Granting least privilege access for computing processes

US8397290B2 · kind B2 · utility

Assignee

• Microsoft Corporation · US

Inventors

• Neil L. Coles · Redmond, US
• Scott R. Shell · Redmond, US
• Upender Sandadi · Issaquah, US
• Angelo Renato Vals · Redmond, US
• Matthew G. Lyons · Palatine, US
• Christopher Ross Jordan · Redmond, US
• Andrew Rogers · Bellevue, US
• Yadhu Gopalan · Issaquah, US
• Bor-Ming Hsieh · Redmond, US

Key dates

• Filing date: Jun 27, 2008
• Grant date: Mar 12, 2013
• Expiry date: Jul 12, 2031

Classification

• Technology area (CPC G): Physics
• CPC primary: G06F2221/2145
• WIPO field: Computer technology
• WIPO sector: Electrical engineering

Abstract

Embodiments provide a security infrastructure that may be configured to run on top of an existing operating system to control what resources can be accessed by an applications and what APIs an application can call. Security decisions are made by taking into account both the current thread's identity and the current thread's call chain context to enable minimal privilege by default. The current thread context is captured and a copy of it is created to be used to perform security checks asynchronously. Every thread in the system has an associated identity. To obtain access to a particular resource, all the callers on the current thread are analyzed to make sure that each caller and thread has access to that resource. Only when each caller and thread has access to that resource is the caller given access to that resource.