Patent ID: 8087065

Claim:
A method for implementing mandatory access control in a system comprising a plurality of computers, the system comprising a plurality of information assets, stored as files on the plurality of computers, and a network communicatively connecting the plurality of computers, wherein each of the plurality of computers includes an operating system that uses a discretionary access control policy, and wherein each of a subset of the plurality of computers includes a software agent component operable to perform the steps of: intercepting a request for a file operation on a file from a user of one of a plurality of computers including a software agent; determining whether the file is protected based on a mandatory access control policy; determining whether the file is on storage local to or remote from the computer from which the request for the file operation occurred; and providing access to the file based on the mandatory access control policy wherein providing access to the file comprises: if the file is protected and on local storage: altering ownership of the file from the user to another owner; setting an access control list of the file based on the mandatory access control policy; and if the file is protected and on remote storage: setting an access control list of the file to allow another owner to take ownership of the file; reopening the file using permissions of the other owner; setting ownership of the file to the other owner; and setting an access control list of the file based on the mandatory access control policy.