System and method for recovering a security profile of a computer system

• US 20020095593A1
• Filed: 01/12/2001
• Published: 07/18/2002
• Est. Priority Date: 01/12/2001
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Daigle, Brian K., Frank, Mitchell R., Daniell, William T., Sevounts, Gary
• Granted Patent: US 7,181,618 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A system for recovering previously activated security profiles utilizes memory and a security application. Initially, the security application enables a user to define a first security profile. After defining the first security profile, the user submits a request for activating the first security profile, and in response, the security application modifies a machine state of the computer system. The modification of the machine state in response to this request locks down the computer system, thereby implementing the first security profile defined by the user. Also in response to the request for activating the first security profile, the security application stores, in the memory, data indicative of the machine state so that the first security profile can be again implemented at a later time, if desired. In this regard, after causing a different security profile to be implemented by the computer system, a user may submit a request for changing the security profile of the computer system back to the first security profile. In response to such a request, the security application retrieves the data previously stored in the memory and automatically modifies the machine state so that the first security profile is again implemented by the computer system. As a result, any changes made to the security profile of the computer system since the submission of the aforementioned request for activating the first security profile are effectively nullified.

Claims

1. A computer system comprising:

memory; and

a security application configured to lock down resources of said computer system by modifying a machine state of said computer system in response to a request for activating a first security profile, said security application configured to store data indicative of said machine state in said memory in response to said request for activating said first security profile, said security application configured to modify said machine state in response to a request for activating a second security profile, said security application configured to retrieve said data in response to a request for recovering said first security profile and to modify said machine state based on said retrieved data.

2. The system of claim 1, wherein said security application includes default data defining default levels of security, wherein said security application enables a user to select one of said default levels of security, and wherein said security application is configured to modify said machine state in response to said request for activating said first security profile based on said selected default level of security.

3. The system of claim 2, wherein said security application defines a plurality of rules for locking down said computer system, wherein said security application configured to enable ones of said rules based on which of said default levels is selected by said user, and wherein said security application is further configured to cause said computer system to enforce each enabled rule within said plurality of rules by modifying said machine state in response to said request for activating said first security profile.

4. The system of claim 3, wherein said security application enables said user to change which of said rules are enabled.

5. A computer system, comprising:

memory; and

a security application defining a plurality of rules, said security application configured to enable a user to select a set of said rules for enforcement by said computer system, said security application configured to lock down said computer system by causing said computer system to enforce said selected set of rules in response to an activation request, said security application further configured to store data identifying said selected set in response to said activation request, said security application configured to change which of said plurality of rules are enforced by said computer system based on inputs to said computer system, said security application configured to retrieve said data in response to a user request and to automatically identify said set of rules based on said retrieved data, said security application further configured to cause said computer system to enforce said identified rules in response to said user request.

6. The system of claim 5, wherein said security application is further configured to define multiple sets of default data, each of said sets of default data identifying different ones of said rules as being enabled for enforcement, said security application configured to enable said user to select one of said sets of default data and to determine which of said rules are selected for inclusion into said selected set of rules based on which of said rules are indicated as enabled.

7. The system of claim 6, wherein said security application enables said user to change which of said rules are indicated as being enabled.

8. A computer system comprising:

means for storing data; and

means for locking down resources of said computer system by modifying a machine state of said computer system in response to a request for activating a first security profile, said locking down means including a means for storing security profile data indicative of said machine state in said memory in response to said request for activating said first security profile, said locking down means including a means for modifying said machine state in response to a request for activating a second security profile, said locking down means including a means for retrieving said security profile data in response to a request for recovering said first security profile and for modifying said machine state based on said retrieved data.

9. A method for locking down resources of a computer system, comprising the steps of:

receiving a request for activating a first security profile;

modifying a machine state of said computer system in response to said request for activating said first security profile;

storing data indicative of said machine state in response to said request for activating said first security profile;

modifying said machine state in response to a request for activating a second security profile;

retrieving said data in response to a request for recovering said first security profile; and

modifying said machine state based on said retrieved data in response to said request for recovering said first security profile.

10. The method of claim 9, further comprising the steps of defining default levels of security;

and

selecting one of said default levels of security,

wherein said modifying step that is performed in response to said request for activating said first security profile is based on said selecting step.

11. The method of claim 10, further comprising the steps of:

defining a plurality of rules for locking down said computer system;

associating each of said default levels of security with different ones of said rules;

enabling ones of said rules based on which of said rules are associated, via said associating step, with said default level selected in said selecting step; and

enforcing each of said rules enabled via said enabling step based on said machine state as modified via said modifying step that is performed in response to said request for activating said first security profile.

12. The method of claim 11, further comprising the step of:

enabling a user to change which of said rules are enabled.

14. The method of claim 13, further comprising the steps of:

defining multiple sets of default data, each of said sets of default data identifying different ones of said rules as being enabled; and

selecting one of said sets of default data,

wherein said selecting a set of said rules step is further based on which of said sets of default data is selected via said selecting one of said sets of default data step.

13. A method for locking down resources of a computer system, comprising the steps of:

defining a plurality of rules for locking down said computer system;

receiving an input from a user of said computer system;

selecting a set of said rules based on said input;

causing said computer system to enforce said selected set of rules in response to an activation request;

storing data identifying said selected set of rules in response to said activation request;

changing which of said plurality of rules are enforced by said computer system;

retrieving said data in response to a user request;

automatically identifying said selected set of rules based on said retrieved data, and

causing said computer system to enforce said selected set of rules in response to said user request.