Declarative Security Policy for Application Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing environments with multiple applications lack fine-grained protection mechanisms, as context isolation treats all server applications in an execution context uniformly, failing to account for varying security requirements among different applications, leading to the need for frequent updates and upgrades to manage new clients and security requirements.
Innovation Solution
An access control mechanism that allows application providers to set up declarative security policies specific to application modules, enabling fine-grained security by distinguishing between different applications through domain security policies and application-level permissions, which can be modified post-deployment without rebuilding the application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If context isolation is implemented to protect applications and their resources, then security protection is improved, but fine-grained application-specific protection is lost because all server applications are treated uniformly
Solution Approach 1:
The patent segments the security policy into two distinct levels: domain security policies that apply to all applications within an execution context, and application security policies that are specific to individual applications. This segmentation allows the system to maintain both coarse-grain context isolation and fine-grain application-specific protection simultaneously, resolving the contradiction between uniform security and adaptive security requirements.
Solution Approach 2:
The patent implements local quality by allowing different security policies to be applied to different applications within the same execution context. Each application can have its own application security policy that specifies which client applications are authorized to access its protected resources, while still operating under the domain security policy of its execution context. This enables tailored security protection for each application rather than a one-size-fits-all approach.
2Adaptability or versatility
If program logic is added to server applications to provide application-specific security, then fine-grained security control is improved, but device complexity increases and frequent updates are required
Solution Approach 1:
The patent extracts the application-specific security logic from the server application code itself and places it into separate application security policies that are stored externally. These policies contain the authorization rules and client credentials information, allowing the server application to enforce fine-grained security without containing complex embedded logic. This extraction reduces the complexity of the server application while maintaining adaptive security control.
Solution Approach 2:
The patent implements preliminary action by pre-defining application security policies that contain all necessary authorization rules and client credentials information before runtime. These policies are established in advance and stored for later retrieval and enforcement, eliminating the need for complex runtime decision-making logic within the server application. The security rules are prepared beforehand, simplifying the server application's runtime operation.
3Adaptability or versatility
If server applications are frequently updated to cope with new clients and security requirements, then adaptability to new security scenarios is improved, but productivity decreases due to continuous development and deployment cycles
Solution Approach 1:
The patent implements dynamics by making the security policy configurable and modifiable without requiring server application updates. The application security policies can be dynamically adjusted to accommodate new clients and security requirements by simply modifying the policy files or database entries, rather than rebuilding and redeploying the entire server application. This dynamic policy configuration enables rapid adaptation to changing security scenarios while maintaining high productivity.
Solution Approach 2:
The patent creates a universal security policy framework that can handle multiple types of clients and security requirements through a common policy structure. The application security policies use standardized formats and mechanisms that can accommodate diverse security scenarios without requiring custom development for each case. This universal approach allows the system to adapt to new security requirements by configuring existing policy templates rather than developing new application code.
Data Source
AI summary
A access control mechanism is provided on a computing device to allow an application provider to set up a declarative security policy specific to an application module. When a runtime environment of the computing device receives a request from a second application instance in a second execution context to access a protected resource in a first application instance, the runtime environment invokes the access control mechanism to determine, based on a protection-domain-level domain security policy, whether the second application instance is allowed to access protected resources in the first execution context. If so, the runtime environment invokes the access control mechanism to determine, based on a declarative security policy for a first application module associated with the first application instance, whether the second application instance is allowed to access the protected resource. If so, the runtime environment allows the second application instance access to the protected resource requested.