Enhanced metadata to authentically report the provenance of a file

• US 10,176,331 B2
• Filed: 06/10/2016
• Issued: 01/08/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Sheehan, John M., Agarwal, Vishal, Cowan, Crispin, Pang, Juan-Lee, Domzalski, Greg, LeBlanc, David C.
• Primary Examiner(s): Brown, Anthony D
• Assistant Examiner(s): Corum, Jr., William A
• Application Number:
  US15/179,536
• Publication Number:
  US 20170357818A1
• Time in Patent Office: 942 Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control

Abstract

Aspects of the technology described herein can provide enhanced metadata to authentically report the provenance of a file. An exemplary computing device may have a file broker to receive an indication from a first security principal to write a file to a file system. The file broker can use one file utility to write the file, but use another file utility to write an identification of the first security principal and its opinion about the file into metadata associated with the file. Subsequently, the identification of the first security principal and its opinion may be used to authentically report the provenance of the file and applied in other security applications.

Claims

1. A computing system, comprising:

a file broker configured to receive a notification, from a first security principal, indicating to write a file to a file system;

a first file utility configured to write the file, the first file utility being accessible to the first security principal via the file broker; and

a second file utility configured to write an identification of the first security principal and a trust level to the file from the first security principal into metadata associated with the file, the second file utility being inaccessible to the first security principal for writing.

2. The computing system of claim 1, wherein the second file utility is further configured to replace an existing identification of another security principal in the metadata associated with the file with the identification of the security principal.

3. The computing system of claim 2, wherein the second file utility is further configured to replace an existing trust level to the file, from the another security principal in the metadata associated with the file, with the trust level to the file from the first security principal.

4. The computing system of claim 1, wherein the second file utility is further configured to add the identification of the first security principal to a chain of existing security principals in the metadata associated with the file.

5. The computing system of claim 4, wherein the second file utility is further configured to add the trust level to the file from the first security principal to a chain of existing trust levels to the file from respective other security principals in the metadata associated with the file.

6. The computing system of claim 1, further comprising:

a second security principal configured to retrieve, via the file broker, the identification of the first security principal from the metadata; and

to determine a provenance of the file based at least in part on the identification of the first security principal.

7. The computing system of claim 6, wherein the second security principal is further configured to access information of a plurality of trusted provenances, and the second security principal is further configured to determine the provenance of the file is one of the plurality of trusted provenances.

8. The computing system of claim 6, wherein the second security principal is further configured to retrieve, via the file broker, the trust level of the first security principal, and to make a security decision for accessing the file based at least in part on the provenance of the file and the trust level to the file from the first security principal.

9. The computing system of claim 6, wherein the first security principal is a first application running in a restricted mode, the second security principal is a second application running in an unrestricted mode.

10. A computer-implemented method, comprising:

receiving a notification from a security principal to write a file to a file system;

recording, via an operating system, a unique identifier of the security principal into metadata associated with the file;

retrieving, via the operating system, the unique identifier of the security principal from the metadata; and

determining a provenance of the file based at least in part on the unique identifier of the security principal.

11. The method of claim 10, further comprising:

making a security decision for accessing the file based at least in part on the provenance of the file.

12. The method of claim 10, further comprising:

determining a trust level to the file based at least in part on the provenance of the file.

13. The method of claim 10, wherein the recording comprises recording the unique identifier of the security principal into the metadata after receiving the notification but before the file is written by the security principal to the file system.

14. The method of claim 10, wherein the recording comprises recording an opinion of the security principal about the file into the metadata.

15. The method of claim 14, wherein the opinion comprises at least one zone identifier.

16. One or more computer storage hardware media comprising computer-implemented instructions that, when used by one or more computing devices, cause the one or more computing devices to:

receive a notification from a security principal to write a file to a file system;

mandatorily record an identification of the security principal into metadata associated with the file wherein the security principal is prevented from altering the metadata; and

write an opinion of the security principal about the file into the metadata associated with the file in response to a request of the security principal to write the opinion.

17. The one or more computer storage media of claim 16, wherein the security principal is a first security principal, and the instructions further cause the one or more computing devices to:

retrieve, by a second security principal, the identification of the first security principal from the metadata; and

determine a provenance of the file based at least in part on the identification of the security principal.

18. The one or more computer storage media of claim 16, wherein the security principal is a first security principal, and the instructions further cause the one or more computing devices to:

retrieve, by a second security principal, the opinion of the first security principal about the file from the metadata; and

make a security decision to access the file by the second security principal based on the provenance of the file and the opinion of the first security principal about the file.

19. The one or more computer storage media of claim 16, wherein the instructions further cause the one or more computing devices to:

facilitate the security principal to form the opinion based on a domain associated with the file.

20. The one or more computer storage media of claim 16, wherein the instructions further cause the one or more computing devices to:

replace an existing identification of another security principal in the metadata associated with the file with the identification of the security principal.