Patent Application
20080046961
The invention enables significant performance gains by compiling complex access control rules using a network service (e.g., security server), wherein several client applications can share the same compiled access control rules. Centralized sharing of the same rules works to eliminate the risk of having different applications, rules, and versions coexisting on the same network. It also makes it a lot easier to update the access control logic since it is centralized into a few, possibly a single, component.
Security server 120 may be located in logical and/or physical proximity to client computer 100 or to the other servers 130, 140, 150. Client computer 100 may encompass other types of client devices and should not be limited to personal computer. For example, client machine may be a mobile device, like a cell-phone, or other device, like an embedded system. Client computer may also operate in an off-line mode if needed. In an off-line mode the permission evaluation may use cached information from previous communication with the servers, and consider their results as valid as long as a response timestamp is still valid.
During client computer operations the application 102 and/or security manager 106 of the virtual machine 104 on client computer 100 may request permission(s) to access application resources (e.g., files, directories, process). Permissions may represent the right to access various system and network resources based on security policies. A set of permissions may be determined for an application code based on the security policy and evidence provided by the application code including, but not limited to, identity, publisher, source (e.g., URL, website), origin (e.g., Internet, Intranet) and/or other information about the application seeking permission. With an ECMA-335 VM, the application and its assemblies (e.g., .DLL files, .EXE files) may specify the requested permissions using declarative or imperative security. Declarative security allows the developer of the application code to insert permission attributes into the code itself whereas imperative security may allow the developer to specify permissions dynamically within source code. Both types are well known in code development and execution. The present invention is able to delegate the permission evaluation to a network service without requiring change to existing VM and security manager, enabling existing applications to gain both performance and manageability advantages without extensive changes.
According to one aspect of the invention, an application 102 running on a client computer 100, may request permissions from a network service running on a security server. This request may include at least, the requested permission (e.g. access file “secret.doc”) and some evidences to help evaluation (e.g. current user is “Bob”).
Alternatively, an application 102 may be executed under a virtual machine 104. In this case the application's declarative and/or imperative security may request permissions from the VM security manager 106, which can delegate the permission evaluation to a network service running on a security server 120. The request may include the XML representation of the permission, the current call stack, application domain, and assembly's evidences. In this case changes to the application itself are minor due to the transparency of the security manager's actions.
In both cases, a security server 120 can use the rule compiler 114 to compile its stored security policies from storage 118 and any other rules it receives from other servers 130, 140, 150. This allows static access control rules and definitions to be compiled for more efficient security evaluation when permissions are requested from client computers 100. Using the code evidences and permission request supplied by the client computer 100 the compiled rules may be executed, with a greater speed than interpreted rules. In the event that a rule does change, the rule can trigger a re-compilation at the security server.
Delegated permission evaluation allows the security permissions to be judged outside the client machine. Further optimization may be made by security server 120 in specific contexts. For example, the repetitive pattern of asking for network resources can be cached. Thus, a response to request for a web service (e.g. service discovery) from a client computer 100 can be made almost instantly when presented a second or subsequent time. Caching the results of the web service for a policy defined time can lower bandwidth usage and improve performance without sacrificing security. Caching can also be implemented at the client computer 100. In this case the security server 120 may add a timestamp within a response. This timestamp can indicate an interval of time, between now and a specified time, for which the result is known to be valid. Client-side caching may be useful when client computers 100 are executing in an offline mode.
A further optimization technique is possible if parts of some rules logic are expected to change often. For example, it may be that a large part of the rule is static and a minor part is dynamic. Splitting such rules into several smaller rules and compiling the rules independently (e.g., one assembly per rule file) can improve performance in the case that some (top) rules are being generated very frequently or automatically for each request. The change of one or more rule(s) can trigger a selective recompilation at security server 120. The impact of the changes is still very small compared to the gains made by compiling the rules.
Thus, the client machine's environment may remain unchanged with respect to evolving security rules. The client computer 100 supplies the evidence in order for the security server 120 to evaluate the security permissions and the client computer 100 enforces the policies sent back from the security server 120. The client computer 100 requests permissions and receives permissions with little regard as to where the security decision came from. The client may be further optimized when applications are executed on a virtual machine where the security manager can be extended to provide such services transparently.
A networked permission also has the advantage of being very generic. The client computer 100 may have limited (little to none) knowledge about the rules used to evaluate the requested permission. Such rules can be changed without affecting the local applications, even while the local applications are executing on the client computer 100.
In the foregoing specification, the invention has been described with reference to specific embodiments thereof. Various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.
