25, 2002 | Feb 20, 2007 | David Felsher | System and method for secure three-party communications | | US7185364 | Mar 21, 2001 | Feb 27, 2007 | Oracle International Corporation | Access system interface | | US7194764 | Feb 26, 2001 | Mar 20, 2007 | Oracle International Corporation | User authentication | | US7225256 | Nov 30, 2001 | May 29, 2007 | Oracle International Corporation | Impersonation in an access system | | US7231661 | Jun 21, 2001 | Jun 12, 2007 | Oracle International Corporation | Authorization services with external authentication | | US7249369 | Feb 26, 2001 | Jul 24, 2007 | Oracle International Corporation | Post data processing | | US7275032 | Apr 25, 2003 | Sep 25, 2007 | Bvoice Corporation | Telephone call handling center where operators utilize synthesized voices generated or modified to exhibit or omit prescribed speech characteristics | | US7330876 | Oct 13, 2000 | Feb 12, 2008 | AOL LLC, a Delaware limited liability company | Method and system of automating internet interactions | | US7370159 | Mar 31, 2004 | May 6, 2008 | STMicroelectronics SA | Microprocessor having an extended addressable space | | US7398311 | Oct 3, 2006 | Jul 8, 2008 | Oracle International Corporation | Selective cache flushing in identity and access management systems | | US7444678 | Jun 14, 2004 | Oct 28, 2008 | AOL LLC | Securing resources from untrusted scripts behind firewalls | | US7458084 | Aug 12, 2005 | Nov 25, 2008 | AT&T Delaware Intellectual Property, Inc. | Methods and systems for converged service creation and execution environment applications | | US7458096 | Oct 27, 2006 | Nov 25, 2008 | Oracle International Corpration | Access system interface | | US7464162 | Feb 26, 2001 | Dec 9, 2008 | Oracle International Corporation | Systems and methods for testing whether access to a resource is authorized based on access information | | US7546956 | Apr 29, 2005 | Jun 16, 2009 | Research In Motion Limited | System and method of operation control on an electronic device | | US7587368 | Jul 5, 2001 | Sep 8, 2009 | | Information record infrastructure, system and method | | US7630974 | Sep 28, 2004 | Dec 8, 2009 | Oracle International Corporation | Multi-language support for enterprise identity and access management | | US7653936 | Jun 25, 2003 | Jan 26, 2010 | Microsoft Corporation | Distributed expression-based access control | | US7725735 | Mar 29, 2005 | May 25, 2010 | International Business Machines Corporation | Source code management method for malicious code detection | | US7752438 | Aug 27, 2002 | Jul 6, 2010 | Hewlett-Packard Development Company, L.P. | Secure resource access | | US7765298 | Nov 16, 2006 | Jul 27, 2010 | Oracle International Corporation | Impersonation in an access system | | US7814536 | Oct 4, 2006 | Oct 12, 2010 | Oracle International Corporation | User authentication | | US7815100 | Apr 29, 2005 | Oct 19, 2010 | Research In Motion Limited | System and method of owner application control of electronic devices | | US7849451 | Mar 2, 2006 | Dec 7, 2010 | Oracle America Inc. | Dynamic delegation chain for runtime adaptation of a code unit to an environment | | US7870596 | Feb 1, 2007 | Jan 11, 2011 | Microsoft Corporation | Accessing network resources outside a security boundary | | US7882132 | Oct 9, 2003 | Feb 1, 2011 | Oracle International Corporation | Support for RDBMS in LDAP system | | US7904454 | Jun 16, 2002 | Mar 8, 2011 | International Business Machines Corporation | Database access security | | US7904487 | Oct 9, 2003 | Mar 8, 2011 | Oracle International Corporation | Translating data access requests | | US7926105 | Feb 28, 2006 | Apr 12, 2011 | Microsoft Corporation | Using security-related attributes | | US7933923 | Nov 4, 2005 | Apr 26, 2011 | International Business Machines Corporation | Tracking and reconciling database commands | | US7970788 | Aug 2, 2005 | Jun 28, 2011 | International Business Machines Corporation | Selective local database access restriction | | US8045958 | Nov 21, 2005 | Oct 25, 2011 | Research In Motion Limited | System and method for application program operation on a wireless device | | US8095597 | May 1, 2001 | Jan 10, 2012 | AOL Inc. | Method and system of automating data capture from electronic correspondence | | US8141100 | Dec 20, 2006 | Mar 20, 2012 | International Business Machines Corporation | Identifying attribute propagation for multi-tier processing | | US8204999 | Feb 26, 2001 | Jun 19, 2012 | Oracle International Corporation | Query string processing |
Claims1. A method for providing security, the method comprising the steps of: - detecting when a request for an action is made by a principal; and
- in response to detecting the request, determining whether said action is authorized based on permissions associated with a plurality of routines in a calling hierarchy associated with said principal, wherein said permissions are associated with said plurality of routines based on a first association between protection domains and permissions.
2. The method of claim 1, wherein: - the step of detecting when a request for an action is made includes detecting when a request for an action is made by a thread; and
- the step of determining whether said action is authorized includes determining whether said action is authorized based on an association between permissions and a plurality of routines in a calling hierarchy associated with said thread.
3. The method of claim 1, wherein: - the calling hierarchy includes a first routine; and
- the step of determining whether said action is authorized further includes determining whether a permission required to perform said action is encompassed by at least one permission associated with said first routine.
4. The method of claim 1, wherein the step of determining whether said action is authorized further includes determining whether a permission required to perform said action is encompassed by at least one permission associated with each routine in said calling hierarchy. 5. A method for providing security, the method comprising the steps of: - detecting when a request for an action is made by a principal,
- determining whether said action is authorized based on an association between permissions and a plurality of routines in a calling hierarchy associated with said principal;
- wherein each routine of said plurality of routines is associated with a class; and
- wherein said association between permissions and said plurality of routines is based on a second association between classes and protection domains.
6. A method for providing security, the method comprising the steps of: - detecting when a request for an action is made by a principal; and
- in response to detecting the request, determining whether said action is authorized based on permissions associated with a plurality of routines in a calling hierarchy associated with said principal, wherein a first routine in said calling hierarchy is privileged; and
- wherein the step of determining whether said action is authorized further includes determining whether a permission required to perform said action is encompassed by at least one permission associated with each routine in said calling hierarchy between and including said first routine and a second routine in said calling hierarchy, wherein said second routine is invoked after said first routine, wherein said second routine is a routine for performing said requested action.
7. The method of claim 6, wherein the step of determining whether said permission required to perform said action is encompassed by at least one permission associated with each routine in said calling hierarchy between and including said first routine and said second routine further includes the steps of: - determining whether said permission required is encompassed by at least one permission associated with said second routine; and
- in response to determining said permission required is encompassed by at least one permission associated with said second routine, then performing the steps of:
- A) selecting a next routine from said plurality of routines in said calling hierarchy,
- B) if said permission required is not encompassed by at least one permission associated with said next routine, then transmitting a message indicating that said permission required is not authorized, and
- C) repeating steps A and B until:
- said permission required is not authorized by at least one permission associated with said next routine,
- there are no more routines to select from said plurality of routines in said calling hierarchy, or
- determining that said next routine is said first routine.
8. The method of claim 7, wherein: - the method further includes the step of setting a flag associated with said first routine to indicate that said first routine is privileged; and
- the step of determining that said next routine is said first routine includes determining that a flag associated with said next routine indicates said next routine is privileged.
9. The method of claim 8, wherein the step of setting said flag associated with said first routine includes setting a flag in a frame in said calling hierarchy associated with said thread. 10. A computer-readable medium carrying one or more sequences of one or more instructions, the one or more sequences of the one or more instructions including instructions which, when executed by one or more processors, causes the one or more processors to perform the steps of: - detecting when a request for an action is made by a principal; and
- in response to detecting the request, determining whether said action is authorized based on permissions associated with a plurality of routines in a calling hierarchy associated with said principal, wherein said permissions are associated with said plurality of routines based on a first association between protection domains and permissions.
11. The computer-readable medium of claim 10, wherein: - the step of detecting when a request for an action is made includes detecting when a request for an action is made by a thread; and
- the step of determining whether said action is authorized includes determining whether said action is authorized based on an association between permissions and a plurality of routines in a calling hierarchy associated with said thread.
12. The computer readable medium of claim 10, wherein: - the calling hierarchy includes a first routine; and
- the step of determining whether said action is authorized further includes determining whether a permission required to perform said action is encompassed by at least one permission associated with said first routine.
13. The computer readable medium of claim 10, wherein the step of determining whether said action is authorized further includes determining whether a permission required to perform said action is encompassed by at least one permission associated with each routine in said calling hierarchy. 14. A computer-readable medium bearing instructions for providing security, the instructions including instructions for performing the steps of: - detecting when a request for an action is made by a principal;
- determining whether said action is authorized based on an association between permissions and a plurality of routines in a calling hierarchy associated with said principal;
- wherein each routine of said plurality of routines is associated with a class; and
- wherein said association between permissions and said plurality of routines is based on a second association between classes and protection domains.
15. A computer-readable medium carrying one or more sequences of one or more instructions, the one or more sequences of the one or more instructions including instructions which, when executed by one or more processors, causes the one or more processors to perform the steps of: - detecting when a request for an action is made by a principal; and
- in response to detecting the request, determining whether said action is authorized based on permissions associated with a plurality of routines in a calling hierarchy associated with said principal, wherein a first routine in said calling hierarchy is privileged; and
- wherein the step of determining whether said action is authorized further includes determining whether a permission required to perform said action is encompassed by at least one permission associated with each routine in said calling hierarchy between and including said first routine and a second routine in said calling hierarchy, wherein said second routine is invoked after said first routine, wherein said second routine is a routine for performing said requested action.
16. The computer readable medium of claim 15, wherein the step of determining whether said permission required to perform said action is encompassed by at least one permission associated with each routine in said calling hierarchy between and including said first routine and said second routine further includes the steps of: - determining whether said permission required is encompassed by at least one permission associated with said second routine; and
- in response to determining said permission required is encompassed by at least one permission associated with said second routine, then performing the steps of:
- A) selecting a next routine from said plurality of routines in said calling hierarchy,
- B) if said permission required is not encompassed by at least one permission associated with said next routine, then transmitting a message indicating that said permission required is not authorized, and
- C) repeating steps A and B until:
- said permission required is not authorized by at least one permission associated with said next routine,
- there are no more routines to select from said plurality of routines in said calling hierarchy, or
- determining that said next routine is said first routine.
17. The computer readable medium of claim 16, wherein: - the computer readable medium further comprises one or more instructions for performing the step of setting a flag associated with said first routine to indicate that said first routine is privileged; and
- the step of determining that said next routine is said first routine includes determining that a flag associated with said next routine indicates said next routine is privileged.
18. The computer readable medium of claim 17, wherein the step of setting said flag associated with said first routine includes setting a flag in a frame in said calling hierarchy associated with said thread. 19. A computer system comprising: - a processor;
- a memory coupled to said processor;
- said processor being configured to detect when a request for an action is made by a principal; and
- said processor being configured to respond to detecting the request by determining whether said action is authorized based on permissions associated with a plurality of routines in a calling hierarchy associated with said principal, wherein said permissions are associated with said plurality of routines based on a first association between protection domains and permissions.
20. The computer system of claim 19, wherein: - the calling hierarchy includes a first routine; and
- said processor is configured to determine whether said action is authorized by determining whether a permission required to perform said action is encompassed by at least one permission associated with said first routine.
21. The computer system of claim 19, wherein - said processor is configured to determine whether said action is authorized by determining whether a permission required to perform said action is encompassed by at least one permission associated with each routine in said calling hierarchy.
|
