Secure network file access controller implementing access control and auditing

• US 20040015723A1
• Filed: 07/22/2002
• Published: 01/22/2004
• Est. Priority Date: 07/22/2002
• Status: Active Grant

• Current Assignee: Thales DIS CPL USA, Inc. (Thales SA)
• Original Assignee: Vormetric, Inc. (Thales SA)
• Inventors: Lo, Mingchen, Zhang, Pu Paul, Pham, Duc, Nguyen, Tien Le
• Granted Patent: US 6,931,530 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A network file access appliance operates as a secure portal for network file access operations between client computer systems and network storage resources. The file access appliance terminates network file access transactions, identified by packet information including client system, mount point, and file request identifiers, between client systems and mount points supported by the access controller. A policy parser determines, based on the packet information, to selectively initiate network file access transactions between the access controller and network storage resources to enable completion of selected network file access transactions directed from the clients to the network file access appliance. The network file access transactions directed to the network storage resources are modified counterparts of policy selected client network file access transactions modified to reference mapped network storage resource mount points and support the secure transfer and storage of network file data.

Claims

1. A secure portal for network file access transactions between client computer systems and network storage resources, said secure portal comprising:

a) a network interface supporting network connections to a client system and a network storage resource, respectively; and

b) an access controller coupled to said network interface, said access controller operative to terminate a first network file access transaction between said client system and a virtual mount point supported by said access controller,

wherein said access controller includes a policy parser, responsive to a client system identifier, a virtual mount point identifier, and a request identifier provided with a first network file request received within said first network file access transaction, operative to selectively enable initiation of a second network file access transaction between said access controller and a defined mount point of said network storage resource dependent on a defined combination including said client system identifier, said virtual mount point identifier, and said request identifier,

said second network file access transaction including a second network file request having a modified correspondence with said first network file request to support completion of said first network file access transaction relative to said defined mount point.

2. The secure portal of claim 1 wherein said policy parser is further responsive to a user identifier and a group identifier and wherein said second network file access transaction is selectively enabled dependent on said defined combination including said client system identifier, said virtual mount point identifier, said user identifier, said group identifier, and said request identifier.

3. The secure portal of claim 1 wherein said policy parser includes policy sets defined for predetermined combinations of said client system identifier, said virtual mount point identifier, and said request identifier, sold second network file access transaction being enabled dependent on said policy sets including a defined policy set corresponding to said defined combination.

4. The secure portal of claim 3 wherein said policy parser is further responsive to a user identifier and a group identifier, wherein said policy sets are further defined for predetermined combinations of said client system identifier, said user identifier, said group identifier, said virtual mount point identifier, and said request identifier, and wherein said second network file access transaction is selectively enabled dependent on said defined combination including said client system identifier, said user identifier, said group identifier, said virtual mount point identifier, and said request identifier.

5. The secure portal of claim 4 wherein said access controller is operative to provide auditing report data and wherein said access controller includes said defined combination in said auditing report data where said policy sets fail to contain said defined policy set corresponding to said defined combination.

6. The secure portal of claim 5 wherein said access controller is operative to provide an administrative alarm selectively based on said defined combination where said policy sets fail to contain said defined policy set corresponding to said defined combination.

7. A network file access controller providing secure access controls over accesses by client computer systems to network storage resources, said network file access controller comprising:

a) a client network interface presenting a plurality of client mount points for connecting to logical network storage resources;

b) a storage network interface coupleable to a plurality of network storage resources;

c) a file access processor, responsive to session and control information provided by a client computer system in a network data packet within a client network file transaction, operative to selectively perform a storage network file transaction to support completion of said client network file transaction, wherein said session and control information includes a target client mount point specification, a process identifier, and a file access request; and

d) a policy parser, responsive to said file access processor, operative to evaluate a plurality of predefined access constraints against said session and control information to enable said storage network file transaction.

8. The network file access controller of claim 7 wherein said file access processor includes mapping data, accessible by said policy parser, establishing a correspondence between said plurality of client mount points and said plurality of network storage resources.

9. The network file access controller of claim 8 wherein said mapping data supports aliasing between said plurality of client mount points and said plurality of network storage resources.

10. The network file access controller of claim 9 wherein said session and control information includes a file path specification and wherein said policy parser is responsive to said file path specification in evaluating said plurality of predefined access constraints.

11. The network file access controller of claim 10 wherein said client network file transaction references a network file and wherein said policy parser qualifies execution of said storage network file transaction to retrieve an encryption key specific to said network file.

12. The network file access controller of claim 11 wherein said policy parser qualifies execution of said storage network file transaction to retrieve an encryption key identifier, specific to said network file, from said plurality of network storage resources.

13. The network file access controller of claim 12 wherein said file access processor includes a policy store and wherein said encryption key is accessed from said policy store based on said encryption key identifier.

14. The network file access controller of claim 12 wherein said encryption key is retrieved from a trusted encryption key server based on said encryption key identifier.

15. A method of controlling access by client systems to network storage resources, said method comprising the steps of:

a) terminating first network file request transactions, including first file access requests, initiated by client systems directed against first network files identified by first path specifications;

b) selecting predetermined ones of said first file access requests discriminated by said first path specifications; and

c) initiating second network file request transactions, including second file access requests, against second network files, identified by second file path specifications, stored by network storage resources, wherein said second file access requests correspond to said predetermined ones of said first file access requests to enable completion of said first network file request transactions, and wherein said second file path specifications correspond to said first file path specifications of said predetermined ones of said first file access requests.

16. The method of claim 15 wherein said step of selecting evaluates said first path specifications and said first file access requests against a predefined set of policy specifications to select said predetermined ones of said first file access requests.

17. The method of claim 16 wherein said first network file request transactions include client and session identifications and wherein said step of selecting further evaluates said client and session identifications against said predefined set of policy specifications to select said predetermined ones of said first file access requests.

18. The method of claim 17 further comprising the step of recording an audit log of said first network file request transactions with respect to said first file access requests as evaluated against said predefined set of policy specifications to select said predetermined ones of said first file access requests.

19. The method of claim 17 wherein said first path specifications include client mount point identifiers, wherein said second path specifications include resource mount point identifiers, and wherein said step of initiating provides for the conversion of said client mount point identifiers to said resource mount point identifiers.

20. The method of claim 19 wherein said step of selecting minimally evaluates said client mount point identifiers of said first path specifications against said predefined set of policy specifications to select said predetermined ones of said first file access requests.

21. The method of claim 20 wherein said client and session identifications include client source IPs and process identifiers.

22. The method of claim 21 wherein said client and session identifications further include authenticated user and group identifiers.

23. The method of claim 22 further comprising the step of recording an audit log of said first network file request transactions with respect to said first file access requests as evaluated against said predefined set of policy specifications to select said predetermined ones of said first file access requests.

24. A method of operating a secure portal appliance to control access to files stored on network storage resources, said method comprising the steps of:

a) establishing a plurality of virtual mount points accessible by client systems for establishing network file access connections within which to receive first network file access requests;

b) evaluating said first network file access requests against a predetermined set of access policies associated by said virtual mount points to identify a second network file requests executable to selectively complete said first network file access requests; and

c) issuing said second network file requests to access network file data to enable selective completion of said first network file access requests.

25. The method of claim 24 wherein said first network file access requests include client session information and wherein said step of evaluating includes evaluating said client session information against said predetermined set of access policies to identify said second network file requests.

26. The method of claim 25 wherein said client session information includes a client process identifier.

27. The method of claim 25 wherein said client session information includes a source client identifier and an authenticated user identifier.

28. The method of claim 25 wherein said client session information includes a source client identifier, a user identifier, a group identifier, and a client process identifier.

29. The method of claim 25 wherein said step of issuing issues said second network file requests with respect to network storage resources having a predetermined correspondence with said plurality of virtual mount points.

30. The method of claim 29 wherein said predetermined correspondence is determined by said predetermined set of access policies.