Methods and systems for using derived user accounts

• US 8,875,281 B2
• Filed: 02/03/2014
• Issued: 10/28/2014
• Est. Priority Date: 11/01/2001
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Erlingsson, Ulfar
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US14/171,512
• Publication Number:
  US 20140150122A1
• Time in Patent Office: 267 Days
• Field of Search: 726/18, 713/193
• US Class Current: 726/18
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Methods, systems and articles of manufacture consistent with features of the present invention allow the generation and use of derived user accounts, or DUA, in a computer system comprising user accounts. In particular, derivation rules define how a DUA is linked to or created based on an existing original user account, or OUA. Derivation transformations may also update the state of a DUA based on its corresponding OUA or give feedback from the state of a DUA to the state of its corresponding OUA.

Claims

1. A computer-implemented method for accessing a resource in a computer system comprising an operating system, comprising:

receiving a request to access a file system or a registry value from an application;

determining if the application is running in a derived user account (DUA) context, wherein the DUA context represents a security context of a DUA that is derived from an original user account (OUA) associated with a user, and wherein the determining comprises examining an access token associated with the request to determine if the request is associated with the DUA;

if the application is not running in the DUA context, creating the DUA and directing the application to run in the DUA context; and

granting the application access to the file system or the registry value.

2. The computer-implemented method of claim 1, wherein creating the DUA comprises applying a derivation transformation to an OUA state of the OUA to generate a corresponding DUA state of the DUA.

3. The computer-implemented method of claim 1, wherein directing the application to run in the DUA context comprises modifying the access token to generate a modified access token and associating the application with the modified access token.

4. The computer-implemented method of claim 1, wherein creating the DUA comprises generating the DUA using a user account creation mechanism of the operating system.

5. The computer-implemented method of claim 1, wherein the DUA comprises different access rights than the OUA.

6. The computer-implemented method of claim 1, wherein creating the DUA comprises creating a copy of the file system or the registry value.

7. The computer-implemented method of claim 6, wherein the granting comprises granting the application access to the copy of the file system or the registry value.

8. The computer-implemented method of claim 1, wherein directing the application to run in the DUA context comprises annotating activity associated with the application as belonging to the DUA.

9. The computer-implemented method of claim 8, wherein annotating the activity associated with the application comprises annotating the activity associated with the application in a kernel thread control block or a kernel process control block.

10. An apparatus, comprising:

at least one memory having program instructions to execute an operating system; and

at least one processor configured to execute the program instructions to perform the operations of;

receiving a request to access a file system or a registry value from an application;

determining if the application is running in a derived user account (DUA) context, wherein the DUA context represents a security context of a DUA that is derived from an original user account (OUA) associated with a user, and wherein the determining comprises examining an access token associated with the request to determine if the request is associated with the DUA;

if the application is not miming in the DUA context, creating a DUA and directing the application to run in the DUA context; and

granting the application access to the file system or the registry value.

11. The apparatus of claim 10, wherein creating the DUA comprises applying a derivation transformation to an OUA state of the OUA to generate a corresponding DUA state of the DUA.

12. The apparatus of claim 10, wherein directing the application to run in the DUA context comprises modifying the access token to generate a modified access token and associating the modified access token with the application.

13. The apparatus of claim 10, wherein directing the application to run in the DUA context comprises annotating activity associated with the application as belonging to the DUA.

14. The apparatus of claim 13, wherein annotating the activity associated with the application comprises annotating the activity associated with the application in a kernel thread control block or a kernel process control block.

15. A non-transitory computer-readable medium containing computer-readable instructions enabling a computer to perform a method, the method comprising:

receiving a request to access a file system or a registry value from an application;

determining if the application is running in a derived user account (DUA) context, wherein the DUA context represents a security context of a DUA that is derived from an original user account (OUA) associated with a user, and wherein the determining comprises examining an access token associated with the request to determine if the request is associated with the DUA;

if the application is not running in the DUA context, creating the DUA and directing the application to run in the DUA context; and

granting the application access to the file system or the registry value.

16. The non-transitory computer-readable medium of claim 15, wherein creating the DUA comprises creating a copy of the file system or the registry value, and wherein the granting comprises granting the application access to the copy of the file system or the registry value.

17. The non-transitory computer-readable medium of claim 15, wherein creating the DUA comprises applying a derivation transformation to an OUA state of the OUA to generate a corresponding DUA state of the DUA.

18. The non-transitory computer-readable medium of claim 15, wherein directing the application to run in the DUA context comprises modifying the access token to generate a modified access token and associating the modified access token with the application.

19. The non-transitory computer-readable medium of claim 15, wherein directing the application to run in the DUA context comprises annotating activity associated with the application as belonging to the DUA.

20. The non-transitory computer-readable medium of claim 19, wherein annotating the activity associated with the application comprises annotating the activity associated with the application in a kernel thread control block or a kernel process control block.