Sap Se

Sap Ag

Helmut Petritsch

Achim D Brucker

Jean-Yves Yannick Cras

Damien Guinan

Gilles Vergnory Mion

Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for determining optimal fix locations for security vulnerabilities in computer-readable code. Implementations include actions of identifying data flows from respective sources to respective sinks in computer-executable code based on information associated with the computer-executable code, determining vulnerability information of the sources, the sinks, and the data flows based on information of vulnerable sources and sinks stored in a database, and providing a graph representation of the code for display, the graph representation depicting the data flows from the respective sources to the respective sinks with the vulnerability information.

Computing optimal fix locations for security vulnerabilities in computer-readable code

Methods, systems, and computer-readable storage media for enforcing dynamic access control constraints of a plurality of access control policies, and actions include receiving a set of ordered policies, determining a set of active policies including one or more policies in the set of ordered policies, determining an access control decision based on at least a first policy in the set of active policies, the access control decision being based on determining whether one of a permit decision and a deny decision is inherited from a second policy in the set of ordered policies, and transmitting the access control decision for enforcement of the access control policy.

Ensuring compliance regulations in systems with dynamic access control

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for accessing an electronic access control model and data indicating results of access control requests that have been processed in accordance with an access control policy of the electronic access control model. Identifying a plurality of partitions in the electronic access control model, where each partition represents one or more access criteria of the electronic access control model that, taken together, define a computer executable access privilege. For each partition, determining a number of access control requests processed based on the partition based on the data, assigning an access type to the partition, determining whether modification of a policy underlying the partition would improve the electronic access control model based on the access type of the partition and the number of access control requests processed based on the partition, and, if so, selectively modifying the policy.

Electronic access controls

Business groups are created to secure business entities of a BI data model. In one aspect, a user to be secured is selected and a business group of the BI model is retrieved. Based on the business group, access to a business entity of the BI model is secured. The business group is associated with the business entity it secures. A value of the secured business entity is selected. A user is secured by assigning the user to the business group for the selected value. The value of the secured business entity is assigned to the user. In one aspect, requests from the user to access the secured business entity are filtered based on the assigned, to the user, value of the business entity.

Automated and delegated model-based row level security

Methods, systems, and computer-readable storage media for analyzing access control violations of a computer-implemented process. Implementations include actions of receiving a request including violation data indicating an access control violation that occurred during execution of the computer-implemented process, requesting a process model from a process model database, the process model including a computer-readable representation of the computer-implemented process, and a task corresponding to the access control violation, processing the task and the process model to provide correlation data including one or more of grouped violations, a set of granted accesses, and a set of violations, and transmitting the correlation data to a client-side computing device for display to a user.

Grouping access control violations for process-aware systems

Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for evaluating access control constraints and include actions of receiving an access control request, obtaining a set of attributes based on an abstract evaluation of a policy, the set of attributes including one or more attributes that could be required to evaluate the access control request, requesting respective values of the one or more attributes in a batch request, receiving the respective values, and providing an access control decision based on the respective values and the policy.

Abstract evaluation of access control policies for efficient evaluation of constraints

In an embodiment, a method is provided for prefetching attributes used in access control evaluation. In this method, an access control policy that comprises rules is retrieved. These rules further comprise parameters. At least one of the rules is categorized into a class from multiple classes based on at least one of the parameters. Here, the class is a grouping based on at least one of these parameters. An attribute associated with the at least one of these parameters is identified and this attribute is mapped to the class.

Prefetch of attributes in evaluating access control requests

Methods, systems, and computer-readable storage media for post-hoc analysis of access control decisions, where actions include receiving a request to analyze an access control request, for which an access control decision has been provided based on a policy, retrieving information associated with the access control request from a log, the information including a first security state version and a time, determining a time interval based on the time and an audit policy, retrieving information associated with at least a second security state version based on the time interval, and evaluating the access control request based on information of the first security state and information of the second security state to provide a post-hoc access control decision.

Automating post-hoc access control checks and compliance audits

The embodiments described herein provide various techniques for providing delegation assistance. Upon a request for delegation assistance, data from information sources are retrieved. Relationships are automatically identified relative to a requesting user based on the data from the information sources. The relationships are automatically ranked, and results of the ranking are provided to the requesting user. The user may then trigger delegation resolution based in part on the results of the ranking.

Growing community of inventors

Karlsruhe, Germany

Helmut Petritsch