Multi-user process based security system and method

• US 20040103096A1
• Filed: 08/05/2003
• Published: 05/27/2004
• Est. Priority Date: 02/01/2002
• Status: Abandoned Application

• Current Assignee: Systems Advisory Group Enterprises Incorporated
• Original Assignee: Systems Advisory Group Enterprises Incorporated
• Inventors: Larsen, Vincent Alan
• Application Number:
  US10/635,702
• Publication Number:
  US 20040103096A1
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A system and method for providing access for a user to resources receives user identification information and loads user resource access information associated with the user identification information including process resource access information associated with a process. The system executes processes where the process accesses resources. When the process accesses resources, the system checks the process resource access information when the process attempts to access a specified resource to determine if the access of the specified resource by the process is permitted and allows the process to access the specified resource if access is permitted or denies the process access to the specified resource if access is not permitted.

Claims

1. A method for providing access for a user to resources comprising the steps of:

receiving user identification information

loading user resource access information associated with the user identification information including process resource access information associated with a process;

executing a process wherein said process accesses resources;

checking the process resource access information when the process attempts to access a specified resource to determine if the access of the specified resource by the process is permitted;

allowing the process to access the specified resource if access permission is indicated; and

denying the process access to the specified resource if access permission is not indicated.

2. The method of providing access of claim 1, where said specified resource comprises a data file.

3. The method of providing access of claim 1, where said specified resources comprises an application file.

4. The method of providing access of claim 1, where said specified resource comprises a digital device.

5. The method of providing access of claim 1, further comprising the step of authenticating said received user identification information.

6. The method of providing access of claim 1, wherein said process resource access information includes a directory path, wherein the process has permission to access files stored in the directories designated by the directory path.

7. The method of providing access of claim 1, wherein said directory path includes a meta-symbol, such that a defined text string is substituted for the meta-symbol.

8. The method of providing access of claim 7, wherein said defined text string is a user identification text string.

9. The method of providing access of claim 1, wherein said process resource access information includes a second process identifier, wherein the process has permission to execute the second process designated by the second process identifier.

10. The method of providing access of claim 9, wherein said user resource access information includes second process resource access information.

11. The method of providing access of claim 1, wherein the step of checking is performed by an operating system.

12. A system for providing access to resources comprising;

a processor for executing a process;

a resource accessed by the processor when executing the process;

user resource access data associated with the process representing resource access permissions;

wherein said processor receives user identification data, wherein said user resource access data is associated with said user identification data, such that before said processor accesses said resource, the processor refers to the user resource access data associated with the process to determine if the process has permission to access the resource.

13. The system for providing access of claim 12, where said resource comprises a data file.

14. The system for providing access of claim 12, where said resource comprises a process.

15. The system for providing access of claim 12, where said resource comprises a digital device.

16. The system for providing access of claim 12, further comprising an authentication agent to authenticate the user identification information.

17. The system for providing access of claim 12, wherein said user resource access data includes a directory path, wherein the process has permission to access files stored in the directories designated by the directory path.

18. The system for providing access of claim 17, wherein said directory path includes a meta-symbol, such that a defined text string is substituted for the meta-symbol.

19. The system for providing access of claim 18, wherein said defined text string is a user identification text string.

20. The system for providing access of claim 12, wherein said user resource access data includes a second process identifier, wherein the process has permission to execute the second process designated by the second process identifier.

21. The system for providing access of claim 20, wherein said user resource access data includes second process resource access information.