Techniques for managing security contexts

1. An article of manufacture comprising:

a non-transitory machine-readable storage medium containing instructions that when executed enable a system to execute multiple concurrent threads with partial ordering of operations, retrieve a security context for each thread, and form a merged security context using said retrieved security contexts, wherein in said partial ordering of operations at least one operation depends on results from at least two other operations, said merged security context formed using an intersection of sets of permissions for each of said threads with said at least two other operations, said intersection of sets of permissions yielding permissions common to each set so as to properly flow and merge security contexts when synchronizing said results of said at least two other operations.

2. The article of claim 1 , further comprising instructions that if executed enable the system to retrieve a process token for each thread, determine said process tokens represent a same process, determine a thread token does not exist for each thread, and form said merged security context using one of said security contexts.

3. The article of claim 1 , further comprising instructions that if executed enable the system to retrieve a process token for each thread, determine said process tokens represent a same process, determine a thread token exists for each thread, and form said merged security context using one of said security contexts if said thread tokens represent a same entity and enabled groups.

4. The article of claim 1 , further comprising instructions that if executed enable the system to retrieve a process token for each thread, determine said process tokens represent different processes, and form said merged security context using one of said security contexts if said process tokens represent a same entity and enabled groups.

5. The article of claim 1 , further comprising instructions that if executed enable the system to retrieve an input token having said set of permissions for each thread, determine said input tokens represent a same entity, and form a merged security token with said intersection of said permissions from said input tokens.

6. The article of claim 1 , further comprising instructions that if executed enable the system to retrieve an input principal for each thread, determine said input principals represent a same entity, and form said merged security context using said input principals.

7. The article of claim 1 , further comprising instructions that if executed enable the system to determine whether said security contexts contain an assert stack modifier, append stack permission information into a compressed stack if none of said security contexts contain an assert stack modifier, and append stack permission information positioned before said assert stack modifiers into a compressed stack if at least one of said security contexts contain an assert stack modifier.

8. The article of claim 1 , further comprising instructions that if executed enable the system to determine said security contexts contain an assert stack modifier, determine only one of said assert stack modifiers are less than full trust, and append stack permission information positioned before said assert stack modifiers followed by said less than full trust assert stack modifier and subsequent stack permission information into a compressed stack.

9. A method, comprising:

executing multiple concurrent threads by a processor with partial ordering of operations, wherein in said partial ordering of operations at least one operation depends on results from at least two other operations;

retrieving a security context for each thread; and

forming a merged security context using said retrieved security contexts, said merged security context formed using an intersection of sets of permissions for each of said threads with said at least two other operations, said intersection of sets of permissions yielding permissions common to each set so as to properly flow and merge security contexts when synchronizing said results of said at least two other operations.

10. The method of claim 9 , comprising:

retrieving a process token for each thread;

determining said process tokens represent a same process;

determining a thread token does not exist for each thread; and

forming said merged security context using one of said security contexts.

11. The method of claim 9 , comprising:

retrieving a process token for each thread;

determining said process tokens represent a same process;

determining a thread token exists for each thread; and

forming said merged security context using one of said security contexts if said thread tokens represent a same entity and enabled groups.

12. The method of claim 9 , comprising:

retrieving a process token for each thread;

determining said process tokens represent different processes; and

forming said merged security context using one of said security contexts if said process tokens represent a same entity and enabled groups.

13. The method of claim 9 , comprising:

retrieving an input token having said set of permissions for each thread;

determining said input tokens represent a same entity; and

forming a merged security token with said intersection of said permissions from said input tokens.

14. The method of claim 9 , comprising:

determining whether said security contexts contain an assert stack modifier;

appending stack permission information into a compressed stack if none of said security contexts contain an assert stack modifier; and

appending stack permission information positioned before said assert stack modifiers into a compressed stack if at least one of said security contexts contain an assert stack modifier.

15. An apparatus, comprising:

a processor; and

a security management module to form a merged security context for multiple concurrent threads, with one of said threads depending on more than one preceding operation from other threads, said merged security context formed using an intersection of sets of permissions for each of said threads with said more than one preceding operation, said intersection of sets of permissions yielding permissions common to each set so as to properly flow and merge security contexts when synchronizing said results of said more than one preceding operation.

16. The apparatus of claim 15 , each thread to have a security context formed using a security token, a managed security principal, or code-based permissions.