Information processing method, apparatus, and system for controlling computer resources, control method therefor, storage medium, and program

• US 7,607,131 B2
• Filed: 11/19/2001
• Issued: 10/20/2009
• Est. Priority Date: 11/20/2000
• Status: Active Grant

• Current Assignee: Humming Heads, Inc.
• Original Assignee: Humming Heads, Inc.
• Inventors: Shima, Takahiro, Oe, Naoyuki
• Primary Examiner(s): Donaghue; Larry D
• Assistant Examiner(s): Gillis; Brian J
• Application Number:
  US09/988,106
• Publication Number:
  US 20020099837A1
• Time in Patent Office: 2,892 Days
• Field of Search: 709/225, 709/229, 709/216, 707/9, 718/105, 718/102, 726/27, 726/29
• US Class Current: 718/102
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

An operation request from a process or OS for computer resource(s) managed by the OS, such as a file, network, storage device, display screen, or external device, is trapped before access to the computer resource. It is determined whether an access right for the computer resource designated by the trapped operation request is present. If the access right is present, the operation request is transferred to the operating system, and a result from the OS is returned to the request source process. If no access right is present, the operation request is denied, or the request is granted by charging in accordance with the contents of the computer resource.

Claims

1. An information processing method of controlling access to computer storage, display, recording and other resources managed by an operating system in a computer, the method being implemented by a specific resource management program located between the operating system and an application, the method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by the operating system, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

an interception step of intercepting an access request for a first computer resource from a process, before the access request is transferred to the operating system;

a monitoring step of monitoring all the basic operations for accessing computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

a cancellation step of, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

a determination step of;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first computer resource which, when considered together, is consistent with one of the access rights, and

determining whether the process is allowed to access the first computer resource based on the examination result;

a processing step of, if it is determined in the determination step that the process is allowed to access the first computer resource, transferring the access request to the operating system and returning a result from the operating system to the process; and

a denial step of denying the access request, if it is determined in the determination step that the process is not allowed to access the first computer resource.

2. The method according to claim 1, wherein the access right information designates an access right that is extended but not defined in an existing environment.

3. The method according to claim 2, wherein the access right information contains information that designates at least one of a right to move to another medium, a right to copy to another medium, a right to print, a right to write to a shared memory, a right to capture a screen, and a right to restrict use processes.

4. The method according to claim 1, wherein in the denial step, an access denial error message is returned to the process without any access to the requested computer resource.

5. The method according to claim 1, wherein in the denial step, a successful access message is returned to the process without any access to the requested computer resource.

6. The method according to claim 1, wherein in the denial step, the access request is converted into an access request for a dummy computer resource and transferred to the operating system, and a result from the operating system is returned to the process.

7. The method according to claim 1, wherein the interception step further comprises intercepting an access request from the operating system before access to a computer resource.

8. An information processing apparatus for controlling access to computer storage, display, recording and other resources managed by an operating system in a computer, the information processing apparatus comprising hardware controlled by a specific resource management program located between the operating system and an application, the apparatus comprising:

a management table stored in a storage medium, wherein the management table provides, for each computer resource managed by the operating system, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

interception means for intercepting an access request for a first computer resource from a process before the access request is transferred to the operating system;

monitoring means for monitoring all the basic operations for accessing computer resources;

registration means for, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

cancellation means for, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

determination means for;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first computer resource which, when considered together, is consistent with one of the access rights, and

determining whether process is allowed to access the first computer resource based on the examination result;

processing means for, if it is determined by the determination means that the process is allowed to access the first computer resource, transferring the access request to the operating system and returning a result from the operating system to the process; and

denial means for denying the access request if it is determined by the determination means that the process is not allowed to access the first computer resource.

9. The apparatus according to claim 8, wherein the access right information designates an access right that is extended but not defined in an existing environment.

10. The apparatus according to claim 9, wherein the access right information contains information that designates at least one of a right to move to another medium, a right to copy to another medium, a right to print, a right to write to a shared memory, a right to capture a screen, and a right to restrict use processes.

11. The apparatus according to claim 8, wherein the denial means returns an access denial error message to the process without any access to the requested computer resource.

12. The apparatus according to claim 8, wherein the denial means returns a successful access message to the process without any access to the requested computer resource.

13. The apparatus according to claim 8, wherein the denial means converts the access request into an access request for a dummy computer resource, transfers the access request to the operating system, and returns a result from the operating system to the process.

14. The apparatus according to claim 8, wherein the interception means further comprises intercepting an access request from the operating system before access to a computer resource.

15. A storage medium which stores a program for causing a computer to control access to computer storage, display, recording and other resources managed by an operating system in a computer, wherein said program implements a specific resource management method and is located between the operating system and an application, said method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by the operating system, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

an interception step of intercepting an access request for a first computer resource from a process, before the access request is transferred to the operating system;

a monitoring step of monitoring all the basic operations for accessing computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

a cancellation step of, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

a determination step of;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first computer resource which, when considered together, is consistent with one of the access rights,

and

determining whether the process is allowed to access the first computer resource based on the examination result;

a processing step of, if it is determined in the determination step that the process is allowed to access the first computer resource, transferring the access request to the operating system and returning a result from the operating system to the process; and

a denial step of denying the access request, if it is determined in the determination step that the process is not allowed to access the first computer resource.

16. The medium according to claim 15, wherein in the determination step, it is determined whether the access right is present by looking up an access right management table containing resource designation information that designates a specific computer resource, condition information under which the access right is validated, and access right information that designates an access right that is extended but not defined in an existing environment.

17. The medium according to claim 16, wherein the access right information contains information that designates at least one of a right to move to another medium, a right to copy to another medium, a right to print, a right to write to a shared memory, a right to capture a screen, and a right to restrict use processes.

18. The medium according to claim 15, wherein in the denial step, an access denial error message is returned to the process without any access to the requested computer resource.

19. The medium according to claim 15, wherein in the denial step, a successful access message is returned to the process without any access to the requested computer resource.

20. The medium according to claim 15, wherein in the denial step, the access request is converted into an access request for a dummy computer resource and transferred to the operating system, and a result from the operating system is returned to the process.

21. The medium according to claim 15, wherein if it is determined in the determination step that no access right is present, and access is denied in the denial step, an access right is permitted by inputting charging information.

22. The medium according to claim 15, wherein the computer resource includes contents of a Web cast, digital broadcasting, and music distribution.

23. The medium according to claim 15, wherein the interception step further comprises intercepting an access request from the operating system before access to a computer resource.

24. An information processing system comprising first and second terminals connected through a communication network, the first and the second terminals being controlled by a specific resource management program located between an operating system, which manages computer storage, display, recording and other resources, and an application for each terminal, wherein

the first terminal comprises:

interception means for intercepting an access request for a first computer resource of the second terminal from a process in the first terminal, before the computer resource of the second terminal is accessed via an operating system of the first terminal

monitoring means for monitoring all the basic operations for accessing computer resources;

registration means for, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium

cancellation means for, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource; and

transmitting means for transmitting the access request intercepted by the interception means to the second terminal; and

the second terminal comprises;

storing means for storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by the operating system of the second terminal, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

receiving means for receiving the access request intercepted by the interception means of the first terminal;

determination means for;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first-computer resource which, when considered together, is consistent with one of the access rights,

and

determining whether the process is allowed to access the first computer resource based on the examination result;

processing means for, if it is determined by the determination means that the process is allowed to access the first computer resource, transferring the access request to the operating system in the first terminal and returning a result from the operating system to the process in the first terminal; and

denial means for denying the access request if it is determined by the determination means that the process is not allowed to access the first computer resource.

25. A control method for an information processing system constituted by connecting first and second terminals through a communication network, the first and the second terminals being controlled by a specific resource management program located between an operating system, which manages computer storage, display, recording and other resources, and an application for each terminal, the method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by an operating system of the second terminal, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

an interception step of intercepting an access request for a first computer resource of the second terminal from a process in the first terminal, before the computer resource of the second terminal is accessed via an operating system of the first terminal

a monitoring step of monitoring all the basic operations for accessing computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

a cancellation step of, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

a determination step of;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first computer resource which, when considered together is consistent with one of the access rights,

and

determining whether the process is allowed to access the first computer resource based on the examination result;

a processing step of, if it is determined in the determination step that the process is allowed to access the first computer resource, transferring the access request to the operating system in the first terminal and returning a result from the operating system to the process in the first terminal; and

a denial step of denying the access request if it is determined in the determination step that the process is not allowed access to the first computer resource.

26. A storage medium which stores a program for causing a computer to control an information processing system constituted by connecting first and second terminals through a communication network, wherein said program implements a resource management method and is located between an operating system, which manages computer storage, display, recording and other resources, and an application for each terminal, said method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by an operating system of the second terminal, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

an interception step of intercepting an access request for a first computer resource of the second terminal from a process in the first terminal, before the computer resource of the second terminal is accessed via an operating system of the first terminal;

a monitoring step of monitoring all the basic operations for accessing computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

a cancellation step of, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

a determination step of;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of operations associated with the process and the first computer resource which, when considered together, is consistent with one of the access rights,

and

determining whether the process is allowed to access the first computer resource based on the examination result;

a processing step of, if it is determined in the determination step that the process is allowed to access the first computer resource, transferring the access request to the operating system in the first terminal and returning a result from the operating system to the process in the first terminal; and

a denial step of denying the operation request if it is determined in the determination step that the process is not allowed to access the first computer resource.

27. An information processing apparatus connected to a terminal through a communication network, the information processing apparatus and the terminal being controlled by a specific resource management program located between an operating system, which manages computer storage, display, recording and other resources, and an application for each of the information processing apparatus and the terminal, the apparatus comprising:

a memory;

a management table stored in the memory, providing, for each computer resource managed by the operating system of the terminal, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

interception means for intercepting an access request for a first computer resource of the terminal from a process, before the computer resource of the terminal is accessed via an operating system of the information processing apparatus;

monitoring means for monitoring all the basic operations for accessing computer resources;

registration means for, when the process secures access to the first computer resource, for registering a correspondence between the process and the first computer resource in the memory;

cancellation means for, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

transmitting means for transmitting the access request intercepted by the interception means to the terminal; and

receiving means for receiving a reply to the access request from the terminal,

wherein the terminal;

retrieves access right information of the computer resource from the first management table;

examines the monitoring result to see whether there is a series of basic operations associated with the process and the first-computer resource which, when considered together, is consistent with one of the access rights,

and

determines whether the process is allowed to access the first computer resource based on the examination result,

wherein the receiving means receives a determination result determined by the terminal as the reply.

28. An information processing apparatus connected to a terminal through a communication network, the information processing apparatus comprising hardware, and the information processing apparatus and the terminal being controlled by a specific resource management program located between an operating system, which manages computer storage, display, recording and other resources, and an application for each of the information processing apparatus and the terminal, the apparatus comprising:

storing means for storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by an operating system of the information processing apparatus, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

receiving means for receiving an access request for a first computer resource of the information processing apparatus from a process of the terminal, intercepted by the terminal, before the first computer resource of the information processing apparatus is accessed via an operating system of the information processing apparatus;

monitoring means for monitoring all the basic operations for accessing computer resources;

registration means for, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

cancellation means for, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

determination means for;

retrieving access right information of the first computer resource from the management table,

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first-computer resource which, when considered together, is consistent with one of the access rights,

and

determining whether the process is allowed to access the first computer resource based on the examination result;

processing means for, if it is determined by the determination means that the process has is allowed to access the first computer resource, transferring the access request to the operating system in the terminal and returning a result to a process in the terminal; and

denial means for denying the access request if it is determined by the determination means that the process is not allowed to access the first computer resource.

29. An information processing method for an information processing apparatus connected to a terminal through a communication network, the information processing apparatus and the terminal being controlled by a specific resource management program located between an operating system, which manages computer storage, display, recording and other resources, and an application for each of the information processing apparatus and the terminal, the method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by the operating system of the terminal, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

an interception step of intercepting an operation request for a first computer resource of the terminal from a process, before the computer resource of the terminal is accessed via an operating system of the information processing apparatus;

a monitoring step of monitoring all the basic operations for accessing computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium

a cancellation step of, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

a transmitting step of transmitting the access request intercepted in the interception step to the terminal;

a receiving step of receiving a reply to the access request from the terminal,

wherein the terminal;

retrieves access right information of the first computer resource from the management table,

examines the monitoring result to see whether there is a series of basic operations associated with the process and the first computer resource which, when considered together, is consistent with one of the access rights,

and

determines whether the process is allowed to access the first computer resource based on the examination result,

wherein in the receiving step, a determination result determined by the terminal is received as the reply.

30. An information processing method for an information processing apparatus connected to a terminal through a communication network, the information processing apparatus and the terminal being controlled by a specific resource management program located between an operating system, which manages computer storage, display, recording and other resources, and an application for each of the information processing apparatus and the terminal, the method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by an operating system of the information processing apparatus, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

a receiving step of receiving an access request for a first computer resource of the information processing apparatus from a process of the terminal, intercepted by the terminal, before the computer resource of the information processing apparatus is accessed via an operating system of the information processing apparatus;

a monitoring step of monitoring all the basic operations for access computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

a cancellation step of, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

a determination step of;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first-computer resource which, when considered together, is consistent with one of the access rights,

and

determining whether the process is allowed to access the first computer resource based on the examination result;

a processing step of, if it is determined in the determination step that the process is allowed to access the first computer resource, transferring the access request to the operating system in the terminal and returning a result to a process in the terminal; and

a denial step of denying the operation request if it is determined in the determination step that the process is not allowed to access the first computer resource.

31. A storage medium which stores a program for controlling an information processing apparatus connected to a terminal through a communication network, said program implements a resource management method and is located between an operating system, which manages computer storage, display, recording and other resources, and an application for each the information processing apparatus and the terminal, said method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by the operating system of the terminal, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

an interception step of intercepting an access request for a first computer resource of the terminal from a process, before the computer resource of the terminal is accessed via an operating system of the information processing apparatus;

a monitoring step of monitoring all the basic operations for accessing computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

a cancellation step of, when the process releases the first computer resource, cancelling the correspondence between the process and the first computer resource;

a transmitting step of transmitting the access request intercepted in the interception step to the terminal;

a receiving step of receiving a reply to the access request from the terminal,

wherein the terminal;

retrieves access right information of the first computer resource from the management table;

examines the monitoring result to see whether there is a series of basic operations associated with the process and the first-computer resource which, when considered together, is consistent with one of the access rights,

and

determines whether the process is allowed to access the first computer resource based on the examination result,

wherein in the receiving step, a determination result determined by the terminal is received as the reply.

32. A storage medium which stores a program for controlling an information processing apparatus connected to a terminal through a communication network, said program implements a resource management method and is located between an operating system, which manages computer storage, display, recording and other resources, and an application for each of the information processing apparatus and the terminal, said method comprising:

a storing step of storing a management table in a storage medium, wherein the management table provides, for each computer resource managed by an operating system of the information processing apparatus, access right information comprising access rights, each represented by a series of basic operations for accessing computer resources, and conditions under which the access rights are validated;

a receiving step of receiving an access request for a first computer resource of the information processing apparatus from a process of the terminal, intercepted by the terminal, before the computer resource of the information processing apparatus is accessed via an operating system of the information processing apparatus;

a monitoring step of monitoring all the basic operations for accessing computer resources;

a registration step of, when the process secures access to the first computer resource, registering a correspondence between the process and the first computer resource in a storage medium;

a cancellation step of, when the process releases the first computer resources, cancelling the correspondence between the process and the first computer resources;

a determination step of;

retrieving access right information of the first computer resource from the management table;

examining the monitoring result to see whether there is a series of basic operations associated with the process and the first-computer resource which, when considered together, is consistent with one of the access rights,

and

determining whether the process is allowed to access the first computer resource based on the examination result;

a processing step of, if it is determined in the determination step that the process is allowed to access the first computer resource, transferring the access request to the operating system in the terminal and returning a result to a process in the terminal; and

a denial step of denying the operation request if it is determined in the determination step that the process is not allowed to access the first computer resource.