IP Library › Granted Patent US 10,120,786
Granted Patent B2
US 10,120,786 · App. 15/376,992 · Granted Nov 6, 2018

Programmatic access control validation

Inventor: Juergen Kremp (Walldorf, DE)
Assignee: SAP SE
G06F11/3688G06F11/3692G06F21/44
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,120,786
App. No.
15/376,992
Granted
Nov 6, 2018
Kind
B2
Abstract

Techniques of validating access controls within an application are disclosed. A validation test is performed by receiving test data comprising one or more privilege elements selected from a set of privilege elements representing a privilege scheme defined in an application. The test data and a data set are accessed. The application is executed using the data set according to the one or more privilege elements. A set of interaction indicators is generated representing interactions of the application with a portion of the data set. The set of interaction indicators is presented at a display device of a computing device.

Claims (73)

1. A system, comprising:

one or more processors; and

a processor-readable storage device in communication with the one or more processors, the processor-readable storage device comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving test data comprising one or more privilege elements, the test data received into a testing container defined within a set of processor-executable instructions comprising an application, the one or more privilege elements being selected from a set of privilege elements representing a privilege scheme;

accessing, by the one or more processors, the application, with the test data incorporated into the testing container, to initiate privilege testing for the application;

accessing, by the one or more processors, a data set to insert at least a portion of the data set into the application;

executing, by the one or more processors, the application, using the data set, according to the one or more privilege elements of the test data;

generating, by the one or more processors, a set of interaction indicators for the application representing interactions of the application with a portion of the data set using the one or more privilege elements; and

causing presentation of the set of interaction indicators at a display device of a computing device.

2. The system of claim 1 , wherein executing the application further comprises:

modeling one or more user interactions with the data set, the one or more user interactions performing at least one executable instruction of the application on the data set using the one or more privilege elements.

3. The system of claim 2 , wherein the operations further comprise:

in response to modeling the one or more user interactions, generating a set of results returned from executing the application on the data set using the one or more privilege elements, the set of results representing a match between the one or more privilege elements and the data set; and

determining a match between the set of results and an expected set of results.

4. The system of claim 3 , wherein the set of interaction indicators is generated in response to generating the set of results, the interaction indicators representing the one or more modeled user interactions and results of the set of results corresponding to each modeled user interaction.

5. The system of claim 3 , wherein the set of interaction indicators is generated in response to determining the match between the set of results and the expected set of results, the interaction indicators representing the one or more modeled user interactions, results of the set of results corresponding to each modeled user interaction, and matches determined for each of the modeled user interactions.

6. The system of claim 2 , wherein the operations further comprise:

in response to modeling the one or more user interactions, determining a mismatch between the one or more privilege elements and the data set; and

wherein the set of interaction indicators represents the one or more user interactions, the one or more privilege elements, and an error indication corresponding to the mismatch between the one or more privilege elements and the data set.

7. The system of claim 1 , wherein the data set is a first data set and the operations further comprise:

determining, by the one or more processors, a first operation mode from a set of operation modes, the set of operation modes indicating data sets accessible by the application during execution, the first operation mode indicating the first data set; and

in response to determining the first operation mode, executing the application, using the data set, according to the one or more privilege elements of the test data.

8. The system of claim 1 , wherein the data set is a first data set and the operations further comprise:

determining, by the one or more processors, a second operation mode from a set of operation modes, the set of operation modes indicating data sets accessible by the application during execution, the second operation mode indicating a second data set;

determining the second data set is distinct from the first data set;

generating an exception notification indicating one or more of the second operation mode and the second data set indicated by the second operation mode; and

causing presentation of the exception notification at the display device of the computing device.

9. A method, comprising:

receiving test data comprising one or more privilege elements, the test data received into a testing container defined within a set of processor-executable instructions comprising an application, the one or more privilege elements being selected from a set of privilege elements representing a privilege scheme;

accessing, by one or more processors, the application, with the test data incorporated into the testing container, to initiate privilege testing for the application;

accessing, by the one or more processors, a data set to insert at least a portion of the data set into the application;

executing, by the one or more processors, the application, using the data set, according to the one or more privilege elements of the test data;

generating, by the one or more processors, a set of interaction indicators for the application representing interactions of the application with a portion of the data set using the one or more privilege elements; and

causing presentation of the set of interaction indicators at a display device of a computing device.

10. The method of claim 9 , wherein executing the application further comprises:

modeling one or more user interactions with the data set, the one or more user interactions performing at least one executable instruction of the application on the data set using the one or more privilege elements.

11. The method of claim 10 , further comprising:

in response to modeling the one or more user interactions, generating a set of results returned from executing the application on the data set using the one or more privilege elements, the set of results representing a match between the one or more privilege elements and the data set; and

determining a match between the set of results and an expected set of results.

12. The method of claim 10 , further comprising:

in response to modeling the one or more user interactions, determining a mismatch between the one or more privilege elements and the data set; and

wherein the set of interaction indicators represents the one or more user interactions, the one or more privilege elements, and an error indication corresponding to the mismatch between the one or more privilege elements and the data set.

13. The method of claim 9 , wherein the data set is a first data set and the method further comprises:

determining, by the one or more processors, a first operation mode from a set of operation modes, the set of operation modes indicating data sets accessible by the application during execution, the first operation mode indicating the first data set; and

in response to determining the first operation mode, executing the application, using the data set, according to the one or more privilege elements of the test data.

14. The method of claim 9 , wherein the data set is a first data set and the method further comprises:

determining, by the one or more processors, a second operation mode from a set of operation modes, the set of operation modes indicating data sets accessible by the application during execution, the second operation mode indicating a second data set;

determining the second data set is distinct from the first data set;

generating an exception notification indicating one or more of the second operation mode and the second data set indicated by the second operation mode; and

causing presentation of the exception notification at the display device of the computing device.

15. A processor-readable storage device comprising instructions that, when executed by one or more processors of a machine, causes the machine to perform operations comprising:

receiving test data comprising one or more privilege elements, the test data received into a testing container defined within a set of processor-executable instructions comprising an application, the one or more privilege elements being selected from a set of privilege elements representing a privilege scheme;

accessing, by the one or more processors, the application, with the test data incorporated into the testing container, to initiate privilege testing for the application;

accessing, by the one or more processors, a data set to insert at least a portion of the data set into the application;

executing, by the one or more processors, the application, using the data set, according to the one or more privilege elements of the test data;

generating, by the one or more processors, a set of interaction indicators for the application representing interactions of the application with a portion of the data set using the one or more privilege elements; and

causing presentation of the set of interaction indicators at a display device of a computing device.

16. The processor-readable storage device of claim 15 , wherein executing the application further comprises:

modeling one or more user interactions with the data set, the one or more user interactions performing at least one executable instruction of the application on the data set using the one or more privilege elements.

17. The processor-readable storage device of claim 16 , wherein the operations further comprise:

in response to modeling the one or more user interactions, generating a set of results returned from executing the application on the data set using the one or more privilege elements, the set of results representing a match between the one or more privilege elements and the data set; and

determining a match between the set of results and an expected set of results.

18. The processor-readable storage device of claim 16 , wherein the operations further comprise:

in response to modeling the one or more user interactions, determining a mismatch between the one or more privilege elements and the data set; and

wherein the set of interaction indicators represents the one or more user interactions, the one or more privilege elements, and an error indication corresponding to the mismatch between the one or more privilege elements and the data set.

19. The processor-readable storage device of claim 15 , wherein the data set is a first data set and the operations further comprise:

determining, by the one or more processors, a first operation mode from a set of operation modes, the set of operation modes indicating data sets accessible by the application during execution, the first operation mode indicating the first data set; and

in response to determining the first operation mode, executing the application, using the data set, according to the one or more privilege elements of the test data.

20. The processor-readable storage device of claim 15 , wherein the data set is a first data set and the operations further comprise:

determining, by the one or more processors, a second operation mode from a set of operation modes, the set of operation modes indicating data sets accessible by the application during execution, the second operation mode indicating a second data set;

determining the second data set is distinct from the first data set;

generating an exception notification indicating one or more of the second operation mode and the second data set indicated by the second operation mode; and

causing presentation of the exception notification at the display device of the computing device.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 30, 2017
From: KREMP, JUERGEN
To: SAP SE
Reel/Frame 041123/0446 →
Continuity (1)
Related Publication 20180165183A1 · Jun 14, 2018