Patent Application
20070079364
1. Field of the Invention
The present invention relates in general to the field of information handling systems, and more specifically, to managing access to software programs.
2. Description of the Related Art
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes, thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is processed, stored or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservation, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information, and may include one or more computer systems, data storage systems, and networking systems.
Historically, trusted vendors and issuers have used physical media (e.g., disk, tape, CD-ROM, etc.) to distribute software installation packages, updates, patches, and other code components for implementation onto information handling systems. However, as information handling systems increase in number and complexity, and software releases and updates become more frequent and intricate, it is becoming common to distribute software, and/or the components it is comprised of, by using a shared storage and networks as a delivery mechanism. The networks used for such software distribution can be private (e.g., secured corporate networks), public (e.g., the Internet), or hybrid (e.g., a private Intranet implemented on the public Internet).
Furthermore, instead of installing a composite installation package of software on an information handling system, it is possible to deliver only the individual software package components that are applicable, licensed and/or associated with either the system's predetermined function or the usage rights granted to its associated users. Similarly, predetermined software updates, service releases, patches, and other code components can be delivered over a network to one or more predetermined information handling systems. However, delivery of software, and/or associated components, can pose security, reliability, availability, scaling, and performance issues that traditional approaches may not adequately address.
Networked computing environments often have safeguards that are implemented to manage or control the set of software programs that are allowed access to information handling systems that comprise the computer network. Furthermore, it is generally desirable to control which software or components are authorized to execute on individual information handling systems. For example, it is commonly considered necessary to prevent malicious and/or non-business-related software programs from entering, and then executing, on information handling systems comprising an organization's computer network. A malicious software program may include virus programs and other intrusive programs, such as worms, network sniffers, and key loggers. Similarly, non-business-related software programs may include photography management tools, music recording tools, and file sharing programs.
In addition to determining whether or not the software program or component is authorized to execute, there are other security issues that may need to be addressed. For example, even if the software is authorized, its authenticity must be proven, including the validity and trustworthiness of the issuing source. Furthermore, if the software is authentic, it is important to determine if its integrity has been compromised, (e.g., has the file been tampered with, become corrupted in transmission, had malicious code inserted, etc.). Likewise, if the use of the software is authorized and its authenticity has been established (along with validating the trustworthiness of its issuer), it is also important to determine if it is licensed for execution on a predetermined information handling system, or use by a specific user.
Traditional network security approaches can allow undetected malicious code and similar attacks to alter many files prior to detection, including corruption of existing system, application and/or back-up files. Currently, user file security is primarily achieved with firewalls and filters that only detect a predetermined set of known insecurities, working in combination with reactive measures to cleanse the known subset of contaminated files and/or file-like objects that may have been affected. Other approaches, such as implementation of encryption security mechanisms may provide evidence of a software program file's integrity, prove its authenticity, and establish the trustworthiness of its issuer, and in some cases, may even provide licensing and usage controls. However, these approaches are generally limited in their implementation and may not support authentication, integrity, and execution controls when a plurality of software applications and/or components are distributed from a plurality of issuers to a plurality of recipient information handling systems operating within a network environment.
In accordance with the present invention, a system and method is disclosed for authenticating the source, integrity, and associated execution controls, of a plurality of software modules, including but not limited to, installation packages, updates, patches, and other code components. These software modules can be distributed from a plurality of issuers for implementation on a plurality of predetermined recipient information handling systems operating within a network environment. Furthermore, the present invention utilizes directory services, implemented within a network environment, to monitor and verify which software is currently authorized and implemented on one or more information handling systems operating within the network environment. The present invention also makes it possible to determine whether a software module received over a network is authorized to interact with a predetermined information handling system.
The present invention provides a Package Directory Services (PDS) that uses predetermined Directory Services, such as Active Directory or LDAP, to uniquely tag previously authorized, implemented, and possibly updated, software, comprised of files and/or file-like objects. In the context of the present invention, file-like objects include any stored information, along with filtered updates, including but not limited to registry settings, directories, file groupings, storage, volumes, web services and other storable data. The method and system of the present invention implements a PDS_TAG, which comprises a secure index into the PDS of each software distribution package, including but not limited to, all associated files and components, package rights, and expiration, along with each file or component's attributes, including but not limited to, size, dates, status, duration, copyright, ownership, category, versions, names, tags/comments and digital rights. Each PDS_TAG is encrypted, to obscure its index into its file, and package attributes. In addition, PDS_TAG encryption is salted with extra bits to hide the file's package(s) membership.
In operation, when an information handling system, or its associated and/or authorized user, attempts to implement software received over a network, the present invention accesses predetermined Directory Services to determine if the received software is authorized to be implemented on the information handling system. In one embodiment of a method of the invention, if the response from the predetermined Directory Services indicates that software received over a network is authorized to be implemented, the invention allows the software to be executed for implementation. Conversely, if the response from the predetermined Directory Services is negative, the software received over a network is prevented from being implemented. In this embodiment, the invention may also include a notification function, such as logging implementation attempts to a file for a future audit.
In another embodiment of a method of the invention, the software authentication function can be implemented on an information handling system that monitors software implementation attempts. When a software implementation attempt is initiated, the software authentication function checks predetermined Directory Services to verify the right of the software to be implemented. In this embodiment of the invention, the system and method of the disclosed invention is configured to prevent implementation of software that has not been authenticated for use. The system and method disclosed herein is advantageous because it prevents malicious and/or non-business-related software from being implemented on an information handling system operating in a network environment. Because the disclosed system and method requires all software be authenticated, the system and method can prevent malicious and/or non-business-related code from executing on an information handling system operating in a networked environment, or log specific executions, or prevent specific execution such as file copying. As such, a user could be prevented from running music or photography programs on a business computer, or similarly prevent accessing music or graphic data files.
The system and method disclosed herein can be used to mediate the right of software to execute with the usage rights of one or more predetermined users, whether the software has been previously implemented, or has been received over a network and is pending implementation. In accordance with the system and method disclosed herein, predetermined directory services can include information concerning the authorization and/or usage rights of each user in a network environment. Thus, the system and method disclosed herein can serve in a mediation capacity to manage access to software programs by users in a network environment. Upon recognizing an attempt by a user to access software, the authentication utility disclosed herein can be used to limit access by users to a predetermined set of software programs available in a network environment. Likewise, the technique disclosed herein provides system administrators with the ability to dynamically change the rights of groups of users in order to grant or deny rights to execute certain software applications.
Other technical advantages will be apparent to those of skill in the art, who will also understand that many such embodiments and variations of the invention are possible, including but not limited to those described hereinabove, which are by no means all inclusive.
The present invention may be better understood, and its numerous objects, features and advantages made apparent to those skilled in the art by referencing the accompanying drawings. The use of the same reference number throughout the several figures designates a like or similar element.
For purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence or data for business, scientific, control or other purposes. For example, an information handling system may be a personal computer, a network storage device, or any other suitable device and may vary in size, shape performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, read only memory (ROM), and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.
Skilled practitioners in the art will be familiar with directory services, which differ from directories, in that it is both the directory information source and the source of the services making the information available and usable to administrators, users, network services, and applications. Ideally, a directory service makes the physical network topology and protocols transparent, so that a user can access any resource without knowing where or how it is physically connected. One such directory service is the Lightweight Directory Access Protocol (LDAP), an open network protocol standard designed to provide access to distributed directories. LDAP provides a mechanism to query or modify information that resides in a directory information tree (DIT), which may contain a broad range of information about different types of objects such as applications, users and other network resources. Another directory service, Active Directory Service (ADS) produced by Microsoft, uses the Domain Name System (DNS), an Internet standard service that translates human-readable computer names to computer-readable numeric IP addresses. ADS hierarchically stores information about network objects and makes it available for searching and querying. Using ADS, a network and its objects are organized by constructs such as domains, trees, forests, trust relationships, organizational units, and sites. Previous to the present invention, information handling system users were unable to utilize Directory Services to filter software applications delivered over a network for malicious and/or non-business-related software programs, and to ensure that each file component of authorized software was signed by a trusted issuer and had not been tampered with.
Referring again to
If the software distribution package 204 meets authentication, integrity, licensing, and usage criteria, then it can be installed on the target information handling system 208. Upon completion, the target information handling system 208 will have a predetermined set of software that has been filtered for malicious and/or non-business-related software, and meets other predetermined criteria.
In other embodiments of the invention, the approaches detailed hereinabove can apply to other package creation options, including but not limited to, deployment, cloning, updates or installs. Similarly, the above file tagging approaches described hereinabove can affect many file-like objects, including but not limited to, OS-based storage of registry configurations, dates, services, web services, logs, and events. In an embodiment of the invention, a third party site or portal could provide PDS services for remote, certified Directory-based services, including but not limited to, package creation and file/package verifications, which could include but are not limited to, ensuring license, expiration dates, version control, or hot updates. In other embodiments of the invention, the approaches detailed hereinabove to other Operating System implementations, including but not limited to, Active Directory, Windows file filter API, and .Net run-time.
Skilled practitioners in the art will recognize that many other embodiments and variations of the present invention are possible. In addition, each of the referenced components in this embodiment of the invention may be comprised of a plurality of components, each interacting with the other in a distributed environment. Furthermore, other embodiments of the invention may expand on the referenced embodiment to extend the scale and reach of the system's implementation.
The present invention provides a system and method for improving current file security by automatically filtering software installation packages to ensure that each package component is signed by a trusted and verified issuer, and has not been tampered with, thereby replacing a weak, native trust model based on firewalls, static filters, reactive detection, and cleansing approaches. In addition, current file corruption vulnerability caused by malicious code, non-business-related software, accidents, and system faults, can be mitigated by tagging file-like objects, including but not limited to, registry, directories, file groupings, storage, volumes, and web services, and using the tag as an index to predetermined Directory Services based on but not limited to, file size, date, rights, archive, file security attributes, auditing attributes, reporting attributes, and service attributes.
Furthermore, filtering of file access can be assured, based on the tag index, including but not limited to, filtering files, file groups, and/or specific files, in combination with file access, including but not limited to type-specific, or polled-files. Likewise, file updates that comply with Directory-Based policies can be ensured, per file, install package of files, user, user group, or global users. Additionally, audits and/or reports on all file accesses can be generated by file tag, including but not limited to, grouping by access attempts, both valid and invalid, and by access type, including but not limited to read, write, append, and by file type, whether executable, data, configuration, and also by file attribute update, including but not limited to archive, compressed, hidden, read-only, executable, etc. Correspondingly, file access logs can be reverted to undo file tags, whether by software package, file group, or specific file.
Moreover, overrides can be enacted to allow exceptions to file tagged access by file, file package, or file grouping, and such override exceptions can be complete, or granular by time, file, package, file group, access, user, user group, etc. Similarly, a bulk-dump mode can allow filter-disabling for software implementations, or updates to previously implemented file packages and their PDS updates, thereby enabling multiple machine deployments, and avoiding potential filter or PDS outages.
Although the present invention has been described in detail, it should be understood that various changes, substitutions and alterations can be made hereto without departing from the spirit and scope of the invention as defined by the appended claims.
