JPH06110763A - File system - Google Patents

Abstract

PURPOSE:To attain file protection by the unit of an optional partial area within the file. CONSTITUTION:In addition to protection information regulating the access right of an owner or another user by the unit of the file 11, partial protection information 13 regulating the access of the owner or another user by the optional partial area within the file 11 is used so as to permit/prohibit its refference, update and execution by the unit of the partial area within the file 11. Consequently, partial data protection can finely be set to the sama file 11. Consequently, not only the efficient utilization of resources but also unified access is attained.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer system having a highly reliable file system which enables a user to partially protect a file.

[0002]

2. Description of the Related Art Generally, file access protection in a computer system in which a plurality of users share and use resources is controlled in units of storing the files. That is, one type of protection information is added to one file. For example, in UNIX, which is a typical operating system of a computer system, a 3-bit permission bit indicating the right of reference, update, and execution for each file owner, user belonging to a group, and other users. Is added and stored. Figure 12
Shown in. The permission bit is represented by “r” for the reference right, “w” for the update right, and “x” for the execution right in the order of the owner, the user belonging to the group, and the other users. Also,
"-" Indicates that there is no right. Therefore, FIG.
In the first file of 1, the owner has the reference right, the update right, and the execution right, and the user who belongs to the group and the other users are permitted only the reference and the execution.

In UNIX, system calls such as reference, update, and execution are prepared as a means for accessing a file. Then, the access permission to the file in those system calls is determined according to the permission bit prepared for each file unit described above.

However, in a computer environment in which a single file is shared and used by a plurality of users, there are cases where different access is required for each user. For example, it may be desirable to prevent only a part of the document file from being referenced by other users. In the execution file, it may be desired to prevent execution by other users for each module or partial execution unit. In order to realize such a request in the UNIX system, it is first necessary to create another file satisfying the protection request.

For example, in FIG. 13A, for the document file A which can be referred to by anyone, the area indicated by P1 is desired to be prevented from being referred to by other users.
In that case, the document file B is created by deleting the portion of the original document file A whose reference is desired to be prevented. This is shown in FIG. Then, the newly created document file B
It is necessary to copy the access permission bit of the document file A to the access permission bit of the above, and remove the reference right of other users from the access permission bit of the document file A.

Further, in FIG. 13 (c), it is assumed that the execution unit indicated by P2 for the execution file C that can be executed by anyone wants to prevent execution by other users. In that case, a new execution file D is created by deleting the portion of the original execution file whose execution is desired to be prevented. This is shown in FIG. And the newly created executable file D
The access permission bit of the execution file C must be copied to the access permission bit of the execution file C, and the execution right of other users must be removed from the access permission bit of the execution file C.

However, in the above two examples, a plurality of files must be prepared, and the name of the original file and the name of the newly created file are also different, so that unified access cannot be performed. I have a problem. Therefore, the UNIX system has no mechanism for implementing such partial protection for the same file.

[0008]

As described above, in the conventional computer system, the data protection is set for each file storage unit, and the same file is partially accessed by different users. There is no mechanism to provide protection. Therefore, in order to set partial protection, a plurality of files must be prepared, which not only makes inefficient use of resources, but also has a problem that uniform access is not possible.

The present invention solves the above-mentioned drawbacks, and provides a file system which enables effective use of resources and unified access, and also enables access to a file in which fine partial protection is set. With the goal.

[0010]

According to the present invention, in a file system of a computer in which a plurality of users share and use the same file, the access right of the owner and other users is defined for each file. The protection information to be specified and the partial protection information that regulates the access rights of the owner and other users for each arbitrary partial area in the file are prepared for each file, and the corresponding file according to these protection information and the partial protection information. And access means for permitting / prohibiting the reference, update, and execution of the file in units of files and units of partial areas in the files.

In this file system, in addition to the protection information which defines the access right of the owner or other users for each file, the access of the owner or other users for each arbitrary partial area in the file Partial protection information that specifies the right is used, and its reference is made for each partial area in the file.
Update / execution can be permitted / prohibited. Therefore, partial data protection can be finely set for the same file. Therefore, not only can resources be used efficiently, but also unified access is possible.

[0012]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows a file system in which the present invention is applied to a UNIX system. This file system is a file 1 that stores the actual data.
1, protected information 12 indicating access control of the file 11, partial protected information 13 indicating partial access control in the file 11, conventional access control means 14 provided to an application, partial protected information The partial access means 15 according to

Each file has one piece of protection information 12, and this protection information 12 stores the permission bit used in the UNIX system and an index indicating the existence of the partial protection information. This state is shown in FIG.

As shown in FIG. 2, the permission bits indicate a reference (r), an update (w), and an execution right (x) to the file for the owner, the group, and the other user.
In the partial protection information 13, the start position for designating the protection range is recorded in the byte start position and the bit start position, and the protection size is recorded in the byte unit and the bit unit. If the protection range is specified on a byte boundary, the protection range is indicated in bytes, and the bit start position contains a 0 code. On the other hand, when the protection range extends over bit boundaries, the protection start position is expressed using both the byte start position and the bit start position, and the protection size is also expressed in both byte units and bit units. In addition, permission bits effective only in the protection range are stored in these protection ranges in the same format as the protection information.

FIG. 3 shows the protection state of the file 11 to which the partial protection information 13 of FIG. 2 is added.
Since the leading 256 bytes are not specified by the partial protection information, the conventional protection information is applied, and the group and other users have the reference and execution rights. The following 256 bytes are the first partial protection (rwx−) recorded in the partial protection information 12.
-----) is applied, so all access except for the owner is denied. Second partial protection (rwxr-x ---
-) Is specified on a bit boundary. This is 32 bytes starting from the 4th high-order bit of the 4097th byte and 1
The range of bits is protected, and reference and execution are permitted for the group users, but access for all other users is denied. In the UNIX system, there are the following types of files that users access. (1) Executable object file (binary file) (2) Object library file (binary file) (3) Executable script file (text file) (4) Text data file (5) Binary data file

In UNIX, of these (2), (4),
For the file (5), the user process refers to and updates the read system call, write.
System call is prepared. Also, (1),
For (3), the exec system call is prepared in which the kernel directly reads the contents from the file into the memory and executes the contents. Therefore, according to the present invention, in both of the above cases, a partial access means that replaces these system calls is prepared for a file in which partial protection information exists.
The means for accessing the files (2), (4), and (5) will be described in Examples 1 and 2. Also, the means for accessing the files (1) and (3) will be described in Examples 3 and 4. [Example 1] An example of a procedure for referring to a file to which the partial protection information 13 is added in the file system shown above will be described with reference to FIGS. 4 and 5.

First, when an open system call for the file 11 is made by the user process, the protection information of the file is first inspected (step S1). If the partial protection information index of the protection information is not set, the conventional file open procedure is performed and then the control is passed to the conventional access means 14, that is, the read system call (steps S2 and S3). On the other hand, when the partial protected information index is set, the file is referred to by using another procedure prepared by the partial access means 15 instead of the conventional access means 14 (steps S2, S3 ...
S5).

When copying the file data to the buffer area, referring to the protected data portion,
There is either a method of masking with a specified code or a step of skipping, but here, it is assumed that the method can be selected when the file is opened. Therefore, it can be realized by expanding the file open system call as follows. open (file descriptor, filename, mode,
Mask flag, mask pattern)

Here, if the mask flag is not specified, the protected portion that cannot be referred to is skipped (steps S4 and S5). Actually, the read position may be moved from the read size, the offset of the partial protection information, the size, and the permission bit. When the mask flag is designated, the data in which the mask pattern is filled in the protected area is referred to (steps S4 and S6). Similarly, the mask pattern is copied to the buffer area when the read position, the read size, the offset of the partial protection information, the size, and the area not permitted by the permission bit are referred to.

FIG. 5 shows an example of a reference image of a file to which partial protection information is added. The original file (a) is protected in the range from the offset P1 to the size S1. Then, reference images when a user who has no reference right to the protected area refers to the entire file are shown in (b) and (c).
In (b), the data excluding the protected data of size S1 is read, and in (c), when a mask is specified when the file is opened, the mask pattern is filled in the protected area and read. It represents. Therefore, in (b), the (original file size-S1) is the referable file size, and in (c), the apparent referable size is the same as the original file. [Example 2] An example of a procedure for updating a file to which the partial protection information 13 is added in the file system shown above will be described.

Generally, updating a file includes updating a part of the file and updating the entire file. The write system call prepared in the UNIX system partially updates the data in the buffer area from the read position designated by the file pointer by the designated size. Partial writing to a file to which partial protection information is added updates both inside and outside the protected area when updating outside the protected area according to the write position and write size. There are three possible cases. Therefore, it is necessary to judge whether or not writing is possible from the write position, write size, protection start position, protection size, and permission bit.

However, care must be taken when updating the entire file. For example, in the UNIX editor program, when the file is updated, the size of the original file is set to 0 using the create system call, and then w
Some use the write system call to update the entire file. In such applications,
For a file to which the partial protection information 13 is added, the partial protection information becomes invalid. Therefore, in a system call that may change the file size, it is necessary to return an error for the file to which the partial protection information 13 is added.
Further, even in the unlink system call for deleting a file, if the partial protection information 13 is added, it is necessary that only the owner of the file can execute it. Next, how the entire file is updated will be described.

6 (a) and 6 (b) show an example of the structure of a file before update and its protection information and partial protection information. In this file protection information (rwxr-xr-x), reference and execution are permitted for the group user and other users, but the partial protection information (p3, 0x0 s2, 0x0,
rwxr−x −−−) is partially protected on the byte boundary from the offset P1 by the size S2,
Only the users who belong to the group are allowed to refer and execute. For this file, as shown in (a) and (c), insert data of size S3 at offset P1,
Data of size S1 is deleted from offset P2, size S4
A procedure for updating the partial protection information in the case of performing the update of adding the data will be described with reference to the flowchart of FIG.

Here, it is assumed that the update right of the protection information for this file has been checked when the file is opened. Furthermore, it is assumed that the updated image is already on the buffer.

First, the existence of the partial protection information 13 is checked (step S11). When there is the partial protection information 13, the update work of the partial protection information is started (step S1).
2). If there is no partial protection information, the conventional updating process using the write system call is executed (step S13). Further, if there is partial protection information, the processing is separated depending on whether the entire file is updated or a partial update is made. In the case of partial update (step S21), the update permission of the protected area is checked (step S22), and if update is possible, the conventional update process using the write system call is executed (step S23). If it cannot be updated, a predetermined error process is performed (step S24).

In case of updating the entire file (step 1
In 4), first, the file before update and the data on the buffer are compared to obtain difference data represented by the following offset and size (step S15). Offset size P1 + S3 P2-S1 P4 + S4 Here, the size is expressed as a positive number for insertion / addition and a negative number for deletion, and is assumed to be sorted in ascending order of offset.

Next, one protection start position (p3) and one protection size (S2) are extracted from the partial protection information before update (step S16). Further, the offset and the size are extracted from the difference data (step S17). Then, the protection start position of partial protection is compared with the offset of the difference data. In this example, it can be seen from the size code that data is inserted, and since it is inserted before the partial protection data from the offset P1 ≤ partial protection start position P3 of the differential data, the new partial protection start position Po = partial protection start position P3 + difference data size S3 New partial protection size Ps = partial protection size S2. As for the next differential data, it was found that the data was deleted in the same manner, and the size S1 was deleted before the partial protection data from the offset P2 of the differential data + size S1 <partial protection start position P3. Start position Po = new partial protection start position Po
-Differential data size S1 New partial protection size Ps = New partial protection size Ps. As for the last differential data, it is necessary to change both the new partial protection start position and size because it is added after the partial protection data from the offset P3 + size S4 ≥ partial protection start position P3 + partial protection size S1 of the differential data. Not, new partial protection start position Po = new partial protection start position P
o New partial protection size Ps = new partial protection size Ps. From the above, the final new partial protection information is the new partial protection start position Po = P3 + S3-S1 new partial protection size Ps = S2. The new partial protection information and the changed data are stored. The updating of the file ends (steps S18 and S20). [Example 3]

In the file system shown above,
An embodiment of the execution procedure of the object file to which the partial protection information is added will be described with reference to the flowchart of FIG.

First, the existence of partial protection information is checked (step S31). If there is no partial protection information, ex
Conventional program execution processing using the ec system call is performed (step S32). In this system call, after checking the execution permission of the file and checking whether the file is a load module, the memory area required for the load module is secured, and the load module of the file is loaded on the secured memory.

On the other hand, if there is partial protection information, the memory area required for the load module is secured (step S3).
3) Similarly, the load module of the file is loaded onto the memory secured in advance (step S34), but at the time of loading the program from the file onto the memory, the partial protection information is checked (step S35), If the execution is not permitted, the invalid code (NOP code or the like) is replaced (step S37). If the area is a module, execution can be prevented by replacing it with an invalid code and replacing the last code with a return code (step S38).

In FIG. 9, (a) shows an executable file to which partial protection information is added, and (b) shows a program image loaded on the memory when another user executes the program. . In the figure, NOP represents an invalid code and RET represents a return code. [Example 4]

In the file system shown above,
An example of the linking procedure of the object library to which the partial protection information is added will be described with reference to the flowchart of FIG.

First, it is checked whether or not partial protection information is added to the object library (step S4).
1). If the partial protection information is not added, the normal link procedure to the execution module is executed (step S42). In the UNIX system, an object library is linked to an execution module by an application program called a linker.
In this application, the module load from the object library is actually read into the buffer by the read system call, the address is relocated, and then added to the executable file by the write system call.

If there is partial protection information, the partial protection information is checked to see if the linked module is executable (step S43). If it is feasible, the link procedure is performed as usual (step S4).
4) If it is not executable, replace the partial protection size with an invalid code from the beginning and read it into the buffer, replace the last code with the return code, and then rearrange and add it to the execution module. Execution of the module can be prevented (step S45).

In FIG. 11, the object library to which the partial protection information is added is shown in (a), and the result of linking a module whose execution is protected from the library to the execution file by another user is ( Shown as b).

As described above, in this embodiment, in addition to the protection information 12 which defines the access right of the owner and other users for each file, the owner and the other for each arbitrary partial area in the file. The partial protection information 13 that defines the access right of the user is used, and the reference, update, and execution of the partial area in the file 11 can be permitted / prohibited. Therefore, partial data protection can be finely set for the same file. Therefore, not only can resources be used efficiently, but also unified access is possible.

[0038]

As described above, according to the present invention,
With regard to shared files, not only the file storage unit but also partial access control can be performed on the same file, so fine security management, unified access, and efficient use of resources can be realized.

[Brief description of drawings]

FIG. 1 is a block diagram showing the configuration of a file system according to an embodiment of the present invention.

FIG. 2 is a diagram showing an example of protection information and partial protection information used in the embodiment.

3 is a diagram showing a structure of data corresponding to the partial protection information of FIG.

FIG. 4 is a flowchart for explaining an operation of the access unit at the time of referring to a file in the embodiment.

FIG. 5 is a diagram showing a file image at the time of referring to a file of the access means in the embodiment.

FIG. 6 is a diagram showing a file image at the time of updating a file of the access means in the embodiment.

FIG. 7 is a flowchart for explaining a file updating operation of the access means in the embodiment.

FIG. 8 is a flowchart for explaining a file execution operation of the access means in the embodiment.

FIG. 9 is a diagram showing an image of loading an execution file in the embodiment.

FIG. 10 is a flowchart illustrating an operation of linking an execution file in the embodiment.

FIG. 11 shows an example of an execution file linked with the library in the embodiment.

FIG. 12 is a diagram for explaining a conventional file system.

FIG. 13 is a diagram showing an image of a document file and an execution file in a conventional file system.

[Explanation of symbols]

11 ... File, 12 ... Protection information, 13 ... Partial protection information, 15 ... Partial access means.

Claims (5)

[Claims] 1. In a file system of a computer in which a plurality of users share and use the same file, protection information defining access rights of the owner and other users for each file, and arbitrary information in the file Partial protection information that defines the access rights of the owner and other users is prepared for each partial area for each file, and according to these protection information and partial protection information, reference, update, and execution of the corresponding file can be performed in file units and A file system comprising: an access unit for permitting / prohibiting each partial area in the file. 2. The access means, when referring to a file having a partial area whose reference is permitted by the protection information and whose reference is prohibited by the partial protection information, is prohibited by the partial protection information. 2. The file system according to claim 1, wherein the data in the existing area is replaced with a blank or an invalid code, or the data in the area is skipped. 3. The access means, when updating a file having a partial area protected by the partial protection information, inserts, deletes, or adds by the update according to a difference between data before update and data after update. 2. The file according to claim 1, wherein a new partial protection information corresponding to the updated file is generated by acquiring the position and size of the data to be read and updating the partial protection information based on the information. system. 4. The access unit invalidates the object code of the partial area when executing an object file having a partial area whose execution is permitted by the protection information and prohibited by the partial protection information. 2. The file system according to claim 1, wherein the file system is replaced with a different execution code, and a predetermined control flow code is added and read into the main memory. 5. The access means protects the partial area when linking an object library file having a partial area whose reference is permitted by the protection information and whose execution is prohibited by the partial protection information. Replace the module with invalid execution code,
The file system according to claim 1, wherein the file system is linked by adding a predetermined control flow code.