System and method for executing a permissions recorder analyzer
AssigneeNovell, Inc.
InventorSebastien Pouliot
Life of this patent
Estimating the term…
Abstract
System and method for accurately determining security policy for an application based on dynamic code analysis of application runtime execution(s). A dynamic recorder, dynamic code analyzer and security policy analyzer can evaluate and determine the security decisions and access to secure resources made during a security event within one or more executions of an application in order to identify an existing security policy that best matches an application's security needs. Security events may be analyzed to determine which security decisions and access to secure resources are necessary and which can be eliminated or replaced with alternative decisions or resources.
Claims26
A computer implemented method for determining a security policy based on execution of application code, comprising:
- executing an application in a runtime module on a computer;
- dynamically logging runtime execution data for the application during the execution of the application in the runtime module;
- identifying one or more security related events generated during the execution of the application from the dynamically logged runtime execution data for the application;
- determining a minimal security policy for the application from the one or more security related events generated during the execution of the application;
- determining whether an existing security policy contained in a database coupled to the computer matches the minimal security policy determined for the application;
- suggesting the existing security policy for the application in response to determining that the existing security policy contained in the database matches the minimal security policy determined for the application;
- and
- creating a new security policy for the application in response to determining that the existing security policy contained in the database does not match the minimal security policy determined for the application.
A computer implemented system for determining a security policy based on execution of application code, comprising:
- a computer comprising at least one processor configured to execute an application, wherein the application comprises computer executable instructions stored in a memory coupled to the computer;
- a runtime module configured to execute the application on the computer;
- a dynamic recorder configured to dynamically log runtime execution data for the application during the execution of the application in the runtime module;
- a dynamic code analyzer that receives the dynamically logged runtime execution data for the application from the dynamic recorder, wherein the dynamic code analyzer is configured to:
- identify one or more security related events generated during the execution of the application from the dynamically logged runtime execution data for the application;
- and
- determine a minimal security policy for the application from the one or more security related events generated during the execution of the application;
- and
- a security policy module that receives the minimal security policy determined for the application from the dynamic code analyzer, wherein the security policy module is configured to:
- determine whether an existing security policy contained in a database coupled to the computer matches the minimal security policy determined for the application;
- suggest the existing security policy for the application in response to determining that the existing security policy contained in the database matches the minimal security policy determined for the application;
- and
- create a new security policy for the application in response to determining that the existing security policy contained in the database does not match the minimal security policy determined for the application.
Dependencies are inferred from the claim text.