US 12,474,902 B2
Annotation driven just in time and state-based RBAC policy control
Brian Gallagher, Waterford (IE); and Cathal O'Connor, Waterford (IE)
Assigned to Red Hat, Inc., Raleigh, NC (US)
Filed by Red Hat, Inc., Raleigh, NC (US)
Filed on Sep. 22, 2022, as Appl. No. 17/950,577.
Prior Publication US 2024/0103818 A1, Mar. 28, 2024
Int. Cl. G06F 9/44 (2018.01); G06F 8/41 (2018.01); G06F 8/60 (2018.01); G06F 21/44 (2013.01)
CPC G06F 8/41 (2013.01) [G06F 8/60 (2013.01); G06F 21/44 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method comprising:
inserting an annotation into a code base comprising a function, wherein the annotation comprises a resource identifier that identifies a resource corresponding to the function;
compiling, by a processing device, the code base into compiled code, wherein, during the compiling, the method further comprises:
inserting into the code base, based on the annotation, a first request prior to the function that requests permission to access the resource corresponding to the resource identifier; and
inserting into the code base, based on the annotation, a second request subsequent to the function to turn off permission to access the resource corresponding to the resource identifier;
deploying the compiled code as a container to a target environment;
executing the compiled code by the container, wherein, during the executing of the compiled code, the method further comprises:
sending, from the container, the first request to a trusted controller to request permission for the container to access the resource;
responsive to receiving the first request at the trusted controller, formatting, by the trusted controller, a first policy request based on a plug-in corresponding to the resource;
sending the first policy request from the trusted controller to the resource to turn on permission for the container to access the resource;
responsive to sending the first request, executing, by the container, the function at the resource;
responsive to executing the function at the resource, sending, from the container, the second request to the trusted controller to turn off permission for the container to access the resource;
responsive to receiving the second request at the trusted controller, formatting, by the trusted controller, a second policy request based on the plug-in corresponding to the resource; and
sending, by the trusted controller to the resource, the second policy request to turn off permission for the container to access the resource.