System for and methods of controlling user access and/or visibility to directories and files of a computer

• US 9,165,160 B1
• Filed: 02/10/2014
• Issued: 10/20/2015
• Est. Priority Date: 02/04/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Hopto Inc.
• Inventors: Tidd, William
• Primary Examiner(s): NGUYEN, CAM LINH T
• Application Number:
  US14/176,895
• Time in Patent Office: 617 Days
• Field of Search: 707/694, 707/783
• US Class Current: 1/1
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A system includes a file access manager driver and a kernel file system driver stack in a kernel-mode address space of an operating system (OS). The system also includes session processes, a public file whitelist; a public file whitelist manager; a user/group file whitelist, which is a private whitelist; and a user/group file whitelist manager in a user-mode address space of the OS. A method includes receiving a request for access and/or visibility to a directory and/or file and then determining whether the request is allowed to execute based on whether the file access manager driver identifies that the directory and/or file is allowed in either public or private whitelists.

Claims

1. A method for controlling user access to directories and files of a computer, the method comprising:

storing a plurality of file whitelists in memory, wherein each file whitelist identifies one or more users and one or more files accessible by the users;

executing instructions stored in memory, wherein execution of the instructions by a processor;

determines that an administrator has performed an act of publishing one or more previously unpublished files, wherein the act of publishing specifies that the previously unpublished files are to be published to one or more users, and

identifies which of the plurality of file whitelists are associated with the specified users; and

automatically adding, based on the act of publishing to the specified users, the previously unpublished files to one or more file whitelists identified as being associated with the specified users, wherein the identified file whitelists are updated with the previously unpublished files.

2. The method of claim 1, wherein the stored file whitelists comprise file whitelists specific to a single user.

3. The method of claim 1, wherein the stored file whitelists comprise file whitelists specific to a group of one or more users.

4. The method of claim 1, wherein the stored file whitelists comprise a public file whitelist that identifies files accessible to all users.

5. The method of claim 1, wherein the stored file whitelists comprise at least one file whitelist that identifies the associated one or more files as a directory of files.

6. The method of claim 1, wherein the stored file whitelists comprise at least one file whitelist that identifies the associated one or more files by reference to a blacklist of restricted files, wherein the associated one or more files are identified as files not on the blacklist.

7. The method of claim 1, wherein the specified one or more users are identified by reference to a group of one or more users, and wherein the identified file whitelists are specific to the group.

8. The method of claim 7, further comprising identifying file whitelists specific to each user in the group and automatically adding the previously unpublished files to the identified file whitelists specific to each user in the group.

9. An apparatus for controlling user access to directories and files of a computer, the apparatus comprising:

memory for storing a plurality of file whitelists, wherein each file whitelist identifies one or more users and one or more files accessible by the users;

a processor for executing instructions stored in memory, wherein execution of the instructions by the processor;

determines that an administrator has performed an act of publishing one or more previously unpublished files, wherein the act of publishing specifies that the previously unpublished files are to be published to one or more users, and

identifies which of the plurality of file whitelists are associated with the specified users,

wherein the one or more file whitelists identified as being associated with the specified users stored in memory are updated by automatic addition, based on the act of publishing to the specified users, of the previously unpublished files.

10. The apparatus of claim 9, wherein the stored file whitelists comprise file whitelists specific to a single user.

11. The apparatus of claim 9, wherein the stored file whitelists comprise file whitelists specific to a group of one or more users.

12. The apparatus of claim 9, wherein the stored file whitelists comprise a public file whitelist that identifies files accessible to all users.

13. The apparatus of claim 9, wherein the stored file whitelists comprise at least one file whitelist that identifies the associated one or more files as a directory of files.

14. The apparatus of claim 9, wherein the stored file whitelists comprise at least one file whitelist that identifies the associated one or more files by reference to a blacklist of restricted files, wherein the associated one or more files are identified as files not on the blacklist.

15. The apparatus of claim 9, wherein the specified one or more users are identified by reference to a group of one or more users, and wherein the identified file whitelists are specific to the group.

16. The apparatus of claim 15, wherein the processor executes further instructions to identify file whitelists specific to each user in the group and automatically add the previously unpublished files to the identified file whitelists specific to each user in the group.

17. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for controlling user access to directories and files of a computer, the method comprising:

storing a plurality of file whitelists, wherein each file whitelist identifies one or more users and one or more files accessible by the users;

determining that an administrator has performed an act of publishing one or more previously unpublished files, wherein the act of publishing specifies that the previously unpublished files are to be published to one or more users;

identifying which of the plurality of file whitelists are associated with the specified users; and

automatically adding, based on the act of publishing to the specified users, the previously unpublished files to one or more file whitelists identified as being associated with the specified users, wherein the identified file whitelists are updated with the previously unpublished files.