Rule-based application access management
A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The engine uses a combination of embedded and configurable rules. It may be desirable to assign and manage rules per process, per resource (e.g. file, registry, etc.), and per user. Access rules may be altitude-specific access rules.
1. A method comprising:
receiving a request to access a resource with an altitude, the resource used in executing a first streaming application;
managing rule-based access to the resource based on the altitude of the resource comprising:
determining whether the resource is associated with a DMZ;
if it is determined that the resource is associated with the DMZ, the managing the rule-based access to the resource based on the altitude of the resource further comprising:
determining access control rules for accessing the resource based on the altitude of the resource;
providing access to the resource based on the access control rules for the resource;
executing the first streaming application using the resource;
setting a timer for the first streaming application;
determining if the timer has expired, and if it is determined that the timer has expired, the method further comprising:
pausing execution of the first streaming application;
executing a second streaming application to completion;
resuming execution of the first streaming application after the second streaming application is executed to completion;
resetting the timer.
2. The method of claim 1 , wherein the resource includes files and registry keys, the method further comprising setting up selective hooks for the files at the altitude of the resource.
3. The method of claim 1 , wherein the resource includes files and registry keys, the method further comprising setting up registry hooks for registry keys at the altitude of the resource.
4. The method of claim 1 , wherein the first streaming application is at least partially virtualized in a software container such that the resource is associated with the software container.
5. The method of claim 1 , wherein the resource includes a plurality of blocks of the first streaming application, the providing access to the resource based on the access control rules for the resource further comprising sending at least a first block of the plurality of blocks of the first streaming application to a streaming client in accordance with the access control rules for the resource.
6. The method of claim 5 , further comprising:
determining if the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client;
if it is determined that the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client, beginning execution of the first streaming application on the streaming client;
if it is determined that the first block of the plurality of blocks is insufficient to begin execution of the first streaming application on the streaming client, sending at least a second block of the plurality of blocks of the first streaming application to the streaming client in accordance with the access control rules for the resource.
7. The method of claim 6 , further comprising:
determining whether a trigger event occurs during execution of the first streaming application on the streaming client;
if it is determined that the trigger event occurs, the method further comprising:
pausing execution of the first streaming application on the streaming client;
executing an alternative application on the streaming client;
resuming execution of the first streaming application on the streaming client using blocks of the plurality of blocks of the first streaming application sent to the streaming client in accordance with the access control rules for the resource after the alternative application is executed on the streaming client.
8. The method of claim 1 , further comprising, if the altitude for the resource is zero:
writing files included as part of the resource on a streaming client;
changing a registry of the streaming client;
updating environment variables of the streaming client.
9. The method of claim 1 , wherein the request includes a resource ID of the resource and a process ID of a process that the resource is associated with, the method further comprising using the resource ID and the process ID to look up, in a requestor-specific access control table, the altitude of the resource and the access control rules for accessing the resource.
10. The method of claim 1 , wherein the access control rules for the resource include one of Accept, Pause, or Deny.
11. A system comprising:
at least one processor;
memory storing instructions configured to instruct the at least one processor to perform:
receiving a request to access a resource with an altitude, the resource used in executing a first streaming application;
managing rule-based access to the resource based on the altitude of the resource comprising:
determining whether the resource is associated with a DMZ;
if it is determined that the resource is associated with the DMZ, the managing the rule-based access to the resource based on the altitude of the resource further comprising:
determining access control rules for accessing the resource based on the altitude of the resource;
providing access to the resource based on the access control rules for the resource;
executing the first streaming application using the resource;
setting a timer for the first streaming application;
determining if the timer has expired, and if it is determined that the timer has expired, the instructions further configured to instruct the at least one processor to perform:
pausing execution of the first streaming application;
executing a second streaming application to completion;
resuming execution of the first streaming application after the second streaming application is executed to completion;
resetting the timer.
12. The system of claim 11 , wherein the resource includes files and registry keys, the instructions further configured to instruct the at least one processor to perform setting up selective hooks for the files at the altitude of the resource.
13. The system of claim 11 , wherein the resource includes files and registry keys, the instructions further configured to instruct the at least one processor to perform setting up registry hooks for registry keys at the altitude of the resource.
14. The system of claim 11 , wherein the first streaming application is at least partially virtualized in a software container such that the resource is associated with the software container.
15. The system of claim 11 , wherein the resource includes a plurality of blocks of the first streaming application, the instructions further configured to instruct the at least one processor to perform sending at least a first block of the plurality of blocks of the first streaming application to a streaming client in accordance with the access control rules for the resource.
16. The system of claim 15 , wherein the instructions are further configured to instruct the at least one processor to perform:
determining if the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client;
if it is determined that the first block of the plurality of blocks is sufficient to begin execution of the first streaming application on the streaming client, beginning execution of the first streaming application on the streaming client;
if it is determined that the first block of the plurality of blocks is insufficient to begin execution of the first streaming application on the streaming client, sending at least a second block of the plurality of blocks of the first streaming application to the streaming client in accordance with the access control rules for the resource.
17. The system of claim 16 , wherein the instructions are further configured to instruct the at least one processor to perform:
determining whether a trigger event occurs during execution of the first streaming application on the streaming client;
if it is determined that the trigger event occurs, the instructions further configured to instruct the at least one processor to perform:
pausing execution of the first streaming application on the streaming client;
executing an alternative application on the streaming client;
resuming execution of the first streaming application on the streaming client using blocks of the plurality of blocks of the first streaming application sent to the streaming client in accordance with the access control rules for the resource after the alternative application is executed on the streaming client.
18. The system of claim 11 , wherein if the altitude for the resource is zero, the instructions are further configured to instruct the at least one processor to perform:
writing files included as part of the resource on a streaming client;
changing a registry of the streaming client;
updating environment variables of the streaming client.
19. The system of claim 11 , wherein the request includes a resource ID of the resource and a process ID of a process that the resource is associated with, the instructions further configured to instruct the at least one processor to perform using the resource ID and the process ID to look up, in a requestor-specific access control table, the altitude of the resource and the access control rules for accessing the resource.
20. The system of claim 11 , wherein the access control rules for the resource include one of Accept, Pause, or Deny.