Security Manager for Dynamic Programming Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic programming environments lack robust security measures, particularly when interacting with non-dynamic environments, leading to potential security compromises and the need for improved isolation between user programs and data in business applications.
Innovation Solution
A security framework using a domain-specific declarative policy language allows administrators to define security policies for bridges between dynamic and non-dynamic programming environments, with a secure bridge implementation that controls access through a security manager, ensuring only permitted operations are used in specific application contexts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If dynamic programming languages are used to allow code changes at runtime, then flexibility and productivity are improved, but security and robustness deteriorate because programs can affect other users' programs and data
Solution Approach 1:
The system segments the programming environment into isolated virtual machines, each running dynamic code in a sandboxed context. This segmentation allows flexibility within each VM while preventing interference between different users' programs, thus resolving the security issue without sacrificing adaptability.
Solution Approach 2:
A security manager acts as an intermediary between the dynamic programming environment and the underlying system resources. It monitors and controls all interactions, permitting only authorized operations, thereby maintaining security while allowing necessary flexibility for dynamic code execution.
2Ease of operation
If dynamic languages allow easy integration and extension, then ease of operation is improved, but security deteriorates due to lack of thread level isolation
Solution Approach 1:
Each integration point and extension mechanism is implemented within isolated virtual machine boundaries, ensuring that easy integration capabilities do not compromise security. The segmentation prevents harmful effects from propagating across thread or user boundaries.
3Adaptability or versatility
If bridges are created between dynamic and non-dynamic environments for interaction, then adaptability is improved, but security deteriorates due to potential compromised security via interaction
Solution Approach 1:
The security manager serves as a mediator for all bridge interactions between dynamic and non-dynamic environments. It enforces security policies that control what operations can occur across the bridge, enabling interoperability while preventing security compromises.
Solution Approach 2:
Security policies are defined and enforced in advance before any bridge interactions occur. This preliminary action establishes secure boundaries and permitted operations, allowing adaptability while preventing security issues before they can manifest.
Data Source
AI summary
In one embodiment the present invention includes a security manager for managing security in a dynamic programming environment. The security manager interfaces between the dynamic programming environment and a non-dynamic programming environment. In this manner, the dynamic programming environment is unable to compromise the non-dynamic programming environment, yet still provide features desirable in a dynamic programming environment. An example using Ruby in a robust business programming environment is detailed.