Managing access to a resource

Methods of managing access to at least one resource in a computer system. The methods may comprise the step of associating access rights with an application resource. The access rights may define a level of access to the resource granted to the application. The methods may also comprise the step of digitally signing the access rights and the application resource. In various embodiments, the associating may comprise incorporating the access rights into a stream of a file including the application resource. Also, in various embodiments, the associating may comprise incorporating the access rights into an extended attribute of a file including the application resource.

BACKGROUND

Managing access to resources is becoming an increasingly important concern in modern computers and computer systems. Traditionally, access management is handled at the operating system level on a user-by-user or group basis. Each user of the computer or computer system is given a security level that determines which resources the user may access and manipulate. The user's level of access to resources is the same, regardless of which application the user runs. For example, the user may be granted either no access, read-only access, or read/write access as determined by the configuration settings for each specific resource. Although user-based security is widely used, it provides only a limited number of access options. For example, even read-only access rights typically allow a user to not only read a file, but also to print and/or copy the file. This may be insufficient in many applications including, for example, those where secrecy is important.

SUMMARY

In one general aspect, embodiments of the invention are directed to methods of managing access to at least one resource in a computer system. The methods may comprise the step of associating access rights with an application resource. The access rights may define a level of access to the resource granted to the application. The methods may also comprise the step of digitally signing the access rights and the application resource. In various embodiments, the associating may comprise incorporating the access rights into a stream or sub-file of a file including the application resource. Also, in various embodiments, the associating may comprise incorporating the access rights into an extended attribute of a file including the application resource. In various embodiments, access rights may be associated with a user as well as an application resource.

In another general aspect, embodiments of the invention are directed to methods of managing access to a resource in a computer system. The methods may comprise the steps of receiving a request from the application to access the at least one resource and determining whether access rights associated with the application includes a reference to a key for decrypting the resource. The methods may also include the step of providing the application with the key if the access rights include the reference.

In yet another general aspect, embodiments of the invention are directed to methods of managing access to a resource in a computer system. The methods may comprise receiving a request from an application to access the at least one resource. The methods may also comprise the step of reading the access rights associated with the application. The access rights may be stored in a stream of a file, and a component of the application may be stored in a second stream of the file. The methods may also comprise the step of providing the application with access to the at least one resource if the access rights indicate that the application is entitled to access the resource.

DETAILED DESCRIPTION OF THE INVENTION

Various embodiments of the present invention may be employed to manage access to computer resources (e.g., data, executable images, encryption keys, etc.) on an application-by-application basis. For example, applications running on a computer or computer system may be given associated access rights. The access rights may define the level of access to the resources that is available to the applications (and therefore to a user of the applications). In various embodiments, the access rights and a component of the application may be digitally signed for verification purposes.

FIG. 1shows a computer system100that may be used to implement various embodiments of the present invention. The computer system100may include various computing devices and/or constructs. For example, the computer system100may include one or more user devices102, one or more servers104, one or more databases106, etc. In various embodiments, one or more of the devices102,104,106may have an associated peripheral storage device108(e.g., an external hard drive, a USB dongle, a USB pen drive, a flash memory card, etc.). The peripheral storage108may provide additional resource storage, as described in more detail below. A network110may provide connectivity between the devices102,104,106according to any suitable wired or wireless method.

The various devices102,104,106,108of the computer system100may generally store resources and/or execute applications that allow users (not shown) of the system100to use and manipulate the resources. User devices102may include any kind of device that allows a user to access resources. Example user devices102include a desktop computer, a laptop computer, a handheld computer, a personal digital assistant (PDA), etc. The user devices102may be used to monitor and/or manipulate applications running on other components of the system100(e.g., the server104), or access resources stored on other components of the system100(e.g., database106). In various embodiments, however, user devices102may also store resources and/or execute applications.

FIG. 2shows a block diagram, according to various embodiments, of a system architecture200that may be implemented on the computer system100to associate one or more access rights or privileges with an application. The system architecture200may include one or more examples of an application202, an operating system204, a file system206and data storage208. Data storage208may include data files210,212,214, as discussed below. It will be appreciated that the architecture200may be implemented on one component of the computer system100(e.g., a user device102, a server104, a database106, etc.), or may be implemented across multiple components of the system.

The application202of the system architecture200may include a group of one or more software components executed by a processor or processors of one or more of the devices102,104,106. The application202may perform at least one function such as, for example, providing e-mail service, providing word processing, providing financial management services, etc. The application202may perform functions by manipulating data. To acquire data for manipulation and output results, the application202may create “read requests” and “write requests” for particular data units. These requests may be handled by other components of the architecture202as described in more detail below. As described below, the application202may have associated access rights that define which resources (e.g., data and other applications) that the application202is authorized to access. It will be appreciated that the architecture200may, in various aspects, include additional applications (not shown).

Data utilized by the application202as well as other applications (e.g., resources) may be stored at data storage208. Data storage208may include any kind of storage drive capable of storing data in an electronic or other suitable computer-readable format. In certain non-limiting embodiments, data storage208may include a single fixed disk drive, an array of disk drives, an array of disk drives combined to provide the appearance of a larger, single disk drive, a solid state drive, etc. Data storage208may be physically located at any device102,104,106,108of the computer system100. For example, data storage208may include various drives accessible over the network110. In various embodiments, all or a part of data storage208may be located at database106and may be accessed through the network110by the other components, such as user devices102, servers104, etc.

File system206may be an organization system for logically and physically organizing data present at the data storage208. In various non-limiting embodiments, the file system206may be a native file system included with the operating system204, described below, or a third party file system. The file system206may organize data units into data files, and manage the location of data files in data storage208. Each data file may include one or more data units. The file system206may be, for example, specific to a computer device102,104,106or to particular drives making up data storage208. In various embodiments, a single file system206may manage associations between data files and physical locations for data storage208located across the computer system100. The file system206may be any suitable file system including, as non-limiting examples, File Allocation Table 16 (FAT16), File Allocation Table 32 (FAT32), NTFS, High Performance File System (HPFS), UNIX file system (UFS), XFS, journaled file system (JFS), Universal Data Format File System (UDFS), CD-ROM File System (CDFS), Enhanced File System (EFS), SGI XFS, Clustered XFS (CXFS), HFS, VxFS, Raw File System (RawFS), Local File System (DCE/LFS), etc.

Interaction between the application202and the data storage208may be facilitated by the operating system204. The operating system204may be any suitable operating system. For example, in various non-limiting embodiments, the operating system204may be any version of MICROSOFT WINDOWS, any UNIX operating system, any Linux operating system, OS/2, any version of Mac OS, etc. Each computer device102,104,106,108may run its own instance of an operating system204. The devices102,104,106of the computer system100may in various embodiments run the same type of operating system204or different types. The operating system204may provide services to the application202that facilitate the application's202functions. For example, the operating system204may allow the application202to access and manipulate data units stored at data storage208. The operating system204may service read or write requests from the application202, for example, by accessing local or remote data storage208through the file system208.

FIG. 3shows a process flow300, according to various embodiments, for associating access rights with an application202. The access rights may be determined at step302. In various embodiments, the access rights may define, for example, a resource or resources (e.g., stored at data storage208) that the application202is authorized to access and/or edit, and the degree to which the application may access and/or edit the resources. For example, it may be desirable to allow the application202to access certain data (e.g., a DLL, a document, etc.), and/or cause the execution of certain executable images (e.g., subroutines associated with the application202, complimentary applications, etc.). In various embodiments, resources may be stored at data storage208as one or more resource files212.

It will be appreciated that the access rights may be expressed in various suitable ways. The particular expression may depend on the set-up of the computer system100and architecture200. For example, in various embodiments, the access rights may include a generalized access setting for the application202. The generalized access setting may define a level of access to the resources of the system100and/or the architecture200. In various embodiments, the generalized access level may be predefined by the operating system204, or other component of the system100or architecture200. Existing operating systems often define generalized access settings, (e.g., administrator, power user, user, etc.), with each access setting corresponding to a predetermined level of access to resources. For example, an application or user having administrative access may have read and write access to all resources, while applications or users having other generalized access levels may have less access.

Also, in various embodiments, the access rights may allow the application202to use encryption keys214necessary to access desired resources. The resources may be encrypted according to any suitable encryption method (e.g., block substitution methods, dual-key encryption algorithms, etc.). In various embodiments, different resources or sets of resources may be encrypted by different encryptions keys or sets thereof. The access rights may allow the application202to access the encryption key or keys that are necessary to decrypt the resources that the application202is entitled to access. In various embodiments, the encryption keys may be stored at data storage208, for example, at an encryption key database214, or at a peripheral device108, such as a USB dongle. The access rights may include security log-in and/or authentication data (e.g., a digital certificate), that allows the application to access the encryption key server and/or database214to retrieve the appropriate encryption key or keys. In various embodiments, the access rights associated with the application202may include the appropriate encryption key or keys. For example, the access rights and/or the appropriate encryption key or keys may be stored as a stream or attribute of the application resource210, as discussed in more detail below.

At step304, the access rights determined at step302may be encoded, or reduced to a data unit that can be associated with the application202. It will be appreciated that the data unit may be expressed in any suitable format including, for example, a binary format, a Security Descriptor Definition Language (SDDL) script, an Extensible Markup Language (XML) script, etc.

The access rights may be associated with the application202at step306. In various embodiments, the access rights may be associated with the application202by associating the data unit representing the access rights with an application resource210. The application resource210may be, for example, an executable image, a dynamically linked library (DLL), a script or other data unit associated with the application202. The access rights may be associated with the application resource210according to any suitable method. For example, the access rights may be incorporated into the file including the application resource210such as a stream or attribute. In various embodiments, the access rights may be placed into a separate file602, as shown byFIG. 6. The separate file602may then be linked with the application resource210according to any suitable method.

In various embodiments, the access rights may be associated with the application resource210by placing a data unit representing the access rights into a stream or sub-file of the file including the application resource210. In a MICROSOFT WINDOWS environment, this concept may be called a “file system filter driver;” in a UNIX/Linux environment, it may be called a “layered” or “stackable” file system; and in MICROSOFT DISK OPERATING SYSTEM (MS-DOS), it may be called an INT21or INT13driver.FIG. 4shows an exemplary file400including two streams or streams402and404. Stream402may include a data unit representing the application resource210, while the stream404may include the data unit representing access rights. It will be appreciated that in systems supporting streams (e.g., multiple sub-files within a single file), a single file may include more than one application resource210. In this case, as shown inFIG. 5, an access rights stream404,504may be included in the file500for each separate application resource stream402,502.

Also, in various embodiments, the access rights may be included as an extended attribute of the application resource file210. Support for extended attributes may be implemented in any suitable way, with extended attribute data stored within or outside of the application resource file210. For example, the OS/2 operating system allows support for extended attributes in the FAT file system by storing extended attribute data in a hidden file in the root directory of a folder or drive. Each file having extended attributes is then modified to include a pointer to the location in the hidden file including its extended attribute data. In various embodiments, the access rights may be otherwise stored as an external file602, shown inFIG. 6. The access rights file602may then be associated with the application resource210by location or other methods. For example, the access rights file602may be placed at a location associated with the application resource file210. In various embodiments, access rights files, such as file602, may be kept at a central database or other location. Also, in various embodiments, the access rights file602may be named in a way that corresponds to the application202or application resource210that it is associated with (e.g., an application “program.exe” may have a access rights file called “program.isc.”). Also, the application resource210and access rights may be associated by the digital signing process described hereinbelow.

At step310, the application resource210and access rights may be digitally signed together. In this way, the access rights may be secured, as modifying the access rights after signing will destroy the validity of the digital signature. In various embodiments where the access rights are included in the same file as the application resource210, the digital signing may involve digitally signing the application resource file210. In embodiments where the access rights are stored in a separate file, then both the application resource file210and the access rights file602may be digitally signed together. The operating system204or other architecture component (e.g., security driver802discussed below) may verify the digital signature to determine whether the access rights have been modified, inadvertently or maliciously, to change the access level of the application202.

The application resource210and access rights may be digitally signed according to any known method or configuration. For example, in various embodiments, the component210and access rights may be signed, and later verified, by authorized entities within the computer system100. Each authorized entity may have an associated digital certificate. The digital certificates of authorized entities may be kept at a central location or certificate store. In various embodiments, security may be enhanced by placing the certificate store on a peripheral device108, such as, for example, a USB dongle.

FIG. 7shows a process flow700for executing the application202and granting the application202a level of access to resources. It will be appreciated that although methods are disclosed for associating access rights with an application, various embodiments may include supplemental user-based security. For example, at step702, it may be determined whether a user (e.g., a user logged on to a user machine102) has sufficient privileges in the computer system100to run the application202. If the user lacks sufficient privileges, then execution of the application202may be denied at step703. If the user has sufficient privileges, then the application executable may be run at step704. The application executable may be, for example, the application resource210described above. Running the application executable may cause the application202to launch, as shown inFIG. 2.

At706, the access rights associated with the application resource210may be extracted. For example, in embodiments where the access rights are stored in a stream404,504, the stream may be read and the data unit including the access rights extracted. In embodiments where the access rights are stored in a separate file associated with the application resource210, the separate file may be located and read. The digital signature of the application resource210and access rights may be verified at step708. Verifying the digital signature may involve comparing the application resource210and access rights, as signed, to some indicator (e.g., a digital certificate, public key, etc.) of all of the authorized entities permitted to sign the data units. If the verification of the application resource210and the access rights fails, it may indicate that the access rights have been corrupted. In this case, the application may not be granted access to at least some resources.

At step710, the application202may make a request to access resources. The request may be a read request, where the application202asks to view data, and/or a write request where the application202asks to modify data. At step711, it may be determined whether the access rights indicate that the application202is entitled to access the requested resources. For example, in embodiments where the resources are encrypted, it may be determined if the appropriate encryption key and/or authorization to access the appropriate encryption key is included in the access rights. In embodiments where the access rights include a privilege setting for the application202, it may be determined whether the privilege setting allows the level of access requested. If the application202is not entitled to the level of access requested, then the access request may be denied at step712. In various embodiments, where the resources are encrypted, if the access rights do not entitle the application202to access the appropriate encryption key, the requested resource may be delivered to the application202anyway, albeit in encrypted and therefore unusable form. If the application202is entitled to the level of access requested, then the requested resource may be forwarded to the application202and/or edited as requested at step714.

In various embodiments, the functionality necessary to implement process flows300and700may be inherent in the operating system204. It will be appreciated, however, that the methods of process flows300and700may be implemented on operating systems204lacking such functionality by utilizing one or more security drivers, such as security driver802, shown inFIG. 8. The security driver802may be logically positioned between the application202and data storage208and may perform various functions to support associating access rights with an application. For example, in various embodiments, the security driver802may provide support for data streams or streams in the system100. This may involve intercepting read and write requests from the application202and data storage802. The security driver802may then read and/or write data units to one or more streams within a file. The file may then be written or retrieved from data storage208.

Also, in various embodiments, the security driver802may facilitate the associating of an access rights with application resource210. For example, in embodiments where the access rights are stored as a separate file602, the security driver802may store the access rights file602at the appropriate location and retrieve it when necessary. The security driver802may also facilitate the digital signing and subsequent verification of the access rights. For example, the security driver802may direct the access rights and application resource210to an authorized entity for signature. In various embodiments, the security driver802may be an authorized entity. The security driver802may also have the ability to verify a digital signature previously applied to an access rights and application resource210. The security driver208may also facilitate access rights or privileges while the application202is running. For example, the security driver208may intercept read requests and write requests from the application202. The security driver208may then determine whether the application is authorized to make the requests and grant them (e.g., by passing them along to the data storage208or operating system204, by providing the application202with a key, etc.), only when an application's202access rights indicate that it is entitled to the requested access, for example, as shown in process flow700.

As used herein, the term “data unit” refers to a group of related data. As used herein, the term “data file” refers to an organizational unit of data. For example, a data file may include one or more data units. In various non-limiting embodiments, a data file may be an application data file, a database record or a file containing some or all of an executable image, such as an application program, code library, device driver, operating system image file, etc. As used herein, the terms “sub-file” and “stream” refer to an organizational unit of data organized within a data file. For example, a stream may include one or more data units.

It is to be understood that the figures and descriptions of the present invention have been simplified to illustrate elements that are relevant for a clear understanding of the present invention, while eliminating other elements, for purposes of clarity. Those of ordinary skill in the art will recognize that these and other elements may be desirable. However, because such elements are well known in the art and because they do not facilitate a better understanding of the present invention, a discussion of such elements is not provided herein.

As used herein, a “computer,” “computer system,” and the like, may be, for example and without limitation, either alone or in combination, a personal computer (PC), server-based computer, main frame, server, microcomputer, minicomputer, laptop, personal data assistant (PDA), cellular phone, pager, processor, including wireless and/or wireline varieties thereof, and/or any other computerized device capable of configuration for processing data for standalone application and/or over a networked medium or media. Computers and computer systems disclosed herein may include operatively associated memory for storing certain software applications used in obtaining, processing, storing and/or communicating data. It can be appreciated that such memory can be internal, external, remote or local with respect to its operatively associated computer or computer system. Memory may also include any means for storing software or other instructions including, for example and without limitation, a hard disk, an optical disk, floppy disk, ROM (read only memory), RAM (random access memory), PROM (programmable ROM), EEPROM (extended erasable PROM), and/or other like computer-readable media.

The described systems may include various modules and/or components implemented as software code to be executed by a processor(s) of the systems or any other computer system using any type of suitable computer instruction type. The software code may be stored as a series of instructions or commands on a computer readable medium. The term “computer-readable medium” as used herein may include, for example, magnetic and optical memory devices such as diskettes, compact discs of both read-only and writeable varieties, optical disk drives, and hard disk drives. A computer-readable medium may also include memory storage that can be physical, virtual, permanent, temporary, semi-permanent and/or semi-temporary. A computer-readable medium may further include one or more data signals transmitted on one or more carrier waves.

While several embodiments of the invention have been described, it should be apparent that various modifications, alterations and adaptations to those embodiments may occur to persons skilled in the art with the attainment of some or all of the advantages of the present invention. It is therefore intended to cover all such modifications, alterations and adaptations without departing from the scope and spirit of the present invention.