Patent Application
20080016212
The accompanying drawings, which are incorporated in and constitute part of this specification, illustrate embodiments of the invention and together with the description, serve to explain the principles of the invention. The embodiments illustrated herein are presently preferred, it being understood, however, that the invention is not limited to the precise arrangements and instrumentalities shown, wherein:
Embodiments of the invention provide a method, system and computer program product for a file system firewall. In accordance with an embodiment of the present invention, a file system firewall can be coupled to a file system in a computing environment. The file system firewall can intercept file access requests and can extract from the requests, request attributes, such as the requesting application and an application user. For each of the requests, a key can be formed from selected ones of the attributes and applied to a set of access rules to locate a specific rule for the request. Thereafter, the request can be permitted only if permitted by the located rule. Otherwise, the request can be denied. In this way, application based security can be applied to files in the file system.
In further illustration,
File system firewall logic 300 can be coupled to the host computing platform 120. The file system firewall logic 300 can include program code enabled to apply access rules 150 to requests to access the files in the file system 140 as issued by applications executing in the client computing devices 110. Specifically, the program code of the file system firewall 300 can be enabled to locate an applicable rule for a file system access request based upon one or more attributes 160 provided in the file system access request, such as the application identifier and the user identifier. Where no rules exist for a particular request, the requesting end user can be prompted to establish the rule, or to permit a one time decision as whether to permit or deny the request.
In more particular illustration,
A file system firewall 230 can be disposed between the operating system 250 and the file system 220 and can limit access to files in the file system 220 based upon access rules 240 associated with the file system firewall. Specifically, the file system firewall 230 can locate one or more applicable rules among the access rules 240 based upon attributes identifiable within any given file system request. The applicable rules particularly can relate to the identity of the application itself so as to apply an application-based rule to the file system request. The applicable rules further can relate to the file system directory in which the requested file exists.
In yet further illustration,
Thereafter, in block 320, a lookup can be performed on a set of access rules using the rule key as a key. In decision block 325, if a rule is located, in decision block 330 it can be determined whether to permit or deny the access request. In the case of a denial, the process can continue through block 335. Otherwise, the process can continue through block 340. In decision block 325, if a rule cannot be located for the given rule key, in block 345, the end user can be prompted to indicate whether or not to permit the access request. The prompt additionally can include a user interface element indicating whether or not to persist the choice of the end user as a rule. In decision block 350, if the end user determines to persist the choice as a rule, in block 355, the choice can be written to the set of rules with the rule key. In either case, in decision block 330, if the end user chose to deny the file system request, inblock 335 the request can be denied. Otherwise, in block 340 the request can be permitted.
The embodiments of the invention can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In a preferred embodiment, the invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, and the like. Furthermore, the invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system.
For the purposes of this description, a computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk—read only memory (CD-ROM), compact disk—read/write (CD-R/W) and DVD.
A data processing system suitable for storing and/or executing program code will include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution. Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system either directly or through intervening I/O controllers. Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
