Rule-based application access management

Patent metadata

Field	Value
Publication number	US-11451548-B2
Application number	US-201916513644-A
Country	US
Kind code	B2
Filing date	Jul 16, 2019
Priority date	Oct 23, 2006
Publication date	Sep 20, 2022
Grant date	Sep 20, 2022

Abstract

A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The engine uses a combination of embedded and configurable rules. It may be desirable to assign and manage rules per process, per resource (e.g. file, registry, etc.), and per user. Access rules may be altitude-specific access rules.

First claim

The invention claimed is:

1. A method comprising:
obtaining, by a rule engine comprising one or more processors and memory, a request from a process to access one or more resources in a software container, wherein the rule engine obtaining the request comprises the rule engine using a file system hook to intercept the request, and wherein the software container includes the rule engine redundantly, or via relative global access;
assigning, by the rule engine to the process, a rule that allows or denies access to the one or more resources;
if the rule assigned to the process allows access to the one or more resources, instructing, by the rule engine, the software container to allow the process access to the one or more resources;
if the rule assigned to the process denies access to the one or more resources and the process is located within the software container, instructing, by the rule engine, the software container to copy the one or more resources for local modification by the process.

2. The method of claim 1 , wherein the assigning the rule to the process is based on one or more of file access control lists, user access control lists, process access control lists, software handlers, file overlays, and resource overlays.

3. The method of claim 1 , wherein the process is a main process having one or more child processes and the method comprises assigning, by the rule engine to the one or more child processes, the same rule assigned to the main process.

4. The method of claim 1 , wherein the rule engine obtaining the request comprises the rule engine receiving the request from the process.

5. The method of claim 1 , wherein the rule engine obtaining the request comprises the rule engine using a virtual drive to intercept the request.

6. The method of claim 1 , wherein the file system hook is a filter driver.

7. The method of claim 1 , wherein the rule engine is local to the software container.

8. The method of claim 1 , wherein the rule engine is remote to the software container.

9. A system comprising:
a rule engine comprising one or more hardware processors and memory;
a software container including resources;
a process;
wherein, in operation, the rule engine:
obtains a request from the process to access one or more resources in the software container, wherein the rule engine obtaining the request comprises the rule engine using a file system hook to intercept the request, and wherein the software container includes the rule engine redundantly, or via relative global access;
assigns to the process a rule that allows or denies access to the one or more resources;
if the rule assigned to the process allows access to the one or more resources, instructs the software container to allow the process access to the one or more resources;
if the rule assigned to the process denies access to the one or more resources and the process is located within the software container, instructs the software container to copy the one or more resources for local modification by the process.

10. The system of claim 9 , wherein the assigning the rule to the process is based on one or more of file access control lists, user access control lists, process access control lists, software handlers, file overlays, and resource overlays.

11. The system of claim 9 , wherein the process is a main process having one or more child processes and wherein, in operation, the rule engine assigns to the one or more child processes the same rule assigned to the main process.

12. The system of claim 9 , wherein the rule engine obtaining the request comprises the rule engine receiving the request from the process.

13. The system of claim 9 , wherein the rule engine obtaining the request comprises the rule engine using a virtual drive to intercept the request.

14. The system of claim 9 , wherein the file system hook is a filter driver.

15. The system of claim 9 , wherein the rule engine is local to the software container.

16. The system of claim 9 , wherein the rule engine is remote to the software container.

Assignees

• Numecent Holdings Inc

Inventors

• Hitomi Arthur S
• Tran Robert
• Kammer Peter J
• Pfiffner Doug
• Nguyen Huy

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L41/0813

  characterised by the conditions triggering a change of settings · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F9/468 Primary

  Specific access rights for resources, e.g. using capability register · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title