Back to results
US 11,961,011 B2Granted
Securing computing resources through entity aggregation
OwnerDennis Paul Ackerman, Stephen Francis Taylorinventors
Life of this patent
Estimating the term…
Abstract
Entity aggregation for security computing resources involves an aggregation covenant that conditionally conveys rights to aggregation members. The ruling covenant is defined for protecting one or more computing resources by overriding system-level and/or entity-specific rights (e.g., super-users). An aggregation configuration module defines an aggregation-specific instance of an entity (user/device, process, or data) that receives the conveyed rights. The entity can use the rights conveyed only through its corresponding instance.
Claims73
A system for securing resources in a computing system through entity aggregation, the system comprising:
- a plurality of entities including a user-type entity or user aggregation, a data-type entity or data aggregation, and a process-type entity or process aggregation, wherein each entity of the plurality of entities is associated with a corresponding entity-specific set of access and privilege information that is indicative of computing environment capabilities of the entity and that is derived from a corresponding root certificate of the entity;
- an aggregation covenant defining an aggregation-specific set of computing environment capabilities, wherein at least one capability in the aggregation-specific set corresponds to a capability in the entity-specific set;
- an aggregation rule configuration module that when executed on at least one processor is adapted to configure at least one rule by which entities of the plurality of entities are aggregated as members of an aggregation associated with the aggregation covenant;
- an aggregation configuration module that when executed on at least one processor is adapted to define an instance of at least one of the plurality of entities as a member of the aggregation based on the at least one rule, wherein each member of the aggregation is bound by a combination of capabilities including capabilities of the aggregation-specific set of capabilities and capabilities of the entity-specific set of capabilities for which there are no corresponding capabilities in the aggregation-specific set of capabilities;
- and
- the at least one processor adapted to control operation of at least one member of the aggregation by overriding the capability in the entity-specific set for the at least one member with the corresponding at least one capability in the aggregation-specific set.
3 more elements
A system for securing resources in a computing system through entity aggregation, the system comprising:
- an aggregation rule configuration module that when executed on at least one processor is adapted to configure at least one rule by which entities of a plurality of entities are aggregated as members of an aggregation that is associated with an aggregation covenant that defines a set of computing environment capabilities granted to members of the association, wherein each of the plurality of entities is associated with corresponding entity-specific computing environment capabilities;
- an aggregation configuration module that when executed on at least one processor is adapted to define an instance of at least one entity of the plurality of entities as a member of the aggregation based on the at least one rule, wherein a member of the aggregation is bound by a combination of capabilities including capabilities granted to the member and a subset of the corresponding entity-specific computing environment capabilities of the at least one entity that is based on a correspondence thereof with the capabilities granted to the member;
- and
- the at least one processor adapted to control operation of at least one member of the aggregation by overriding a capability of the entity-specific computing environment capabilities for the at least one member with a corresponding capability granted to the at least one member.
1 more element
A method for securing resources in a computing system through entity aggregation, the method comprising:
- configuring an aggregation covenant with an aggregation-specific set of computing environment capabilities;
- accessing a set of access and privilege information that is indicative of entity-specific computing environment capabilities for an entity in a plurality of entities including a user-type entity or user aggregation, a data-type entity or data aggregation, and a process-type entity or process aggregation, wherein at least one capability in the aggregation-specific set corresponds to at least one of the entity-specific computing environment capabilities;
- configuring, by executing an aggregation rule configuration module on at least one processor, at least one rule by which entities of the plurality of entities are aggregated as members of an aggregation associated with the aggregation covenant;
- aggregating, by executing an aggregation configuration module on at least one processor, an instance of at least one of the plurality of entities as a member of the aggregation based on the at least one rule, wherein each member of the aggregation is bound by a combination of capabilities including capabilities of the aggregation-specific set of capabilities and by the entity-specific capabilities for which there are no corresponding capabilities in the aggregation-specific set of capabilities;
- and
- securing a computing system resource with the at least one processor by performing at least one computer security action that overrides at least one of the entity-specific computing environment capabilities with at least one corresponding capability in the aggregation-specific set of capabilities.
3 more elements
Dependencies are inferred from the claim text.