Method and system for implementing mandatory file access control in native discretionary access control environments

• US 8,087,065 B2
• Filed: 02/08/2007
• Issued: 12/27/2011
• Est. Priority Date: 11/17/2006
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Tirosh, Oren, Werner, Eran
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US11/703,778
• Publication Number:
  US 20080120695A1
• Time in Patent Office: 1,783 Days
• Field of Search: 726/3, 726/9, 726/15, 713/151, 713/164
• US Class Current: 726/3
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method is provided for implementing a mandatory access control model in operating systems which natively use a discretionary access control scheme. A method for implementing mandatory access control in a system comprising a plurality of computers, the system comprising a plurality of information assets, stored as files on the plurality of computers, and a network communicatively connecting the plurality of computers, wherein each of the plurality of computers includes an operating system that uses a discretionary access control policy, and wherein each of a subset of the plurality of computers includes a software agent component operable to perform the steps of intercepting a request for a file operation on a file from a user of one of the plurality of computers including the software agent, determining whether the file is protected, if the file is protected, altering ownership of the file from the user to another owner, and providing access to the file based on a mandatory access control policy.

Claims

1. A method for implementing mandatory access control in a system comprising a plurality of computers, the system comprising a plurality of information assets, stored as files on the plurality of computers, and a network communicatively connecting the plurality of computers, wherein each of the plurality of computers includes an operating system that uses a discretionary access control policy, and wherein each of a subset of the plurality of computers includes a software agent component operable to perform the steps of:

intercepting a request for a file operation on a file from a user of one of a plurality of computers including a software agent;

determining whether the file is protected based on a mandatory access control policy;

determining whether the file is on storage local to or remote from the computer from which the request for the file operation occurred; and

providing access to the file based on the mandatory access control policy wherein providing access to the file comprises;

if the file is protected and on local storage;

altering ownership of the file from the user to another owner;

setting an access control list of the file based on the mandatory access control policy; and

if the file is protected and on remote storage;

setting an access control list of the file to allow another owner to take ownership of the file;

reopening the file using permissions of the other owner;

setting ownership of the file to the other owner; and

setting an access control list of the file based on the mandatory access control policy.

2. The method of claim 1, wherein the requested file operation is at least one of creating the file, writing to the file, or closing the file.

3. The method of claim 1, wherein the step of setting the access control list of the file if the file is protected and on local storage comprises the step of:

setting the access control list of the file so as to prevent a user from accessing the file from a computer that does not include the software agent component.

4. The method of claim 1, wherein if the file is protected and on remote storage, the other owner is an account associated with a requesting computer from which the request for the file operation occurred.

5. The method of claim 4, wherein the software agent component accesses the account associated with the requesting computer through a login session already associated with the requesting computer.

6. The method of claim 4, wherein the other owner is a separate account for which the agent provides login information and creates a login session.

7. The method of claim 4, further comprising the steps of:

intercepting a request for a file read operation on a file from a user of one of the plurality of computers including the software agent;

altering the read request; and

performing the altered read request using a login session not associated with the user.

8. The method of claim 7, wherein the login session is established by the software agent component using login information associated with the other owner.

9. The method of claim 4, further comprising the steps of:

intercepting a request for a file read operation on a file from a user of one of the plurality of computers including the software agent;

altering the read request; and

performing the altered read request using another login session associated with the user, but having a different set of group memberships than a login session used to request the file read operation.

10. The method of claim 9, wherein the other login session does not have membership in at least one group to which the login session belongs.

11. The method of claim 10, further comprising the steps of:

removing a group membership of a user account;

forming a login session for the user account; and

restoring the group membership of the user account.

12. The method of claim 1, further comprising the steps of:

intercepting an attempt to modify an access control list of a file; and

allowing the modification based on a criterion.

13. The method of claim 12, further comprising the step of:

altering a parameter of the attempt to modify an access control list of a file.

14. The method of claim 1, wherein intercepting the request for the file operation includes intercepting system calls from user processes to an operating system and altering parameters and results of the system calls, utilizing the software agent.

15. A computer program product embodied on a non-transitory computer readable medium, the computer program product comprising a software agent for implementing a mandatory access control in a system comprising a plurality of computers, wherein each of the plurality of computers includes an operating system that uses a discretionary access control policy, and wherein each of a subset of the plurality of computers includes the software agent component, the computer readable medium comprising:

computer code for intercepting a request for a file operation on a file from a user of one of a plurality of computers including the software agent;

computer code for determining whether the file is protected based on a mandatory access control policy;

computer code for determining whether the file is on storage local to or remote from the computer from which the request for the file operation occurred; and

computer code for providing access to the file based on a mandatory access control policy;

wherein the computer code is operable such that providing access to the file includes;

if the file is protected and on local storage;

altering ownership of the file from the user to another owner;

setting an access control list of the file based on the mandatory access control policy; and

if the file is protected and on remote storage;

setting an access control list of the file to allow another owner to take ownership of the file;

reopening the file using permissions of the other owner;

setting ownership of the file to the other owner; and

setting an access control list of the file based on the mandatory access control policy.

16. A system, comprising:

a processor for executing a software agent component, the software agent component for implementing a mandatory access control in a system comprising a plurality of computers, wherein each of the plurality of computers includes an operating system that uses a discretionary access control policy, and wherein each of a subset of the plurality of computers includes the software agent component, the software agent component configuring the processor to;

intercept a request for a file operation on a file from a user of one of a plurality of computers including a software agent;

determine whether the file is protected based on a mandatory access control policy;

determine whether the file is on storage local to or remote from the computer from which the request for the file operation occurred; and

provide access to the file based on the mandatory access control policy wherein the act of providing access to the file comprises;

if the file is protected and on local storage;

altering ownership of the file from the user to another owner; and

setting an access control list of the file based on the mandatory access control policy;

if the file is protected and on remote storage;

setting an access control list of the file to allow another owner to take ownership of the file;

reopening the file using permissions of the other owner;

setting ownership of the file to the other owner; and

setting an access control list of the file based on the mandatory access control policy.