Back to results
US 2003/0233544 A1Published application
Methods and systems for providing a secure application environment using derived user accounts
AssigneeGreen Border Technologies
InventorUlfar Erlingsson
Life of this patent
Estimating the term…
Abstract
A secure application environment (“SAE”) may be created by using derivation transformations (“DTs”) to create a derived user account (“DUA”) based on the original user account (“OUA”). An SAE may be created by selecting for each resource whose access is controlled by the OUA a DT that provides security for that resource without, whenever possible, reducing the functionality of the system as a whole, and creating a means for accessing a version of each resource based on the selected DT that may be accessed by an insecure actor.
Claims69
A method of creating a secure application environment in a computer system comprising at least one resource the access to which is governed by a user account, the method comprising:
- determining if the at least one resource is within the secure application environment;
- and,
- if the at least one resource is within the secure application environment,
- determining a transformation rule for the at least one resource based on the user account;
- and
- handling a request to access the at least one resource in accordance with the transformation rule for the at least one resource.
3 more elements
A method for creating a secure application execution environment in a computer system that allows access to resources based on a user account, the method comprising:
- receiving a request to access a resource to which access is governed by the user account, the request specifying the requested resource and an access type;
- determining a transformation rule for the requested resource based on the access type;
- and
- handling the request to access the resource in accordance with the transformation rule.
1 more element
A method for creating a secure application environment in a computer system comprising at least one resource, the method comprising:
- generating a user account associated with the secure application environment, the user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- receiving a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- accessing the requested resource based on the derivation transformation associated with the one of the at least one matching resources, if the requested access is allowable.
1 more element
A method of handling a request to access a resource in a computer system or network of computers, the method comprising:
- generating a table comprising window handles that are valid within a secure environment;
- intercepting a system call comprising a window handle representing a resource that a user wishes to access;
- determining if the window handle exists in the table;
- granting access to the resource, if the window handle exists in the table;
- and
- refusing access if the window handle does not exist in the table.
3 more elements
A method for creating a secure application environment in a computer system comprising at least one resource, the method comprising:
- generating a first user account associated with the secure application environment, the first user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- generating a second user account based on the first user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the first user account, at least one allowed access type and at least one derivation transformation;
- receiving a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- accessing the requested resource based on the derivation transformation associated with the one of the at least one matching resources, if the requested access is allowable.
2 more elements
A method for creating a secure application environment in a computer system comprising at least one resource, the method comprising:
- generating at least one user account associated with the secure application environment, the at least one user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- intercepting a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- if the requested resource is within the secure application environment,
- modifying the request based on the derivation transformation associated with the requested resource;
- and
- performing the modified request;
- and
- if the requested resource is not within the secure application environment, rejecting the request.
6 more elements
An apparatus comprising:
- at least one memory having program instructions to execute an operating system;
- and
- at least one processor configured to execute the program instructions to perform the operations of:
- determining if the at least one resource is within the secure application environment;
- and,
- if the at least one resource is within the secure application environment,
- determining a transformation rule for the at least one resource based on the user account;
- and
- handling a request to access the at least one resource in accordance with the transformation rule for the at least one resource.
6 more elements
An apparatus comprising:
- at least one memory having program instructions to execute an operating system;
- and
- at least one processor configured to execute the program instructions to perform the operations of:
- receiving a request to access a resource to which access is governed by the user account, the request specifying the requested resource and an access type;
- determining a transformation rule for the requested resource based on the access type;
- and
- handling the request to access the resource in accordance with the transformation rule.
4 more elements
An apparatus comprising:
- at least one memory having program instructions to execute an operating system;
- and
- at least one processor configured to execute the program instructions to perform the operations of:
- generating a user account associated with the secure application environment, the user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- receiving a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- accessing the requested resource based on the derivation transformation associated with the one of the at least one matching resources, if the requested access is allowable.
4 more elements
An apparatus comprising:
- at least one memory having program instructions to execute an operating system;
- and
- at least one processor configured to execute the program instructions to perform the operations of:
- generating a table comprising window handles that are valid within a secure environment;
- intercepting a system call comprising a window handle representing a resource that a user wishes to access;
- determining if the window handle exists in the table;
- granting access to the resource, if the window handle exists in the table;
- and
- refusing access if the window handle does not exist in the table.
6 more elements
An apparatus comprising:
- at least one memory having program instructions to execute an operating system;
- and
- at least one processor configured to execute the program instructions to perform the operations of:
- generating a first user account associated with the secure application environment, the first user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- generating a second user account based on the first user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the first user account, at least one allowed access type and at least one derivation transformation;
- receiving a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- accessing the requested resource based on the derivation transformation associated with the one of the at least one matching resources, if the requested access is allowable.
5 more elements
An apparatus comprising:
- at least one memory having program instructions to execute an operating system;
- and
- at least one processor configured to execute the program instructions to perform the operations of:
- generating at least one user account associated with the secure application environment, the at least one user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- intercepting a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- if the requested resource is within the secure application environment,
- modifying the request based on the derivation transformation associated with the requested resource;
- and
- performing the modified request;
- and
- if the requested resource is not within the secure application environment, rejecting the request.
9 more elements
A computer-readable medium containing instructions for controlling an operating system to perform a method comprising:
- determining if the at least one resource is within the secure application environment;
- and,
- if the at least one resource is within the secure application environment,
- determining a transformation rule for the at least one resource based on the user account;
- and
- handling a request to access the at least one resource in accordance with the transformation rule for the at least one resource.
3 more elements
A computer-readable medium containing instructions for controlling an operating system to perform a method comprising:
- receiving a request to access a resource to which access is governed by the user account, the request specifying the requested resource and an access type;
- determining a transformation rule for the requested resource based on the access type;
- and
- handling the request to access the resource in accordance with the transformation rule.
1 more element
A computer-readable medium containing instructions for controlling an operating system to perform a method comprising:
- generating a user account associated with the secure application environment, the user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- receiving a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- accessing the requested resource based on the derivation transformation associated with the one of the at least one matching resources, if the requested access is allowable.
1 more element
A computer-readable medium containing instructions for controlling an operating system to perform a method comprising:
- generating a table comprising window handles that are valid within a secure environment;
- intercepting a system call comprising a window handle representing a resource that a user wishes to access;
- determining if the window handle exists in the table;
- granting access to the resource, if the window handle exists in the table;
- and
- refusing access if the window handle does not exist in the table.
3 more elements
A computer-readable medium containing instructions for controlling an operating system to perform a method comprising:
- generating a first user account associated with the secure application environment, the first user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- generating a second user account based on the first user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the first user account, at least one allowed access type and at least one derivation transformation;
- receiving a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- accessing the requested resource based on the derivation transformation associated with the one of the at least one matching resources, if the requested access is allowable.
2 more elements
A computer-readable medium containing instructions for controlling an operating system to perform a method comprising:
- generating at least one user account associated with the secure application environment, the at least one user account comprising at least one resource within the secure application environment and, for each of the at least one resources in the secure application environment, at least one allowed access type and at least one derivation transformation;
- intercepting a request to access a resource, the request specifying the requested resource and a requested access type;
- and
- if the requested resource is within the secure application environment,
- modifying the request based on the derivation transformation associated with the requested resource;
- and
- performing the modified request;
- and
- if the requested resource is not within the secure application environment, rejecting the request.
6 more elements
Dependencies are inferred from the claim text.