Amazon Technologies, Inc.

Didier Germain Durand

Ilia Gilderman

Neha Rungta

Brad Eugene Marshall

Amit Goel

Chungha Sung

Mary Southern

Zhe Li

Computer-implemented techniques for verifying translated access controls for application modernization include an application modernization service of a provider network obtaining a source access control. The service translates the source access control to a target access control. The service compiles the source access control and the target access control into respective automated reasoning solver encodings. The service uses the automated reasoning solver encoding to query an automated reasoning solver such as a Satisfiability Modulo Theories (SMT) solver to determine whether the source access control is less or more permissive than the target access control representing a security issue or an availability issue with the target access control, respectively.

Verifying translated access controls for application modernization

Remapping mainframe functional components from a mainframe computing environment onto a network of distinct but communicating accounts of a provider network. The mainframe computer (or network of such computers) is analyzed hierarchically through one or more of physical separation between logical partitions (LPARs), LPARs within the mainframe computer(s), separation of batch and transactional workloads, separation of batch and transactional accounts, or security of the mainframe architecture. Mainframe application artifacts obtained through the analyzing are used to generate a graph model representing relationships among the mainframe application artifacts. The graph model includes nodes representing the mainframe application artifacts and edges connecting pairs of the mainframe application artifacts, where the edges represent use relationships between the pairs of mainframe application artifacts. The nodes are then clustered, where the clusters represent sets of mainframe artifacts having high density of use relationships, and the clusters correspond to the distinct accounts in the provider network.

Decomposition of monoliths into multi-account provider network structures

Systems, devices, and methods are provided for implementing a cloud-based mainframe service. A cloud-based mainframe service may utilize various resources, including an operating system that is provisioned with an authorization interceptor that uses a first set of security policies stored in a policy database to determine whether to grant or deny access to resources managed by the operating system. The authorization interceptor may use the security policies of the policy database to determine whether to grant access to operating system resources. A database management system may use a second set of security policies stored in the policy database to determine whether to grant or deny access to resources managed by the database system. Security policies for a mainframe service may be centrally stored in a policy database managed by a policy management service.

Cloud-based mainframe service

Systems, devices, and methods are provided for authorizing access to operating system resources using security policies managed by a service external to the operating system. An operating system may be provisioned with a kernel-mode component that intercepts system calls from applications, determines a request context for the system call, and sends a request to an external policy management service. The policy management service may be used to perform a policy evaluation to determine whether to grant access to operating system resources. In some cases, policies are cached by the operating system. In various examples, the operating system and policy management service are both hosted on resources managed by a computing resource service provider on behalf of a customer to run mainframe workloads.

Authorizing access to operating system resources using security policies managed by service external to the operating system

Systems, devices, and methods are provided for determining whether security assurances are satisfied by security policies that are used to control access to resources used by a mainframe application. A system may use a database to store a plurality of security policies that may comprise security polices of various resources used by mainframes, including resources managed by operating systems and database systems. A reference policy that corresponds to the security assurance being sought may be determined. The security policies may be evaluated using a satisfiability modulo theories (SMT) solver to determine whether the security policies are equally or less permissive than the reference policy.

Cloud-based security service for improved compliance of mainframe workloads

Systems, devices, and methods are provided for authorizing access to database management system (DBMS) resources using security policies managed by a service external to the DBMS. A DBMS may be provisioned to obtain a database request, identify one or more securable resources that from applications, determine a request context for the system call, and sends a request to an external policy management service. The policy management service may be used to perform a policy evaluation to determine whether to grant access to the securable resources. In some cases, policies are cached by the DBMS. In various examples, the DBMS and policy management service are both hosted on resources managed by a computing resource service provider on behalf of a customer to run mainframe workloads.

Growing community of inventors

Jougne, France

Didier Germain Durand