Access authorization having embedded policies

A method in a computing system having a memory and a processor for receiving an embedded policy, the method comprising:nreceiving a request to load a first application program of a first application program image;determining whether a first policy is embedded within the first application program image, such that the first application program image contains the first application program and the embedded first policy, wherein the first policy is coded in a programming language;responsive to determining that a first policy is embedded in the first application program image:nwith the processor, extracting the first policy from the first application program image,loading the first application program for execution by the processor,starting execution of the first application program,with the processor, intercepting a call by the first application program to access a resource, andupon intercepting the call,nwith the processor, executing the code of the extracted first policy to determine whether to allow or deny the access,upon determining that the access is allowed, enabling the access, andupon determining that the access is not allowed, preventing the accessso that the first application program of the first application program image is restricted from accessing computer resources in accordance with the access restrictions defined by the first policy embedded within the first application program image;embedding a second policy within a second application program, wherein the second policy defines access restrictions for the second application program, so that the second application program contains the embedded second policy;accessing a directed graph that represents system calls normally issued by the second application program, wherein the directed graph was previously generated by tracking previous instances of the second application program;tracking the execution of a second instance of the second application program; andupon detecting, based on the tracking and the directed graph, an anomalous condition in the execution of the second instance of the application program,nextracting the embedded second policy from within the second application program, andapplying the extracted second policy to the second instance of the application programso that the second instance of the second application program is restricted from accessing computer resources in accordance with the access restrictions defined by the second policy that is embedded within the second application program.

A method in a computing system having a memory and a processor for receiving an embedded policy, the method comprising:nreceiving a request to load a first application program of a first application program image;determining whether a first policy is embedded within the first application program image, such that the first application program image contains the first application program and the embedded first policy, wherein the first policy is coded in a programming language;responsive to determining that a first policy is embedded in the first application program image:nwith the processor, extracting the first policy from the first application program image,loading the first application program for execution by the processor,starting execution of the first application program,with the processor, intercepting a call by the first application program to access a resource, andupon intercepting the call,nwith the processor, executing the code of the extracted first policy to determine whether to allow or deny the access,upon determining that the access is allowed, enabling the access, andupon determining that the access is not allowed, preventing the accessso that the first application program of the first application program image is restricted from accessing computer resources in accordance with the access restrictions defined by the first policy embedded within the first application program image;embedding a second policy within a second application program, wherein the second policy defines access restrictions for the second application program, so that the second application program contains the embedded second policy;accessing a directed graph that represents system calls normally issued by the second application program, wherein the directed graph was previously generated by tracking previous instances of the second application program;tracking the execution of a second instance of the second application program;upon detecting, based on the tracking and the directed graph, an anomalous condition in the execution of the second instance of the application program,nextracting the embedded second policy from within the second application program, andapplying the extracted second policy to the second instance of the application programso that the second instance of the second application program is restricted from accessing computer resources in accordance with the access restrictions defined by the second policy that is embedded within the second application program; andresponsive to determining that a first policy is not embedded in the first application program image:nwhen a third policy applicable to the first application program is stored in a policy repository,nloading the first application for execution on the computer, andapplying the third policy applicable to the first application program that is stored in the policy repositoryso that the first application program is restricted from accessing computer resources in accordance with the access restrictions defined by the third policy applicable to the first application program that is stored in the policy repository, andwhen a third policy applicable to the first application program is not stored in the policy repository, not loading the first application program for execution on the computer.

A system having a memory and a processor for applying an embedded policy, the system comprising:na component that receives a request to load an image of a first application program, the image of the first application program containing the first application program;a component that determines whether a first policy is embedded within the first application program, the first policy defining access restrictions for the first application program, such that the first application program contains the embedded first policy, wherein the first policy is coded in a programming language;a component that, responsive to determining that a first policy is embedded within the first application program:nextracts the first policy from the first application program,loads the image of the first application program on the computer for execution by the processor,starts execution of the first application program,intercepts a call by the first application program to access a resource, andupon intercepting the call,nexecutes, with a processor, the code of the extracted first policy to determine whether to allow or deny the access,upon determining that the access is allowed, enables the access, andupon determining that the access is not allowed, prevents the accessso that the first application program is restricted from accessing computer resources in accordance with the access restrictions defined by the first policy embedded within the first application program;a component that embeds a second policy within a second application program, wherein the second policy defines access restrictions for the second application program, so that the second application program contains the embedded second policy;a component that accesses a directed graph that represents system calls normally issued by the second application program, wherein the directed graph was previously generated by tracking previous instances of the second application program;a component that tracks the execution of a second instance of the second application program; anda component that upon detecting, based on the tracking and the directed graph, an anomalous condition in the execution of the second instance of the application program,nextracts the embedded second policy from within the second application program, andapplies the extracted second policy to the second instance of the application programso that the second instance of the second application program is restricted from accessing computer resources in accordance with the access restrictions defined by the second policy that is embedded within the second application program.

A system having a memory and a processor for applying an embedded policy, the system comprising:na component that receives a request to load an image of a first application program, the image of the first application program containing the first application program;a component that determines whether a first policy is embedded within the first application program, the first policy defining access restrictions for the first application program, such that the first application program contains the embedded first policy, wherein the first policy is coded in a programming language;a component that, responsive to determining that a first policy is embedded within the first application program:nextracts the first policy from the first application program,loads the image of the first application program on the computer for execution by the processor;starts execution of the first application program,intercepts a call by the first application program to access a resource, and upon intercepting the call,nexecutes, with a processor, the code of the extracted first policy to determine whether to allow or deny the access,upon determining that the access is allowed, enables the access, andupon determining that the access is not allowed, prevents the accessso that the first application program is restricted from accessing computer resources in accordance with the access restrictions defined by the first policy embedded within the first application program;a component that embeds a second policy within a second application program, wherein the second policy defines access restrictions for the second application program, so that the second application program contains the embedded second policy;a component that accesses a directed graph that represents system calls normally issued by the second application program, wherein the directed graph was previously generated by tracking previous instances of the second application program;a component that tracks the execution of a second instance of the second application program;a component that upon detecting, based on the tracking and the directed graph, an anomalous condition in the execution of the second instance of the application program,nextracts the embedded second policy from within the second application program, andapplies the extracted second policy to the second instance of the application programso that the second instance of the second application program is restricted from accessing computer resources in accordance with the access restrictions defined by the second policy that is embedded within the second application program; anda component that, responsive to determining that a first policy is not embedded in the first application program:nwhen a third policy applicable to the first application program is stored in a policy repository,nloads the first application for execution on the computer, andapplies the third policy applicable to the first application program that is stored in the policy repositoryso that the first application program is restricted from accessing computer resources in accordance with the access restrictions defined by the third policy applicable to the first application program that is stored in the policy repository, andwhen a third policy applicable to the first application program is not stored in the policy repository, does not load the first application program for execution on the computer.