초록 ▼

The present invention is an algorithm that manages the ability of a user or software program to access certain protected file resources. This invention describes a method for file system security through techniques that control access to the file system resources using externally stored attributes.

The present invention is an algorithm that manages the ability of a user or software program to access certain protected file resources. This invention describes a method for file system security through techniques that control access to the file system resources using externally stored attributes. This invention accomplishes the described objectives in file system security by creating an external database containing auxiliary attributes for objects in the file system. During a file access attempt, an identifier of this file will be matched against a set of protected files in a security database. If that file is not in the database, there is not protection on the file and requester will be allowed to access the file. If a match does show that the file is protected there will be a determination as to whether the requester will be allowed access to the file. The basis for this access determination will be a set security rules defined in the external security attribute. This invention incorporates techniques and algorithms for attribute attachment, storage and organization of the associations to these attributes, and subsequent recognition of attached attributes. In this approach, the attributes would define authorization policy for controlling access to objects in the file system.

대표청구항 ▼

I claim: 1. A method external from a native operating system of a computer system for generating a file identifier for use in controlling access to file system resources in a computer system comprising the steps of: generating a data structure having a pointer to an index related to a physical loca

I claim: 1. A method external from a native operating system of a computer system for generating a file identifier for use in controlling access to file system resources in a computer system comprising the steps of: generating a data structure having a pointer to an index related to a physical location of a file resource in the file system and a pointer to a directory containing a requested file resource, wherein the file resource and the directory are on a memory device; obtaining a unique physical attribute of the file system object, by retrieving a serial number for a file location where a requested file system resource resides the file system location is retrieved from an inode or vnode index or from a serial number generated using a programming interface; obtaining the name of the file system object, by opening the directory identified in the data structure, for each entry in the directory, reading the serial number for the file location, comparing said vnode or inode number to said serial number for the file location number and retrieving the file name of the resource out of the directory; and constructing a file identifier for that file system object from said obtained unique physical attribute and said file system object name, by coupling the unique physical attribute to the file system object name to produce the file identifier for a particular file system object. 2. The method as described in claim 1 wherein said file identifier construction step comprises placing the index number at the beginning of the bytes that will be the file identifier and appending the file name to the file of bytes. 3. The method as described in claim 1 further comprising after said comparing step, the steps of: retrieving the next entry in the directory when the said comparison is not equal; determining if this entry is the last entry; and proceeding to read said entry is not the last entry. 4. The method as described in claim 3 further comprising the step of returning no file identifier when no directory entry file serial number equals the index file space number. 5. A method external from a native operating system of a computer system for generating a file identifier for use in controlling access to file system resources in the computer system, the external file generating method comprising the steps: obtaining an underlying object data pointer for a file system object; obtaining an object pointer of for the parent directory of the file system object; obtaining a physical file location number for the system object using the obtained underlying object data pointer for the system file object and the obtained object pointer of for the parent directory of the file system object, wherein the system object and the parent directory are on a memory device; obtaining the file name for the system file object by using the data pointer for the parent directory by using the data pointer for the parent directory to open the directory; obtaining a specific file serial number for the system file object using the physical file; reading information contained in the directory to get a directory entry's serial number or node index; determining whether there is a match between a serial number of an entry in the parent directory and the obtained serial number of the specific file system object; when the determination is that the serial number of a directory entry is equal to the serial number of the specific file system object, retrieving the name of the entry in the directory and the length of that name; constructing a file identifier for a file system resource of the file system object by placing the file serial number at the beginning of the file of bytes; appending the length of the file name and file name to the constructed file identifier resulting in memory locations containing the serial number, the length of the file name and the file name in consecutive memory locations; setting a file identifier length for the constructed file identifier to be equal to the length of the file name plus the number of bytes required for the serial number plus the number of byes required to write the length of the file name; and returning the newly constructed file identifier to the user.