RU2207619C2 - Resource access differentiation system - Google Patents

Abstract

FIELD: computer engineering; protection of workstation information resources and communications network servers. SUBSTANCE: system whose functions are extended by enabling access to resources not only for resource-requesting users but also for resource-requesting processes (programs) has user authorization unit, users access rights storage unit, user resource access enabling unit, process access rights storage unit, process resource access enabling unit, unit for storage of privileged process rights of access, privileged process resource access enabling unit, and resource access enabling unit. EFFECT: enhanced protection degree of data resources of workstations and servers; enlarged functional capabilities of system. 1 cl, 2 dwg

Description

 The invention relates to computer technology, namely to information computer systems and networks, and can be used to protect information resources of workstations and servers.

 There is a known system for protecting information resources of a computing system and the Secret Net network (see. "Secret Net Access Control System. User Guide, 1996"). It is a software package that can be installed on a stand-alone computer or on computers connected to a computer network. The system solves the problem of restricting access to resources, in particular to file objects.

 Closest to the technical nature of the claimed (prototype) is a resource access control system built into the Windows NT Server 4.0 operating system (see Prince Valda Hilly, "Secrets of Windows NT Server 4.0." -K. "Dialectics", 1997, p. . 14-15).

 The system is presented in figure 1. The system for restricting access to resources includes a user authorization unit 1, a user access storage unit 2, a user access permission block 3, the input of the user authorization unit 1 being connected to the user authorization input 4, the output to the first input of the user access storage unit 2 , with the second input of the access permission block for the user to the resource, the first input of which is with the output of the user access rights storage unit 2, the second input of which is with the input of setting access rights upa members 5, the third user input unit allowing access to resources 3 - to the input of an access request to a resource 6, the output user access permissions to resources unit 3 - in a yield of access permission to the resource 7.

 Differentiation of access to resources is as follows. The administrator from input 4, after authorization in block 1, by entering his identifier and password (from the same input, the administrator starts up the users and assigns their passwords stored in block 1), from input 5 sets the table of access rights to resources in block 2 (for example, to differentiate access to file objects - this is the prototype that solves this problem; logical disks, directories and files are set for each user, to which the user is allowed access and the type of access - full access, read only, write only, only complete etc.). Each time a user accesses a resource from input 6 (input 6 receives the identifier of the requested resource and the requested action with the resource), carried out after authorization by block 1 from input 4, block 3 for this user (the user ID in block 3 comes from the output of the block 1, user access rights - from the output of block 2) a decision is made whether or not to grant the requested access, permission of the access requested by the user to the resource is issued by block 3 to exit 7.

The disadvantage of the system is the following:
1. The possibility of differentiating access rights to resources only for the user (by his identifier) is implemented regardless of which application he is working with - which process (program) is requesting access. Those. if the user is allowed access to the object, then this access will be granted to him regardless of what process caused the call winword.exe, far.exe, etc. In practice, there is a need to differentiate user access to a resource not only taking into account the user ID, but also taking into account the program requesting access.

 2. For the Microsoft family of operating systems, it is important that any program running on a computer gets access allowed to the current (registered in the system) user. Therefore, if some network service is installed on the PC, for example, the DHCP service (remote administration of the PC), then when the agent (process) of this service is launched on the workstation, it gets access to all the resources that the current user has access to, which makes remote viewing possible all user resources from the network - when the manager is working with the agent).

 The aim of the invention is to increase the level of security of information resources of workstations and servers by expanding the functions of the system for restricting access to resources, carried out not only for users requesting a resource (by their identifiers), but also for processes (programs) requesting a resource.

 This is achieved in that a resource access control system containing a user authorization block, a user access storage unit, a user access permission block, the input of the user authorization unit is connected to the user authorization input, the output is to the first input of the access right storage unit users, with the second input of the access permission block of the user to resources, the first input of which is with the output of the user access rights storage unit, the second input of which is with the job input equal access control for users, the third input of the access permission block for the user to the resources - with the request for access to the resource input, the following are additionally introduced: the block for storing process access rights, the block for process access permission for resources, the block for storing privileges for privileged processes, the block for allowing privileged process access resources, the block access permissions to resources, and the first input of the storage block of the access rights of processes is connected to the first input of the storage block of the access rights of privileged processes s, with the output of the user authorization block, the second input - with the input of the task of restricting access rights to the processes, the output - with the first input of the process permission block for accessing resources, the second input of which is with the identification input of the process that requested access to the resource, with the second input of the permission block access of the privileged process to resources, the first input of which is with the output of the storage block for the privileges of privileged processes, the second input of which is with the input of the privileges of privileged processes, the first input of the access permission block for the resource - with the output of the user access permission block for the resource, the second input - with the output of the privileged process access permission block for resources, the third input - with the output of the process access permission block for resources, the output - with the output of access permission to the resource .

 A diagram of a system for restricting access to resources is shown in FIG. 2, it contains: a user authorization unit 1, a user access storage unit 2, a user access permission block 3, a process access storage unit 4, a process access permission block 5, a block for storing privileges for privileged processes 6, a block for allowing privileged process access to resources 7, a block for allowing access to resources 8, the input of user authorization block 1 being connected to the user authorization input 9; output - with the first input of the user access rights storage unit 2, with the second input of the user access permission block 3, the first input of which is with the output of the user access storage unit 2, the second input of which is with the input of the user access control permission setting 10, the third the input of the permission block for user access to resources 3 - with the input of the request for access to the resource 11, the first input of the block for storing access rights of processes 4 is connected to the first input of the block for storing access rights for privileged processes 6, with the output m of user authorization block 1, the second input - with the input of the task of restricting access rights of processes 12, the output - with the first input of the block of process access permission to resources 5; the second input of which is with the identification input of the process that requested access to resource 14, with the second input of the privileged process access permission block to resources 7. the first input of which is with the output of the privileged process access storage unit 6, the second input of which is with the input of the task of differentiation rights access privileged processes 13, the first input of the access permission block to resources 8 - with the output of the user access permission block to resources 3, the second input - with the output of the privileged access permission block process resources 7, the third input - to the output unit of the access permissions to resources is 5, the output - with output an access permission to the resource 15.

 The system for restricting access to resources works as follows. In addition to the analysis of user access rights to resources, as in the prototype implemented by blocks 1, 2, 3, the process access rights to resources are set and analyzed. The table of access rights of processes to resources (the identifier of a process is its name and the full path from where the process started, as well as access parameters to the resource: full access, read, write, execute, etc.) is created by the administrator from input 12 (after administrator authorization ) and is stored in block 4. From input 14, when requesting access to resources, block 5 from the OS receives the parameters of the process that requested the resource (name and full path of the process), the resource identifier and actions with the resource, block 5 compares the request with the access rights of the process ( from block 5) and generate There is (or not) a signal of the process’s access to the resource that goes to block 8. It distinguishes a special class of processes, the so-called privileged processes, the request of which is processed by blocks 6 and 7. Their difference from the usual ones is that the access of these processes to resources is differentiated beyond the delimitation of access rights to user resources. Such processes may include systemic and other processes. For example, user access to a system disk (for example, C: drive) may be denied, but some processes need to open this access, for example, system processes that write data to the registry, etc. It is necessary to open access to the system disk and application processes, for example, providing remote administration of a PC. Thus, privileged is understood as a process that is not subject to access restriction of the current user. These processes are processed in the same way as normal ones, by blocks 6 and 7. In block 6, the administrator after authorization by block 1 enters the access rights delimitation table, the access rights when requested are analyzed by block 7. Three permissive signals are received in block 8 - permission to access the user to a resource from block 3, permission to access a process to a resource from block 5, and permission to access a privileged process to a resource from block 7. Block 8 generates a signal to allow access to the resource to exit 15 upon receipt of permission or from the exit ka 7, or simultaneously permissions from the outputs of blocks 3 and 5, i.e. skips authorized requests of privileged processes, authorized requests of other processes within the access permissions of the current (registered in block 1) user.

 Thus, the proposed system allows to provide differentiation of access to resources not only for users, but also taking into account the processes (programs) launched by the user to access resources.

 The resources to which access by the proposed system can be delimited can be not only file objects, but also devices (for example, COM and LPT ports), network addresses and host services of the local and global networks, etc.

 Blocks used in the inventive system for restricting access to resources can be implemented as follows.

 Blocks 4 and 6 are implemented similarly to block 2 of the prototype, blocks 5 and 7 are similar to block 3 of the prototype. Block 8 performs the following logical operation "Block 7 output" OR "Block 3 output" AND "Block 5 output".

 Blocks in the General case can be implemented both software and hardware.

 Thus, the implementation of all used blocks is achieved by standard means based on the classical principles of implementing the foundations of computer technology.

 The following can be attributed to the advantages of the proposed system for restricting access to resources.

 1. The possibility of differentiating access rights to user resources (by its identifier) is realized taking into account which application it is working with - which process (program) is requesting access, which expands the possibilities of differentiating access to resources.

 2. For the Microsoft family OS using the claimed system, the possibility is realized that any program running on a computer does not receive full access to resources allowed to the current (registered) user, but access allowed to this program within the user's access permissions. Therefore, if some network service is installed on the PC, for example, the DHCP service (remote administration of the PC), then when the agent (process) of this service is launched on the workstation, it does not gain access to all the resources that the current user has access to, which makes it possible to remotely viewing all user resources from the network (when the manager is working with the agent), but only the access that is allowed to the requesting resource.

Claims (1)

 A system for restricting access to resources, comprising a user authorization block, a user access rights storage unit, a user access permission block, the input of the user authorization block is connected to the user authorization input, the output to the first input of the user access storage unit, and the second input of the block permissions for user access to resources, the first input of which is with the output of the storage unit for user access rights, the second input of which is with the input of the task of restricting access rights users, the third input of the block for user access permission to resources - with the request for access to the resource input, characterized in that the block for storing process access rights, the block for process access to resources, the block for storing privileges for privileged processes, the block for allowing privileged process access resources, the block access permissions to resources, and the first input of the storage block of the access rights of the processes is connected to the first input of the storage block of the access rights of privileged processes, from ode to the user authorization block, the second input - with the input of the task of restricting access rights to processes, the output - with the first input of the process access permission block to the resources, the second input of which is with the identification of the process that requested access to the resource, with the second input of the privileged process access permission block to resources, the first input of which is with the output of the privileged process access rights storage unit, the second input of which is with the input of the privilege access control privileges of the privileged processes, the first input is a resource access permission lock - with the output of the user access permission block for the resource, the second input - with the access block of the privileged process access permission block for the resources, the third input - with the output of the process access permission block for the resources, output - with the output of the resource access permission.

Images