Patent Application
20080235806
The present invention generally concerns computer system file security, and more particularly concerns methods and apparatus that implement file security on a contextual basis by, for example, restricting access to a file to certain computers in a networked system; or to computers having a particular application program installed; or to certain users based on a time criterion.
Current computer file systems operating in accordance with the prior art contain relatively limited means to control how computer files are used. For example, in accordance with the prior art computer files can be marked read-only. There is currently no way to restrict the use of a computer file to a particular application, or to a particular computer, or to a particular time period.
In conventional file management systems, various restrictions respecting viewing or editing rights can be instituted in dependence either on a privilege level assigned to a user or through the user's association with a particular group. There are no restrictions, however, that define where or when a file can be used. There is no way to restrict access to files based on location or time, or to limit use of files based on the identity of a user's system.
What is needed then is a context-based file security system that contains metadata to describe who, when and where a file or certain data can be used, thereby limiting access to files or data to certain users at certain times or at certain locations.
Accordingly, those skilled in the art desire context-dependent file security systems that append novel metadata to files to control what computer systems and/or application programs can access a file; and when the file can be accessed.
In addition, those skilled in the art desire context-dependent file security systems that hide from view files not authorized to be viewed from particular computer systems, or with particular application programs. On the other hand, context-dependent file systems desired by those skilled in the art should render files visible to users who have accessed the file using an authorized computer or an authorized application program.
The foregoing and other objects are overcome, and other advantages are realized, in accordance with the following embodiments of the present invention.
A first embodiment of the invention comprises a signal-bearing medium tangibly embodying a program of machine readable instructions executable by a digital processing apparatus of a computer system to perform context-based file security operations, the operations comprising: receiving a selection of at least one context-based permission to be applied to at least one file stored in a computer memory resource associated with the computer system, whereby the at least one context-based permission will be used by the computer system to control access to the at least one file; and saving the at least one context-based permission to a memory of the computer system as context-based permission information.
A second embodiment of the present invention comprises a signal-bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus of a computer system to perform context-based file security operations concerning at least one file stored in a computer memory resource associated with the computer system, the operations comprising: monitoring access requests for files stored in the computer memory resource associated with the computer system; detecting a particular access request for files stored in the computer memory resource, where the particular access request encompasses the at least one file; retrieving context-based permission information associated with the at least one file, where the context-based permission information concerns a context-based permission used to control access to the at least one file; deriving user context information from the particular access request; comparing the context-based permission saved in the context-based permission information to the user context information derived from the particular access request; and granting access to the file if the context-based permission and user context information match.
A third embodiment of the present invention comprises a signal-bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus of a computer system to perform context-based security operations, the operations comprising: receiving a selection of at least one context-based permission to be applied to at least one computer system resource associated with the computer system, whereby the at least one context-based permission will be used by the computer system to control access to the at least one computer system resource; and saving the at least one context-based permission to a memory of the computer system as context-based permission information.
A fourth embodiment of the present invention comprises a computer system for performing context-based security operations concerning at least one computer system resource, the computer system comprising: at least one memory to store at least one program of machine-readable instructions, where the at least one program performs context-based security operations concerning the at least one computer system resource when executed; at least one processor coupled to the at least one memory and computer system resource, where the at least one processor performs at least the following operations when the at least one program is executed: receiving at least one selection of a context-based permission to be applied to the at least one computer system resource, whereby the context-based permission will be used by the computer system to control access to the at least one computer system resource; and saving the at least one context-based permission to a memory of the computer system as context-based permission information.
A fifth embodiment of the present invention comprises a computer system for performing context-based security operations concerning at least one computer system resource, the computer system comprising: at least one memory to store at least one program of machine-readable instructions, where the at least one program performs context-based security operations concerning the at least one computer system resource when executed; at least one processor coupled to the at least one memory, where the at least one processor performs at least the following operations when the at least one program is executed: monitoring access to the at least one computer system resource; detecting an attempt to access the at least one computer system resource; retrieving the context-based permission information; deriving user context information from the access attempt; comparing the context-based permission saved in the context-based permission information to the user context information derived from the access attempt; and granting access to the computer system resource if the context-based permission and user context information match.
Thus it is seen that the present invention overcomes the limitations of the prior art. In particular, apparatus and methods operating in accordance with the prior art have relatively limited ability to institute context-dependent file security. For example, computer files in current electronic computer file systems can be designated as read-only, or restricted to access by certain authorized individuals or groups.
In contrast, methods and apparatus operating in accordance with the present invention establish new attributes and metadata for computer system files that describe how, when and where files can be accessed or used. These new attributes specify where physically a file can be used, or even where it is visible. The file metadata contains a certificate that must be validated by the proper application before the file can be used, edited or even viewed and made visible. Users with an authorized application, for example, can “see” files that can be operated on by the authorized application. Users without the authorized application do not “see” the files in computer systems operating in accordance with the context-dependent security system of the present invention; for users without the authorized application the files do not exist and cannot be accessed.
In addition to new metadata, new runtime software is introduced as part of the present invention to mediate file access. A policy store is introduced, to determine what actions are permissible and how to handle boundary cases, such as the case where a user has an open file and crosses the geographic boundary outside of which the file is not to be accessed while the file is still open.
In context-dependent computer file security systems operating in accordance with the present invention, users at a particular location such as a public internet site would not be able to view corporate or secure information. A context-dependent computer file security system operating in such a manner would prevent hackers from gaining access to proprietary data. Such a context-dependent computer file security system can be instituted in methods and apparatus of the present invention by appending metadata to selected computer system files that allows access to selected computer system files only from computer systems on a corporate intranet or secure network, or connected through some type of hardware or software security device. Although time specific, location-specific and application-specific metadata are given as examples, other metadata can be applied.
In computer file security systems instituting the context-dependent file security measures of the present invention, the following attributes may be used to provide security. For example, a file may only be modified under certain conditions relating to any of: vendor or package doing the modification (e.g. only an IBM software package can access a file), application (e.g., only WORD™ has permission to change a WORD™ file), location of computing resource, date of most recent change, number of times a file has been copied or printed, relevance of file to user's need, content of the entity being modified (e.g., if the system determines that the topic of a document is “encryption,” then the file may not be modified), time of day, and date.
Restricting access to a file based on file content may be particularly novel. File content or “topic” may be accessed by various known methods, such as the use of keywords, latent semantic indexing, an automatic analysis of the text, and so forth. The user may also intentionally add keywords or specify that the file is not to be modified under various conditions.
In conclusion, the foregoing summary of the embodiments of the present invention is exemplary and non-limiting. For example, one of ordinary skill in the art will understand that one or more aspects or steps from one embodiment can combined with one or more aspects or steps from another alternate embodiment to create a new embodiment within the scope of the present invention.
The foregoing and other aspects of these teachings are made more evident in the following Detailed Description of the Preferred Embodiments, when read in conjunction with the attached Drawing Figures, wherein:
In operation, users operating through computers 142, 144, 146, 148, 150 and 152 seek access to computer system resources (such as, for example, files, folders, application programs, network resources, etc.) stored on database 120, or elsewhere accessible through network 110. In the particular example described with respect to
Other context-based permissions operating in accordance with the present invention may allow users to access a third file from any of the computers under certain circumstances. For example, a context-based permission concerning the time of day a third file may be accessed would permit access to the third file from any of the computers as long as the time criterion was satisfied. Other context-based permissions concerning the number of times a file can be accessed or printed similarly would permit access from any of the computers as long as the permission criterion was satisfied.
A method 200 operating in accordance with the present invention is depicted in
At step 210, the computer system receives a selection of at least one context-based permission to be applied to at least one file stored in a computer memory resource associated with the computer system, whereby the at least one context-based permission will be used by the computer system to control access to the at least one file. Then at step 220, the computer system executes a step of the method which saves the context-based permission to a memory of the computer system as context-based permission information.
The steps of the method depicted in
At step 310 of the method 300, the computer system receives a selection of at least one context-based permission to be applied to at least one file stored in a computer memory resource associated with the computer system, whereby the at least one context-based permission will be used by the computer system to control access to the at least one file. Then, at step 320, the computer system saves the at least one context-based permission to a memory of the computer system as context-based permission information. Next, at step 330, the computer system monitors access requests for files stored in the computer system memory resource associated with the computer system. Then, at step 340, the computer system detects a particular access request for files stored in the computer memory resource, where the particular access request encompasses the at least one file. Next, at step 350, the computer system retrieves the context-based permission information. Then, at step 360, the computer system derives user context information from the particular access request. Next, at step 370, the computer system compares the context-based permission information to the user context information derived from the particular access request.
In variants of the method depicted in
One of ordinary skill in the art will understand that an access request within the context of the present invention can take many forms. For example, “an access request” may occur when a user issues a search request through a browser, search engine or a file search feature of a file system. If the entity issuing the search request, which is treated as “an access request” within the context of the present invention, does not satisfy the context-based permission, then the existence of a file which otherwise satisfies the search request of the entity will not be revealed to the entity. Another example of an “access request” within the context of the present invention occurs when a user accesses a file tree composed of files and folders. Prior to the entity being allowed to peruse the contents of the file tree structure, the computer system will compare the context-based permissions for all of the contents of the file tree against the user context information evident from the access attempt of the entity. Only those elements of the file tree for which the context-based permissions are satisfied by the entity will be visible to the entity. One skilled in the art will understand that other access requests are possible within the context of the present invention.
The methods depicted in
In another variant of the method depicted in
In various embodiments of the present invention, different context-based permissions may be implemented to control access to a file. For example, in one embodiment the context-based permission restricts access to the at least one file to a particular time period such as, for example, certain hours during the day; or certain days of the week; or certain months of the year, etc. In another embodiment, the context-based permission restricts access to the at least one file to access through a particular authorized application program or programs. If an access attempt is made through another application program, and not the authorized program or programs, access will be denied.
In still further embodiments, the context-based permission restricts access to a file based on an aspect of identity relevant to computer systems. For example, the context-based permission can restrict access to a file to a particular computer or groups of computers. In another example, the context-based permission can restrict access to a file to computers resident in certain domains. In a further example, the context-based permission can restrict access based on geographic location. If it is determined that an access request is made from a region of the world notorious for on-line scams, then access will be denied. In yet another example of identity, the context-based permission can restrict access to a file based on application program vendor identity. This would allow a user to prevent entities from using a file with application programs not marketed by, for example, IBM.
In other embodiments, the context-based permission restricts access to a file based on whether the access attempt is made through an authorized security instrumentality. In one example, the context-based permission can restrict access to a file to access made through an authorized hardware security device. In another example, the context-based permission can restrict access to a file to access using an authorized security application.
In further embodiments, the context-based permission can restrict the number of times that a file operation may be performed on a file to a predetermined number. In such an embodiment, this context-based permission could be used to restrict the number of times a file is accessed; or the number of times a file is copied; or the number of times a file is printed; or the number of times a file is modified; or the number of times a file is downloaded.
In variants of the methods depicted in
In addition to files, as indicated previously, the methods and apparatus of the present invention can be applied to a broader set of resources including, but not limited to, folders, databases, hardware resources, networks, network interfaces, etc. These resources are generally referred to in this application as “computer system resources.” Computer system resources further encompass any computer-related asset for which it is useful to govern access.
In addition to the methods depicted in
In embodiments of the present invention, the context-based permissions can be instituted in various ways. For example, a file can be encrypted by a context-specific key that is generated based on the context permissions. The key is then saved in a key store. When the file is accessed, a key is generated for the current context, and that key is compared with the key in the key store to see if it is a match or within a specified range. If so, file access is permitted. If not, file access is denied.
In other embodiments, the methods and apparatus of the invention establish a secure hidden database of file metadata which is accessed by the file system for displaying or accessing files or configuration information on storage 120. Files and data may contain digital certificates to validate that the program that is attempting access to the file or data does not indeed have the right or privilege to view or edit the data. The metadata can optionally be deployed as part of a policy by IT administrators, and later attached to a particular file or files so as to limit access to those files.
The present invention can be implemented as an extension to an existing file system provided by the operating system, or by the middleware that mediates access to files. In either case, actions to access files are mediated and approved or denied according to the file metadata or to local policies expressed as file metadata to determine how the file can be used.
Thus it is seen that the foregoing description has provided by way of exemplary and non-limiting examples a full and informative description of the best method and apparatus presently contemplated by the inventors for implementing context-dependent file security. One skilled in the art will appreciate that the various embodiments described herein can be practiced individually; in combination with one or more other embodiments described herein; or in combination with context-dependent file security systems differing from those described herein. Further, one skilled in the art will appreciate that the present invention can be practiced by other than the described embodiments; that these described embodiments are presented for the purposes of illustration and not of limitation; and that the present invention is therefore limited only by the claims which follow.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 11173111 | Jul 2005 | US |
| Child | 12131351 | US |
