Controlling access to one or more datasets of an operating system in use

A method and system for controlling access to data. Each dataset of L datasets is stored, via storage access controller (SAC) software external to an operating system, on at least one physical storage device. Each dataset is independently accessible in accordance with an access permission type assigned to each dataset independently selected for each dataset from N unique access permission types. N≥2 and L≥N. Control of access to each dataset stored on the at least one physical storage device is configured to enforce, via the SAC, access to each dataset in accordance with the access permission type assigned to each dataset. The operating system is unable to provide the control of access to each dataset to which access is enforced by the SAC in accordance with the access permission type assigned to each dataset and which is stored on the at least one physical storage device.

TECHNICAL FIELD

The present invention relates to controlling access to one or more datasets of an operating system in use.

BACKGROUND

Computer systems run operating systems in which users are commonly provided with differing levels of access permissions or privileges. The access permissions are arranged to enable the activities of a given user to be restricted where appropriate. For example, a normal user of a computer system may have relatively restricted access permissions, which limit the user's ability to use, modify or create selected sets of data. An administrator of the computer system may, by contrast, have access permissions that enable the administrator to use, modify or create any data within the computer system. Hierarchies of access permissions may be provided. Access permissions commonly relate to reading or writing datasets in the form of computer files. Access permissions may also be referred to as user rights or privileges. In many computer systems, full access permissions are reserved for trusted computer system administrator user accounts commonly referred to as a superuser, privileged, root or supervisor accounts.

Maintaining the security or integrity of a computer system is problematic when an administrator account is compromised or an unauthorized administrator account is created. Such accounts can be used to access, create or modify computer system data so as to compromise the security and integrity of the computer system. In particular, security related data or sensitive user data could be accessed or modified.

BRIEF SUMMARY

The present invention provides a method, and associated computer program product and computer system, for controlling access to data. The method comprises:

storing, by a processor of a computer system, via execution of a storage access controller (SAC), each dataset of L datasets on at least one physical storage device, wherein each dataset is independently accessible in accordance with an access permission type assigned to each dataset independently selected for each dataset from N unique access permission types, wherein N is at least 2 and L≥N, and wherein the SAC is software within the computer system and is external to an operating system of the computer system; and

after said storing, configuring in the SAC control of access to each dataset stored on the at least one physical storage device, said control of access configured to enforce, by the SAC, access to each dataset in accordance with the access permission type assigned to each dataset, wherein the operating system is unable to provide the control of access to each dataset to which access is enforced by the SAC in accordance with the access permission type assigned to each dataset and which is stored on the at least one physical storage device.

DETAILED DESCRIPTION

An embodiment of the invention provides apparatus for configuring an operating system on a programmable device for controlling access to one or more datasets of the operating system in use, the apparatus comprising a processor operable to: identify an operating system for running on a programmable device; identify a dataset for the operating system, the dataset having associated access permissions; select a storage device for storing the identified dataset; store the identified dataset on the selected storage device; and configure access control to the identified dataset when stored on the selected storage device, so that the access control is operable to enforce the associated access permissions for the dataset in response an access request for the dataset from the operating system in use, the access control being provided externally to the operating system.

Embodiments of the invention enable the control of access to selected datasets, such as OS critical resources, perhaps comprising security related data, to be performed externally to the OS. In the event of the OS being compromised at a user level capable of overriding access permissions within the OS, the access permissions for the critical resources of the OS are more likely to remain secure or to resist unauthorized alteration or overriding.

The access control may be functionally isolated from the operating system. The dataset may comprise data related to the security of the operating system. The dataset may comprise data normally reserved for unrestricted access solely by a higher privileged user group of the operating system. The access permissions may be enforced on requests for access to the dataset by only allowing access to the storage device if the request complies with the respective access permissions.

A plurality of datasets may be identified, each dataset having respective access permissions. The access permissions may comprise a plurality of types and storage devices are provided for storing the datasets having access permissions of corresponding types. The or each identified dataset may be at least partially predetermined for the operating system. The storage devices may be logical storage devices provided within the operating system. The storage devices may be physical storage devices.

Another embodiment provides apparatus for use externally to an operating system for managing requests from the operating system for access to a dataset having restricted access permissions, the apparatus being operable to: receive externally to an operating system a request for access by the operating system to a dataset of the operating system, the dataset having associated access permissions; comparing the request for access to the dataset to the access permissions for the dataset; and allow the request only if the request is compatible with the access permissions.

A further embodiment provides a method for configuring an operating system on a programmable device for controlling access to one or more datasets of the operating system in use, the method comprising the steps of: identifying an operating system for running on a programmable device; identifying a dataset for the operating system, the dataset having associated access permissions; selecting a storage device for storing the identified dataset; storing the identified dataset on the selected storage device; and configuring access control to the identified dataset when stored on the selected storage device, the access control being arranged to enforce the associated access permissions for the dataset in response an access request for the dataset from the operating system in use, the access control being provided externally to the operating system.

Another embodiment provides method for use externally to an operating system for managing requests from the operating system for access to a dataset having restricted access permissions, the method comprising the steps of: receiving externally to an operating system a request for access by the operating system to a dataset of the operating system, the dataset having associated access permissions; comparing the request for access to the dataset to the access permissions for the dataset; and allowing the request only if the request is compatible with the access permissions.

A further embodiment provides a computer program stored on a computer readable medium and loadable into the internal memory of a digital computer, comprising software code portions, when said program is run on a computer, for performing a method for configuring an operating system on a programmable device for controlling access to one or more datasets of the operating system in use, the method comprising the steps of: identifying an operating system for running on a programmable device; identifying a dataset for the operating system, the dataset having associated access permissions; selecting a storage device for storing the identified dataset; storing the identified dataset on the selected storage device; and configuring access control to the identified dataset when stored on the selected storage device, the access control being arranged to enforce the associated access permissions for the dataset in response an access request for the dataset from the operating system in use, the access control being provided externally to the operating system.

With reference toFIG. 1, a computer system101comprises a computer102connected to a first storage device103and a set of second storage devices104, in accordance with embodiments of the present invention. The computer102is loaded with an operating system (OS) loader program105arranged to run natively on the hardware of the computer102and provides the functionality for loading and launching executable code, such as an operating system (OS) or OS installer program on the computer102.

In the present embodiment the first storage device103comprises operating system (OS) datasets106and an OS installer program107. The OS installer program107is arranged to an operational OS on the computer102using the OS datasets106. In the present embodiment, the OS datasets106comprise four datasets108that hold data relevant to the security or integrity of the OS when installed and in use. The four datasets108each have respective associated access permissions (not shown) with respect to reading from or writing to the datasets108by the highest-level user of the OS.

The computer102is also loaded with a storage access controller (SAC)109arranged, in the present embodiment, to run natively on the hardware of the computer102. The SAC109is arranged to control access to data stored on the set of second storage devices104by the OS when installed and running on the computer102.

The first storage device103further comprises a file integrity table (FIT)110, which comprises an identification of each of the critical datasets108described above. With reference toFIG. 2, in the present embodiment, the FIT110comprises an entry201for each of the predetermined critical datasets108, in accordance with embodiments of the present invention. In the present embodiment, each entry201comprises the filename202and pathname203for identifying the relevant datasets108within the OS datasets106. Each entry201further identifies the relevant access permissions204for the relevant dataset108. In the present embodiment, the access permissions comprise read only (ro), write once (w1), read/write (rw) and write only (wo). In the present embodiment, each entry201also comprises a logical storage device identifier205associated with the given dataset108. In the present embodiment, one logical storage device is provided for each type of access permission. In other words each dataset108is assigned to a logical storage device in dependence on the access permissions associated with the dataset108. For example, the two entries in the FIT110may identify datasets with read only access permissions204and are both assigned the same logical storage device identifier205.

In the present embodiment, the contents of the FIT110are provided by the provider or author of the OS datasets106so as to identify at least a subset of the critical datasets108to the administrator installing the OS onto the computer102. In the present embodiment, the FIT110may be edited by the administrator so as to add, remove or modify entries201as required.

The FIT110is arranged for use by the OS installer107when loading the OS datasets106, to identify the critical datasets108. The OS installer107is then arranged to set up the computer102so that access to the critical datasets108is enforced externally to the operational OS by the SAC109and in accordance with the respective access permissions. With reference toFIG. 3, the OS installer107is arranged to install the OS datasets106on the computer102to provide an operational OS300, in accordance with embodiments of the present invention. Once loaded, the OS installer107creates a set of logical storage devices301corresponding to each identifier205in the FIT110. As noted above, each identifier205is associated with one type of access permissions. The OS installer107also selects a set of physical storage devices302, on the basis of the interface provided to the physical storage104via the SAC109, that corresponds to the set of logical storage devices301. Thus, in the present embodiment, each physical device302corresponds to a respective logical storage device301and to a respective type of access permissions.

Once the associated logical and physical storage devices301,302have been set up, the OS installer107is arranged to move the critical datasets108identified in the FIT108from the file system303of the OS300onto the physical storage devices302in dependence on the respective access permission types. The critical datasets108remain referenced in the file system303as indicated by the dashed outlines108′ inFIG. 3. The SAC109is then configured, separately to any configuration of the OS300, with the access permissions data304for each physical storage device302for enforcement on subsequent requests for access to any of the critical datasets108. The setup of the OS300is then completed before it is made available for use on the computer102.

During the subsequent normal operation of the OS300, any request for access to the critical datasets108is serviced by the file system303via the SAC109. The SAC109is arranged to enforce the relevant access permissions for the critical dataset108that is subject to any such request. If the access requested in a given request is not compatible with the relevant access permissions data304, the SAC109will refuse the request and report a permissions error to the file system303.

In embodiments of the invention, since the enforcement of the access permissions for the selected datasets108is provided externally to the installed OS300, even a compromised superuser or administrator account cannot provide unauthorized access to those selected datasets108. For example, a compromised superuser or administrator account cannot perform write access to normally read only data such as password data or encryption key data.

The processing of the OS installer program107will now be described with reference to the flow chart ofFIG. 4, in accordance with embodiments of the present invention. Processing is initiated at step401and proceeds to step402where the permission types204are identified, and the identification of the SAC109and associated physical storage devices104is prompted and once inputted processing moves to step403. At step403a physical storage device302is selected for each of the permissions types identified in the FIT110and set up accordingly and processing then moves to step404. At step404a set of logical drives (i.e., logical storage devices) are set up in the file system303of the OS300that, in the present embodiment, correspond with the logical drive data205in the FIT110, and the logical storage devices respectively correspond to the datasets108and the physical storage devices104, and processing moves to step405. At step405the datasets108located by the respective paths203in the FIT110are moved or copied from the file system303to the respective physical storage devices302selected in step403, and processing moves to step406. In step405, each dataset of L datasets108(FIG. 1) or108′ (FIG. 3) are stored on at least one physical storage device. For example in one embodiment, each dataset of the L datasets108is stored on a respective physical storage device104(FIG. 1) or302(FIG. 3). Each dataset of the L datasets is independently accessible in accordance with access permissions of N unique access permission types (e.g., ro, w1, r/w, wo inFIG. 2) respectively specific to each dataset. N is at least 2 and L≥N wherein N=4 in the embodiments ofFIGS. 1-3. The SAC is software within the computer system101and is external to the operating system of the computer system.

At step406the processing of the OS installer107ends and the OS300is booted, including the logical and physical storage devices301,302, and performs any required configuration tasks before processing moves to step407. At step407the access permissions304are set on the SAC109preventing any further unauthorized access to the critical datasets108and processing moves to step408. Step407configures control of access to each dataset of the L datasets stored on the at least one physical storage device (e.g., on respective physical storage devices). The control of access is configured to enforce, by the SAC, the access permission of the unique permission type specific to each dataset. In one embodiment, the operating system is unable to provide the control of access to each dataset to which access permission is enforced by the SAC and which is stored on the respective physical storage device. At step408the OS300is made

Once the OS installer has been set up with the secure externally controlled access permissions as described above, changes to the critical datasets108, non-compliant with the permissions enforced in normal operation by the SAC, may only be made subsequently in controlled maintenance procedures during which the datasets are isolated from any possible unauthorized interference. During such maintenance procedures the access permissions are changed so as to enable any required maintenance on the critical data sets108. Such maintenance procedures are performed externally to the OS300. In other words, no changes to the critical datasets108, non-compliant with the permissions enforced in normal operation by the SAC, and no changes to the access control functions of the SAC109are allowed at any time from within the OS300even during the controlled maintenance procedures.

The processing performed by the SAC109in response to a file access request from the OS300will now be described with reference toFIG. 5, in accordance with embodiments of the present invention. Processing is initiated at step501in response to the receipt of a request from the OS300to access one of the protected datasets108and processing then moves to step502. At step502the relevant physical device302is identified from the received request from the attributes of the referenced dataset108′ in the file system303and processing moves to step503. At step503the permissions304for the identified device302are retrieved by the SAC109and processing moves to step504. At step504the request is compared by the SAC109to the permissions304for the relevant device and processing moves to step505. If at step505the request is compatible with the relevant permissions304then processing moves to step506. At step506the request is performed and processing then moves to step507and ends. If at step505the request is not compatible with the relevant permission303then processing moves to step508. At step508the request is rejected and returned to the OS300with a permissions error. Processing then moves to step507and ends.

In another embodiment, the critical datasets are not stored by access permissions type. Instead, access permissions are applied at the file level. In this embodiment, the critical datasets may all be stored on one logical or physical device.

In a further embodiment, the FIT is provided for access by the OS during I/O requests for the critical datasets. The FIT will remain read only during the normal operation of the operating system. The read only property of the FIT may be achieved by storing the FIT on the read only storage device302. The OS may use the FIT to perform a check of the critical dataset access permissions and refuse the request if it is not compatible. In this manner, only compatible requests are sent to SAC. If this pre-checking process is subverted the SAC check provides a backup. The FIT may also be used by the OS where a relevant dataset needs to be extended, to identify correct storage device for the new data. The FIT may also be used when a given critical dataset needs to be created so as to identify the correct storage device for the new critical dataset. Such runtime use of the FIT enables critical datasets created after installation to be provided with external access permissions control as described above.

In another embodiment the FIT comprises simple list of file names or file paths and associated access permissions. In a further embodiment, each relevant dataset in the FIT is identified by any other suitable specification such as a sub-tree in the registry. The FIT may omit any identification of logical storage devices. Instead, the OS installer may be arranged to apply a predetermined set of rules to set up a suitable set of logical and corresponding physical devices. The FIT may be modified by an authorized administrator only and only during the controlled maintenance period described above. As will be understood by those skilled in the art, the FIT may use other criteria for identifying the relevant critical datasets such as wild card matching or dataset ownership for example.

In another embodiment, an existing hypervisor or storage controller provides the access permissions control function. As will be understood by those skilled in the art, the access permissions control functions of the SAC may be provided in software, firmware or hardware or a combination thereof. The access permissions control functions may be provided at any point external to the relevant OS between the OS and the relevant storage devices. As will be understood by those skilled in the art, the SAC or the OS installer may be provided on different computers or provided as services over a network. As will be understood by those skilled in the art, the SAC may be provided externally to the computer on which the relevant OS operates.

Embodiments of the invention are likely to be of most benefit in the context of full-fledged multi-user operating systems (OS). The term OS is intended to be construed broadly. Embodiments of the invention may be applied to other computing environments, such as computerized machines running custom software, operating with external storage, where critical internal datasets might need to be protected from alteration from within the software during normal operation.

Embodiments of the invention can be used not only to help protect against intended attacks, for example, by malicious users, but also to help safeguard against a possible OS malfunction so as to preserve a safe state of the OS.

As will be understood by those skilled in the art, embodiments of the invention may be applied to any operating system where access permissions to some datasets may want to be secured. Embodiments of the invention may be applied to virtual machines, logical partitions (LPARs) or operating system running indirectly or directly on physical computing hardware. In the case of virtual machines, the access permissions control functions may be provided by the hypervisor running the virtual machine or by another hypervisor or I/O controller down the I/O path.

Embodiments of the invention enable the control of access to selected datasets such as OS critical resources, perhaps comprising security related data, to be functionally isolated from the OS. Thus in the event of the OS being compromised and at a user level capable of overriding access permissions within the OS, the access permissions for the critical resources of the OS are more like to remain secure or resist unauthorized alteration or overriding.

As will be understood by those skilled in the art, the OS datasets provided for installation on a given computer or other suitable hardware may be installed in a number of different ways in dependence on the given hardware or user selected options. Thus the arrangement of the OS datasets on the distribution media may vary significantly from their subsequent arrangement in a given instance of the OS when installed.

As will be understood by those skilled in the art, a program loader that may comprise part of the microcode of the relevant hardware and may also perform the tasks of an OS installer in some implementations.

As will be understood by those skilled in the art that the apparatus that embodies a part or all of the present invention may be a general purpose device comprising a processor, memory, input/output interfaces and having software arranged to provide a part or all of an embodiment of the invention. The device could be a single device or a group of devices and the software could be a single program or a set of programs. Furthermore, any or all of the software used to implement the invention can be communicated via any suitable transmission or storage means so that the software can be loaded onto one or more devices.

FIG. 6illustrates a computer system used for implementing methods of the present invention, in accordance with the embodiments of the present invention. The computer system90comprises a processor91, an input device92coupled to the processor91, an output device93coupled to the processor91, and memory devices94and95each coupled to the processor91. The input device92may be, inter alia, a keyboard, a mouse, a keypad, a touch screen, a scanner, a voice recognition device, a sensor, a network interface card (NIC), a Voice/video over Internet Protocol (VOIP) adapter, a wireless adapter, a telephone adapter, a dedicated circuit adapter, etc. The output device93may be, inter alia, a printer, a plotter, a computer screen, a magnetic tape, a removable hard disk, a floppy disk, a NIC, a VOIP adapter, a wireless adapter, a telephone adapter, a dedicated circuit adapter, an audio and/or visual signal generator, a light emitting diode (LED), etc. The memory devices94and95may be, inter alia, a hard disk, a floppy disk, a magnetic tape, an optical storage such as a compact disc (CD) or a digital video disc (DVD), a dynamic random access memory (DRAM), a read-only memory (ROM), etc. The memory device95includes computer program code97which is a computer program that comprises computer-executable instructions. The program code97includes software or program instructions that may implement methods of the present invention. The processor91executes the program code97. The memory device94includes input data96. The input data96includes input required by the program code97. The output device93displays output from the program code97. Either or both memory devices94and95(or one or more additional memory devices not shown inFIG. 6) may be used as a computer readable storage medium or device (or program storage device) having a computer readable program embodied therein and/or having other data stored therein, wherein the computer readable program comprises the program code97. Generally, a computer program product (or, alternatively, an article of manufacture) of the computer system90may comprise said computer readable storage medium (or said program storage device). A computer readable storage device of the present invention, when storing the program code97for execution by one or more processors, is not a transmission medium such as a copper transmission cable, an optical transmission fiber, or a wireless transmission medium.

WhileFIG. 6shows the computer system90as a particular configuration of hardware and software, any configuration of hardware and software, as would be known to a person of ordinary skill in the art, may be utilized for the purposes stated supra in conjunction with the particular computer system90ofFIG. 6. For example, the memory devices94and95may be portions of a single memory device rather than separate memory devices. As another example, the processor91may represent one or more processors, and each memory device of memory devices94and95may represent one or more memory devices and/or one or more computer readable storage devices.