System and Method for Enhanced Layer of Security to Protect a File System from Malicious Programs

• US 20080256625A1
• Filed: 05/15/2008
• Published: 10/16/2008
• Est. Priority Date: 04/19/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bhogal, Kulvir Singh, Potluri, Lakshmi, Nachimuthu, Kanmani, Baskaran, Guruprasad
• Application Number:
  US12/120,776
• Publication Number:
  US 20080256625A1
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

A system and method for providing an enhanced layer of security to protect the file system from malicious programs are provided. An additional layer of security for protecting data and to minimize successful attacks by malicious programs is provided. This additional layer uses the feature of code signing to verify that the code is from a source which the code claims to be from, and also that the code has not been tampered with by a malicious party. The file system provides a feature by which certificates are mapped to portions of a file system, e.g., files/directories, such that only programs that are certified by those certificates are able to read/modify those portions of the file system.

Claims

1. A method, in a data processing system, for authorizing access to portions of a file system, comprising:

receiving, from an executing program, a request to access a portion of the file system, the request including an identifier of the portion of the file system;

retrieving, based on the identifier of the portion of the file system, authorized certificate information associated with the identifier of the portion of the file system, identifying authorized certificates of trusted parties that may be used to access the portion of the file system;

determining if the executing program corresponds to an authorized certificate associated with the portion of the file system; and

permitting access to the portion of the file system only if the executing program corresponds to the authorized certificate associated with the portion of the file system.

2. The method of claim 1, wherein the portion of the file system is one of a file, a group of files, a directory, and a group of directories in the file system.

3. The method of claim 1, wherein the portion of the file system is a registry file of the file system.

4. The method of claim 1, further comprising:

receiving a user selection of the portion of the file system;

receiving a user selection of one or more certificates to be associated with the portion of the file system; and

storing an identifier of the portion of the file system in association with one or more identifiers of the one or more certificates associated with the portion of the file system.

5. The method of claim 1, further comprising:

determining if a user that initiated execution of the program has sufficient permissions to access the portion of the file system in a manner necessary for execution of the program; and

if the user that initiated execution of the program does not have sufficient permissions to access the portion of the file system in the manner necessary, denying access by the executing program to the portion of the file system.

7. The method of claim 1, wherein the method is implemented each time the executing program requests access to the portion of the file system.

8. The method of claim 1, wherein determining if the executing program corresponds to an authorized certificate associated with the portion of the file system includes:

extracting a digital signature of the executing program; and

determining if the digital signature of the executing program maps to an authorized certificate associated with the portion of the file system.

6. (canceled)

9. A computer program product comprising a computer readable medium having a computer readable program recorded thereon for authorizing access to portions of a file system, comprising:

first instructions for receiving, from an executing program, a request to access a portion of the file system, the request including an identifier of the portion of the file system;

second instructions for retrieving, based on the identifier of the portion of the file system, authorized certificate information associated with the identifier of the portion of the file system, identifying authorized certificates of trusted parties that may be used to access the portion of the file system;

third instructions for determining if the executing program corresponds to an authorized certificate associated with the portion of the file system; and

fourth instructions for permitting access to the portion of the file system only if the executing program corresponds to the authorized certificate associated with the portion of the file system.

10. The computer program product of claim 9, wherein the portion of the file system is one of a file, a group of files, a directory, and a group of directories in the file system.

11. The computer program product of claim 9, wherein the portion of the file system is a registry file of the file system.

12. The computer program product of claim 9, further comprising:

fifth instructions for receiving a user selection of the portion of the file system;

sixth instructions for receiving a user selection of one or more certificates to be associated with the portion of the file system; and

seventh instructions for storing an identifier of the portion of the file system in association with one or more identifiers of the one or more certificates associated with the portion of the file system.

13. The computer program product of claim 9, further comprising:

fifth instructions for determining if a user that initiated execution of the program has sufficient permissions to access the portion of the file system in a manner necessary for execution of the program; and

sixth instructions for denying access by the executing program to the portion of the file system, if the user that initiated execution of the program does not have sufficient permissions to access the portion of the file system in the manner necessary.

14. The computer program product of claim 13, wherein the second, third and fourth instructions are executed only if the user that initiated the execution of the program has sufficient permissions to access the portion of the file system in the manner necessary.

15. The computer program product of claim 9, wherein the first, second, third and fourth instructions are executed each time the executing program requests access to the portion of the file system.

16. The computer program product of claim 9, wherein the third instructions for determining if the executing program corresponds to an authorized certificate associated with the portion of the file system include:

instructions for extracting a digital signature of the executing program; and

instructions for determining if the digital signature of the executing program maps to an authorized certificate associated with the portion of the file system.

17. A system for authorizing access to portions of a file system, comprising:

a processor; and

a data storage device coupled to the processor, wherein the data storage system has an associated file system, and wherein the processor;

receives, from an executing program, a request to access a portion of the file system, the request including an identifier of the portion of the file system,

retrieves, based on the identifier of the portion of the file system, authorized certificate information associated with the identifier of the portion of the file system, identifying authorized certificates of trusted parties that may be used to access the portion of the file system,

determines if the executing program corresponds to an authorized certificate associated with the portion of the file system, and

permits access to the portion of the file system only if the executing program corresponds to the authorized certificate associated with the portion of the file system.

18. The system of claim 17, wherein the processor receives a user selection of the portion of the file system, receives a user selection of one or more certificates to be associated with the portion of the file system, and stores an identifier of the portion of the file system in association with one or more identifiers of the one or more certificates associated with the portion of the file system in the data storage device.

19. The system of claim 17, wherein the processor determines if a user that initiated execution of the program has sufficient permissions to access the portion of the file system in a manner necessary for execution of the program, and denies access by the executing program to the portion of the file system, if the user that initiated execution of the program does not have sufficient permissions to access the portion of the file system in the manner necessary.

20. The system of claim 19, wherein the processor retrieves authorized certificate information associated with the identifier of the portion of the file system, determines if the executing program corresponds to an authorized certificate associated with the portion of the file system, and permits access to the portion of the file system only if the user that initiated the execution of the program has sufficient permissions to access the portion of the file system in the manner necessary.