Authenticated component permissions framework

Patent metadata

Field	Value
Publication number	US-11494479-B2
Application number	US-201916548771-A
Country	US
Kind code	B2
Filing date	Aug 22, 2019
Priority date	Aug 31, 2018
Publication date	Nov 8, 2022
Grant date	Nov 8, 2022

Abstract

Various embodiments set forth techniques for managing access to a resource at a device. In one aspect, a method includes receiving a request by an application to access a resource, determining that an application permission associated with the application and the resource grants the application access to the resource, where the application permission includes a signature of a permission review entity associated with the resource, and granting the request to access the resource based on the application permission. The permission review entity associated with the resource may be authorized through device permissions specified by an implementer or provider of the device.

First claim

What is claimed is:

1. A computer-implemented method for managing access to resources at a device, comprising:
receiving a first request by a first application to access a first resource associated with a first level of access to a first subsystem of the device, wherein a second resource is associated with a second level of access to the first subsystem that is greater than the first level of access;
receiving a first application permission associated with the first application and the first resource, wherein the first application permission includes a first signature of a first permission review entity;
determining that the first application permission grants the first application the first level of access to the first subsystem based on verifying that the first permission review entity is included in a first list of a first descriptor associated with the first resource that lists permission review entities that are authorized to review applications for permission to have the first level of access to the first subsystem, wherein a second list of a second descriptor associated with the second resource lists permission review entities that are authorized to review applications for permission to have the second level of access to the first subsystem, wherein the second list is different from the first list; and
granting the first request to access the first resource based on the first application permission.

2. The method of claim 1 , further comprising:
receiving a second request by a second application to access the first resource;
determining that a second application permission associated with the second application and the first resource denies the second application access to the first resource; and
rejecting the second request to access the first resource based on the second application permission.

3. The method of claim 2 , wherein the second application permission includes a second signature of the first permission review entity.

4. The method of claim 2 , wherein the second application permission includes a second signature of a second permission review entity associated with the first resource, wherein the second permission review entity is distinct from the first permission review entity.

5. The method of claim 1 , wherein the first application permission is associated with one or more access conditions, and wherein determining that the first application permission grants the first application access to the first resource comprises determining that the one or more access conditions are satisfied.

6. The method of claim 1 , further comprising:
obtaining first device permission information; and
based on determining that the first device permission information includes a signature of a system provider entity associated with the device:
determining that the first device permission information is valid, and storing the first device permission information in a memory of the device.

7. The method of claim 6 , further comprising:
obtaining second device permission information; and
based on determining that the second device permission information does not include a signature of the system provider entity associated with the device, determining that the second device permission information is invalid.

8. The method of claim 6 , wherein the first device permission information specifies the first list of the first descriptor that lists the permission review entities that are authorized to review applications for permission to have the first level of access to the first subsystem.

9. The method of claim 8 , further comprising, based on determining that the first permission review entity is included in the first list of the first descriptor that lists the permission review entities, determining that the first application permission is valid.

10. One or more non-transitory computer-readable storage media storing instructions, that, when executed by one or more processors, cause the one or more processors to perform the steps of:
obtaining a first application permission associated with a first application and a first resource associated with a first level of access to a first subsystem of a device, wherein a second resource is associated with a second level of access to the first subsystem that is greater than the first level of access;
based on determining that the first application permission includes a signature of a first permission review entity included in a first list of a first descriptor associated with the first resource that lists permission review entities that are authorized to review applications for permission to have the first level of access to the first subsystem, determining that the first application permission is valid, wherein a second list of a second descriptor associated with the second resource lists permission review entities that are authorized to review applications for permission to have the second level of access to the first subsystem, wherein the second list is different from the first list; and
granting the first application access to the first resource based on the first application permission.

11. The one or more computer-readable storage media of claim 10 , wherein the first application permission is associated with one or more access conditions, and wherein granting the first application access to the first resource comprises granting the first application access based on determining that the one or more access conditions are satisfied.

12. The one or more computer-readable storage media of claim 10 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to perform the steps of:
obtaining a second application permission associated with the first application and the second resource; and
based on determining that the second application permission includes a signature of a second permission review entity not included in the second list of the second descriptor that lists permission review entities associated with the second resource, determining that the second application permission is invalid.

13. The one or more computer-readable storage media of claim 10 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to perform the steps of:
obtaining device permission information;
determining that the device permission information includes a signature of a system provider entity associated with the device; and
based on the determination that the device permission information includes the signature of the system provider entity:
determining that the device permission information is valid, and
storing the device permission information in a memory of the device.

14. The one or more computer-readable storage media of claim 13 , wherein the first list of the first descriptor that lists the permission review entities that are authorized to review applications for permission to have the first level of access to the first subsystem is included in the device permission information.

15. The one or more computer-readable storage media of claim 13 , wherein the device permission information is obtained via the system provider entity.

16. The one or more computer-readable storage media of claim 10 , wherein the first application permission is obtained via an application provider entity associated with the first application.

17. The one or more computer-readable storage media of claim 10 , wherein the first application permission is obtained via the first permission review entity.

18. A system, comprising:
a

Assignees

• Harman Int Ind

Inventors

• Varghese Eugine Thomas
• Gopinath Sreejit

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title