Back to results
US 10,757,128 B2Granted
Security policy analyzer service and satisfiability engine
AssigneeAmazon Technologies, Inc.
InventorsJohn Cook, Neha Rungta, Catherine Dodge, Jeff Puchalski, Carsten Varming
Life of this patent
Estimating the term…
Abstract
Security policies may be utilized to grant or deny permissions related to the access of computing resources. Two or more security policies may be compared to determine whether the policies are equivalent, whether one security is more permissive than another, and more. In some cases, it may be possible to identify whether there exists a security permission that is sufficient to determine two security policies lack equivalency. Propositional logics may be utilized in the evaluation of security policies.
Claims21
A computer-implemented method, comprising:
- obtaining, via an interface, information specifying:
- a first security policy encoding a first set of security permissions;
- and
- a second security policy encoding a second set of security permissions, wherein the second set of security permissions encodes a constraint that is applicable when a source virtual computing environment endpoint exists and is inapplicable when the source virtual computing environment endpoint does not exist;
- determining a first propositional logic expression based at least in part on the first set of security permissions;
- determining a second propositional logic expression based at least in part on the second set of security permissions;
- identifying a set of parameters that is sufficient to determine the first propositional logic and the second propositional logic lack equivalency such that applying the first security policy to the set of parameters results in a grant of access to a computing resource associated to the set of parameters and applying the second security policy to the set of parameters results in a denial of access to the computing resource, wherein the first propositional logic expression and the second propositional logic expression are collectively sufficient to identify the set of parameters;
- and
- providing, via the interface, a result indicating that the first security policy grants a particular virtual computing environment endpoint access to a computing resource that the second security policy denies access to.
6 more elements
A system, comprising:
- one or more processors;
- memory that stores computer-executable instructions that, as a result of execution, cause the system to:
- determine a first propositional logic based at least in part on a first set of security permissions;
- determine a second propositional logic based at least in part on a second set of security permissions, wherein the second set of security permissions encodes a constraint that is applicable when a source virtual computing environment endpoint exists and is inapplicable when the source virtual computing environment endpoint does not exist;
- identify a set of parameters that is sufficient to determine the first propositional logic and the second propositional logic lack equivalency using the first propositional logic and the second propositional logic, wherein the first propositional logic and the second propositional logic form information that is sufficient to determine that the first propositional logic and the second propositional logic lack equivalency, further wherein applying the first set of security permissions to the set of parameters results in a grant of access to a computing resource associated to the set of parameters and applying the second set of security permissions to the set of parameters results in a denial of access to the computing resource;
- and
- provide an indication that the first set of security permissions and the second set of security permissions lack equivalency as a result of different access being granted to a particular virtual computing environment endpoint.
4 more elements
A non-transitory computer-readable storage medium storing executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- identify a set of parameters that is sufficient to determine that there exists a security permission associated with either a first set of security permissions or a second set of security permissions that is sufficient to determine a first propositional logic determined from the first set of security permissions and a second propositional logic determined from the second set of security permissions lack equivalency, wherein the first propositional logic and the second propositional logic form information that is sufficient to determine that the first propositional logic and the second propositional logic lack equivalency, wherein the second set of security permissions encodes a constraint that is applicable when a source virtual computing environment endpoint exists and is inapplicable when the source virtual computing environment endpoint does not exist, further wherein applying the first set of security permissions to the set of parameters results in a grant of access to a computing resource associated to the set of parameters and applying the second set of security permissions to the set of parameters results in a denial of access to the computing resource;
- and
- provide an indication that the first set of security permissions and the second set of security permissions lack equivalency based at least in part on exercising the first set of security permissions and the second set of security permissions against a particular virtual computing environment endpoint.
Dependencies are inferred from the claim text.