System and method for role based analysis and access control

1. A method for program access control, comprising:

generating a typestate hierarchy tree and assigning roles to nodes of the hierarchy tree wherein the nodes represent typestates;

for at least one typestate, providing typestate properties;

assigning a role to the at least one typestate in a program in accordance with the typestate properties by associating a security property with the typestate;

limiting access to operations of the at least one typestate in the program based on the role assigned to the at least one typestate and an access permission level;

performing a role consistency analysis to determine if assigning the role is consistent throughout the program; and

performing a role escape analysis to determine if any program objects escape a role assignment.

2. The method as recited in claim 1 , wherein limiting access to operations includes denying access to the at least one typestate if a role is junior to an assigned role.

3. The method as recited in claim 1 , wherein limiting access to operations includes permitting access to the at least one typestate if a role is senior to an assigned role.

4. The method as recited in claim 1 , wherein the method is included with and extends a method-based access control method.

5. A computer program product comprising a computer useable storage medium having a computer readable program for program access control, wherein the computer readable program when executed on a computer causes the computer to perform the steps of:

for at least one typestate, providing typestate properties;

assigning a role to the at least one typestate in a program in accordance with the typestate properties; and

limiting access to operations of the at least one typestate in the program based on the role assigned to the at least one typestate and an access permission level; and

performing a role escape analysis to determine if any program objects escape a role assignment.

6. The computer program product as recited in claim 5 , further comprising performing a role consistency analysis to determine if assigning the role is consistent throughout the program.

7. The computer program product as recited in claim 5 , wherein limiting access to operations includes at least one of denying access to the at least one typestate if a role is junior to an assigned role and permitting access to the at least one typestate if a role is senior to an assigned role.