System for and methods of controlling user access and/or visibility to directories and files of a computer

• US 8,688,734 B1
• Filed: 02/06/2012
• Issued: 04/01/2014
• Est. Priority Date: 02/04/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Hopto Inc.
• Inventors: Tidd, William
• Primary Examiner(s): NGUYEN, CAM LINH T
• Application Number:
  US13/367,239
• Time in Patent Office: 785 Days
• Field of Search: 707/694, 707/783
• US Class Current: 707/783
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A system includes a file access manager driver and a kernel file system driver stack in a kernel-mode address space of an operating system (OS). The system also includes session processes, a public file whitelist; a public file whitelist manager; a user/group file whitelist, which is a private whitelist; and a user/group file whitelist manager in a user-mode address space of the OS. A method includes receiving a request for access and/or visibility to a directory and/or file and then determining whether the request is allowed to execute based on whether the file access manager driver identifies that the directory and/or file is allowed in either public or private whitelists.

Claims

1. A method for controlling user access to directories and files of a computer, the method comprising:

receiving an user/group file whitelist, wherein the received user/group file whitelist is stored in a data storage medium and comprises published directories and/or files associated with a group of one or more users;

determining that an administrator has performed an act of publishing one or more previously unpublished directories and/or files, wherein the act of publishing specifies that the previously unpublished directories and/or files are to be published to the group of one or more users that is associated with the stored user/group file whitelist;

authenticating a user as belonging to the specified group of one or more users to whom the previously unpublished directories and/or files are published; and

automatically adding, based on the act of publishing to the specified group, the previously unpublished directories and/or files to the stored user/group file whitelist, wherein the stored user/group file whitelist in the data storage medium is updated with the previously unpublished directories and/or files.

2. The method of claim 1, further comprising restricting the specified group of one or more users from viewing the previously unpublished directories and/or files prior to publication;

and allowing the specified group of one or more users to run one or more processes in the previously unpublished directories and/or files after publication.

3. The method of claim 1, further comprising storing a public file whitelist in the data storage medium and automatically denying user access to directories and/or files that are not in the public file whitelist.

4. The method of claim 1, further comprising bringing the user/group file whitelist into a kernel-mode address space.

5. The method of claim 1, wherein the specified group is associated with a blacklist comprising one or more directories and/or files that are not allowed to be accessed or viewed by the specified group.

6. The method of claim 1, further comprising reading the stored user/group file whitelist into a searchable data structure.

7. The method of claim 6, wherein the searchable data structure comprises an array list.

8. An apparatus for controlling user access to directories and files of a computer, comprising:

a communication network for receiving an user/group file whitelist comprising published directories and/or files associated with a group of one or more users;

a data storage medium for storing the received user/group file whitelist; and

a processor for executing instructions stored in memory, wherein the execution of the instructions by the processor;

determines that an administrator has performed an act of publishing one or more previously unpublished directories and/or files, wherein the act of publishing specifies that the previously unpublished directories and/or files are to be published to the group of one or more users that is associated with the user/group file whitelist;

authenticates a user as belonging to the specified group of one or more users to whom the previously unpublished directories and/or files are published; and

automatically adds, based on the act of publishing to the specified group, the previously unpublished directories and/or files to the user/group file whitelist, wherein the stored user/group file whitelist in the data storage medium is updated with the previously unpublished directories and/or files.

9. The apparatus of claim 8, wherein the processor further restricts the specified group of one or more users from viewing the previously unpublished directories and/or files prior to publication, and allows the specified groups of one or more users to run one or more processes in the previously unpublished directories and/or files after publication.

10. The apparatus of claim 8, wherein the data storage medium further stores a public file whitelist, and wherein the processor automatically denies user access to one or more of directories and/or files that are not in the public file whitelist.

11. The apparatus of claim 8, wherein data storage medium further stores user data of the authenticated user and wherein the user/group file whitelist is stored in association with the user data of the authenticated user.

12. The apparatus of claim 8, wherein the data storage medium further stores a blacklist associated with the specified group, the blacklist comprising one or more directories and/or files that are not allowed to be accessed by members of the specified group.

13. The apparatus of claim 8, wherein the user/group file whitelist is read into a searchable data structure in the data storage medium.

14. The method of claim 13, wherein the searchable data structure comprises an array list in the data storage medium.

15. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to perform a method for controlling user access to directories and files of a computer, the method comprising:

receiving an user/group file whitelist, wherein the received user/group file whitelist comprises directories and/or files associated with a group of one or more users;

determining that an administrator has performed an act of publishing one or more previously unpublished directories and/or files, wherein the act of publishing specifies that the previously unpublished directories and/or files are to be published to the group of one or more users that is associated with the stored user/group file whitelist;

authenticating a user as belonging to the specified group of one or more users to whom the previously unpublished directories and/or files are published; and

automatically adding, based on the act of publishing to the specified group, the previously unpublished directories and/or files to the stored user/group file whitelist, wherein the stored user/group file whitelist is updated with the previously unpublished directories and/or files.

16. The non-transitory computer-readable storage medium of claim 15, further comprising instructions executable to restrict the specified group of one or more users from viewing the previously unpublished directories and/or files prior to publication;

and to allow the specified group of one or more users to run one or more processes in the previously unpublished directories and/or files after publication.

17. The non-transitory computer-readable storage medium of claim 15, further comprising storing a public file whitelist in a data storage medium and automatically denying user access to directories and/or files that are not in the public file whitelist.

18. The non-transitory computer-readable storage medium of claim 15, further comprising bringing the user/group file whitelist into a kernel-mode address space.

19. The non-transitory computer-readable storage medium of claim 15, wherein the specified group is associated with a blacklist comprising one or more directories and/or files that are not allowed to be accessed or viewed by the specified group.

20. The non-transitory computer-readable storage medium of claim 15, further comprising reading the stored user/group file whitelist into a searchable data structure.