Administrative security systems and methods

• US 20050182963A1
• Filed: 04/15/2005
• Published: 08/18/2005
• Est. Priority Date: 12/13/1999
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Gang, Sutton, Paul C., Phillips, Thomas G.
• Granted Patent: US 7,676,672 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/33 using certificates

Abstract

In an implementation of administrative security systems and methods, access to administrative functions is controlled according to access privileges. A security process can be executed with administrative privilege to initiate an administrative function, and a user process can be executed with non-administrative privilege such that access to the administrative function is restricted. The user process can request initiation of the administrative function via the security process with parameters that include an identification of the administrative function and input arguments to the administrative function.

Claims

1. A computing device, comprising:

means for controlling access to administrative functions according to access privileges;

means for executing a security process with administrative privilege to initiate an administrative function;

means for executing a user process with non-administrative privilege restricting access to the administrative function; and

means for requesting initiation of the administrative function via the security process on behalf of the user process with parameters that include an identification of the administrative function and input arguments to the administrative function.

2. A computing device as recited in claim 1, further comprising means for initiating the administrative function with the input arguments on behalf of the user process.

3. A computing device as recited in claim 1, further comprising means for determining whether the user process is allowed to initiate the administrative function via the security process.

4. A computing device as recited in claim 1, further comprising:

means for determining whether the user process is allowed to initiate the administrative function via the security process; and

means for initiating the administrative function with the input arguments on behalf of the user process if determining that the user process is allowed to initiate the administrative function via the security process.

5. A computing device as recited in claim 1, further comprising means for determining whether the input arguments for the administrative function are valid.

6. A computing device as recited in claim 1, further comprising:

means for determining whether the input arguments for the administrative function are valid; and

means for initiating the administrative function with the input arguments on behalf of the user process if the input arguments for the administrative function are determined to be valid.

7. A computing device as recited in claim 1, further comprising:

means for determining whether the user process is allowed to initiate the administrative function via the security process;

means for determining whether the input arguments for the administrative function are valid; and

means for initiating the administrative function with the input arguments on behalf of the user process if the input arguments for the administrative function are determined to be valid, and if determining that the user process is allowed to initiate the administrative function via the security process.

8. A computing device as recited in claim 1, further comprising means for instantiating the user process to execute with the non-administrative privilege via remote administration from a networked remote administrator.

9. A computing device as recited in claim 1, wherein the means for controlling access to the administrative functions includes means for controlling access to the administrative functions of an operating system.

10. A computing device as recited in claim 1, wherein the means for controlling access to the administrative functions includes means for controlling access to the administrative functions of the security process.

11. A computing device as recited in claim 1, wherein the means for executing the security process includes means for executing the security process as an independent user service with the administrative privilege.

12. A computing device as recited in claim 1, further comprising means for configuring the security process as an intermediary between the user process and the administrative function such that the security process is independent of administrative function implementation.

13. A computing device as recited in claim 1, further comprising means for receiving the parameters and initiating the administrative function with the input arguments on behalf of the user process such that the security process is independent of administrative function execution.