Back to results
US 8,544,083 B2Granted
Identification security elevation
AssigneeMicrosoft Corporation
InventorsKarthik Jaganathan, Tanmoy Dutta, Eric C Perlin, Steven L. Hiskey, Cezar Ungureanasu
Life of this patent
Estimating the term…
Abstract
Security elevation techniques are described. In an implementation, a request is received for additional security access beyond that which is currently specified for a program. An identity that describes the program is checked with a plurality of conditions. The security level is automatically elevated to grant the additional security access when the identity corresponds to one of the conditions that indicates that the security level is to be automatically elevated.
Claims20
A method comprising:
- receiving a request from a first program on behalf of a second program that is identifiable using multiple identities that each describe the second program and for additional security access beyond that which is currently specified for the second program, the request including at least one of the identities that describes the second program;
- checking the at least one of the identities that describes the second program with a plurality of conditions to determine whether the at least one identity corresponds to at least one of the conditions that causes one of a program path, a program manufacturer, a program name, or a program version to be checked, each of the conditions:
- corresponds to particular identities such that correspondence of the at least one identity to a condition does not indicate correspondence of another one of the identities that describes the second program to the condition and non-correspondence of the at least one identity to the condition does not indicate non-correspondence of the other identities to the condition;
- and
- is associated with a procedure that is to be performed before a security level for the second program is elevated above a current security level for the second program to grant the additional security access;
- and
- automatically elevating the security level for the second program to grant the additional security access when the at least one identity corresponds to a condition that indicates that the security level is to be automatically elevated.
4 more elements
One or more computer-readable memory devices comprising instructions that are
- executable to generate a background service that is operable to:
- verify that an identity, which is one of multiple identities associated with a program that each serve to describe the program, is bound to data that forms the program responsive to a request for security access beyond a security level that is currently specified for the program, the multiple identities including at least one of a path, a manufacturer, a name, or a version of the program, the request made by another program on behalf of the program, and the security access enabling the program to perform actions that are restricted for the program at the level that is currently specified for the program;
- and
- elevate the security level for the program beyond the level that is currently specified for the program independent of a security level of the other program and without manual authorization when the identity corresponds to one of a plurality of conditions that is associated with automatic security level elevation, at least one of the plurality of conditions corresponds to elevating the security level for a program based on a manufacturer of said program.
1 more element
One or more computer-readable memory devices comprising instructions that are executable to:
- check an identity of a program having multiple identities that each describe the program with a list of conditions responsive to a request for elevated security access of the program, the multiple identities including at least one of a path, a manufacturer, a name, or a version of the program, the request made by another program on behalf of the program, and the identity being associated with a hash with data that forms the program, in which the hash is included in a file signed with a certificate, each of the conditions:
- corresponds to particular identities such that correspondence of the checked identity to a condition does not indicate correspondence of another one of the identities that describes the program to the condition and non-correspondence of the checked identity to the condition does not indicate non-correspondence of the other identities to the condition;
- and
- is associated with a procedure that is to be performed before the program's security access is elevated above a current level of access to permit the program the elevated security access;
- at least one of the conditions is associated with a procedure to elevate the security access when the identity matches the condition independent of an identity of a user of the program;
- and
- elevate the program's security access automatically when the identity of the program corresponds to one of the conditions in the list that indicates that the elevated security access is permitted and the certificate is associated with the one of the conditions, the security access of the program being elevated independent of the other program's security access.
4 more elements
Dependencies are inferred from the claim text.