US6766314B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method for attachment and recognition of external authorization policy on file system resources
Assignee: International Business Machines Corp
•
Filing: 2001-04-05
•
Granted: 2004-07-20
•
Expires: 2021-04-05
Abstract
Abstract The present invention is an algorithm that manages the ability of a user or software program to access certain protected file resources. This invention describes a method for file system security through techniques that control access to the file system resources using externally stored attributes. This invention accomplishes the described objectives in file system security by creating an external database containing auxiliary attributes for objects in the file system. During a file access attempt, an identifier of this file will be matched against a set of protected files in a security database. If that file is not in the database, there is not protection on the file and requester will be allowed to access the file. If a match does show that the file is protected there will be a determination as to whether the requester will be allowed access to the file. The basis for this access determination will be a set security rules defined in the external security attribute. This invention incorporates techniques and algorithms for attribute attachment, storage and organization of the associations to these attributes, and subsequent recognition of attached attributes. In this approach, the attributes would define authorization policy for controlling access to objects in the file system.
Inventors
- 👤 Rodney Carlton Burnett
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 16:31
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F16/00; G06F16/10; Y; Y10; Y10S; Y10S707/00; Y10S707/953; Y10S707/955; Y10S707/99931; Y10S707/99932; Y10S707/99933; Y10S707/99939; Y10S707/99941; Y10S707/99943
Claims Analysis
Total Claims: 21
Claim 1
Independent Claim
186 words
A method for controlling access to file system resources in a computer system through the use of externally stored attributes comprising the steps of: generating a file identifier corresponding to each file system object that will have protected and controlled access by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object; storing a record of each said file identifier and associated protected object name for each said file system object in a database, such that there is a file identifier to protected object name map for each file system object; searching the database, at the initiation of a file system object access attempt to determine if the attempted access is to a protected file system object; and generating an authorization decision for access to said file system object in response to said file system object access attempt, when the determination is that the attempted access is to a protected file system object.
Claim 2
Independent Claim
186 words
A method for controlling access to file system resources in a computer system through the use of externally stored attributes comprising the steps of: generating a file identifier corresponding to each file system object that will have protected and controlled access by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object; storing a record of each said file identifier and associated protected object name for each said file system object in a database, such that there is a file identifier to protected object name map for each file system object; searching the database, at the initiation of a file system object access attempt to determine if the attempted access is to a protected file system object; and generating an authorization decision for access to said file system object in response to said file system object access attempt, when the determination is that the attempted access is to a protected file system object.
Claim 3
Dependent Claim
20 words
The method as described in claim 1 wherein the search of the database is performed using the generated file identifier.
Claim 4
Dependent Claim
26 words
The method as described in claim 2 wherein said search is to find a match between a file identifier and protected object name in the database.
Claim 5
Dependent Claim
32 words
The method as described in claim 2 wherein access to a file is granted if a search of the database does not produce a protected object name match for the file identifier.
Claim 6
Dependent Claim
28 words
The method as described in claim 3 wherein an authorization decision is to deny access to a protected file system object found during a search of the database.
Claim 7
Dependent Claim
28 words
The method as described in claim 1 wherein said storing record step comprises mapping the file identifier to a protected object name for a protected file system object.
Claim 8
Dependent Claim
36 words
The method as described in claim 3 wherein said decision authorization step comprises calling an access decision component to obtain an access decision for a found match between a file identifier and a protected object name.
Claim 9
Dependent Claim
38 words
The method as described in claim 7 wherein said access decision is based on specific protections for the file system object for which there is a request for access, said specific protections being stored in a master database.
Claim 10
Independent Claim
208 words
A method for enforcing security policies over file system objects in a computer system using an external authorization program and comprising the steps of: associating a security policy to a protected file system object, where the said security policy capable of granting access to said protected file system object, by generating a file identifier corresponding to each protected file system object by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object and storing a record of each said file identifier and associated protected object name for each said file system object in a database, such that there is a file identifier to protected object name map for each file system object; upon an access request to a file system object, checking all protected file system objects using a file identifier to determine if the access request is to a protected object file; and generating an authorization decision for access to said file system object in response to said file system object access attempt, when the attempted access is to a protected file system object.
Claim 11
Independent Claim
208 words
A method for enforcing security policies over file system objects in a computer system using an external authorization program and comprising the steps of: associating a security policy to a protected file system object, where the said security policy capable of granting access to said protected file system object, by generating a file identifier corresponding to each protected file system object by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object and storing a record of each said file identifier and associated protected object name for each said file system object in a database, such that there is a file identifier to protected object name map for each file system object; upon an access request to a file system object, checking all protected file system objects using a file identifier to determine if the access request is to a protected object file; and generating an authorization decision for access to said file system object in response to said file system object access attempt, when the attempted access is to a protected file system object.
Claim 12
Dependent Claim
44 words
The method as described in claim 9 wherein the step of checking all protected file system objects comprise searching the database, at the initiation of a file system object access attempt to determine if the attempted access is to a protected file system object.
Claim 13
Dependent Claim
26 words
The method as described in claim 10 wherein said search is to find a match between a file identifier and protected object name in the database.
Claim 14
Dependent Claim
35 words
The method as described in claim 9 wherein said access authorization decision step comprises determining whether to grant access to the requested file system object using security policy rules contained in the external authorization program.
Claim 15
Dependent Claim
30 words
The method of claim 9 wherein access to a requested file system object is granted if a search of the database does not produce a protected object file system object.
Claim 16
Dependent Claim
28 words
The method as described in claim 11 wherein an authorization decision is to deny access to a protected file system object found during a search of the database.
Claim 17
Dependent Claim
184 words
A computer program product in a computer readable medium for controlling access to file system resources in a computer system through the use of externally stored attributes comprising the steps of: instructions for generating a file identifier corresponding to each file system object that will have protected and controlled access by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object; instructions for storing a record of each said file identifier and associated full path name for each said file system object in a database; instructions for searching the database, at the initiation of a file system object access attempt to determine if the attempted access is to a protected file system object; and instructions for generating an authorization decision for access to said file system object in response to said file system object access attempt, when the determination is that the attempted access is to a protected file system object.
Claim 18
Dependent Claim
184 words
A computer program product in a computer readable medium for controlling access to file system resources in a computer system through the use of externally stored attributes comprising the steps of: instructions for generating a file identifier corresponding to each file system object that will have protected and controlled access by obtaining an attribute of the physical location of a file system object, obtaining the name of the file system object, and coupling the physical location attribute to the file system object name to produce the file identifier for a particular file system object; instructions for storing a record of each said file identifier and associated full path name for each said file system object in a database; instructions for searching the database, at the initiation of a file system object access attempt to determine if the attempted access is to a protected file system object; and instructions for generating an authorization decision for access to said file system object in response to said file system object access attempt, when the determination is that the attempted access is to a protected file system object.
Claim 19
Dependent Claim
24 words
The computer program product as described in claim 15 wherein the instructions for searching the database comprise instructions for using the generated file identifier.
Claim 20
Dependent Claim
34 words
The computer program product as described in claim 15 wherein said instructions for storing a record comprising instructions for mapping the file identifier to a protected object name for a protected file system object.
Claim 21
Dependent Claim
43 words
The computer program product as described in claim 15 wherein said instructions for generating an authorization decision comprise instructions for calling an access decision component to obtain an access decision for a found match between a file identifier and a protected object name.
References Cited (Backward Citations)
US6336115B1
Cited
US6535867B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-07-20 | 2008-01-19 | 2008-07-20 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-07-20 | 2012-01-19 | 2012-07-20 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-07-20 | 2016-01-19 | 2016-07-20 | $7700.00 | Window Closed / Lapsed |