WO2010091607A1

WO2010091607A1 - Method for providing custom access control mode in file system

Info

Publication number: WO2010091607A1
Application number: PCT/CN2010/070267
Authority: WO
Inventors: 马杰
Original assignee: Ma Jie
Priority date: 2009-02-13
Filing date: 2010-01-20
Publication date: 2010-08-19
Also published as: CN101807185A; CN101807185B

Abstract

A method for providing custom access control mode in a file system, wherein the task of access control validation for access operations is subdivided into several validation steps which are independent to each other, and each validation step is constituted of the preset validation methods and the input information for performing the validation methods. The meaning of the custom is that the administrator and application are capable of defining the validation steps included in the task of access control validation, defining the operation flow of each validation step, and defining various data contents required by the validation steps, and even adding the desired validation methods.

Description

A method for providing a customized access control method in a file system

The content of the present invention relates to a file management system, i.e., a file system, responsible for managing and storing file information in an operating system. Specifically, a method of providing a custom access control method in a file system is described. By providing a configurable file access control process and providing a variety of authentication methods, users and applications can use the file system to meet personalized file access control requirements, ultimately making the file system a content management and its application. The base platform. Background technique

The file system responsible for managing and storing file information consists of three main components: software related to file management, managed files, and data structures required to implement file management. From a system perspective, a file system is a system that organizes and allocates file storage space, is responsible for storing files, and protects and retrieves stored files. Specifically, it is responsible for creating files for users, depositing, reading, modifying, dumping files, controlling the storage of files, and revoking files when users are no longer using them.

Access to control files is an essential function of the file system. The purpose is to avoid the occurrence of corruption during the use of file sharing, usually by the access control verification module in the file system. In the general file system, the access control verification module is a checkpoint between the directory retrieval module and the logical file system, responsible for checking and judging access restrictions and sharing rights, as shown in Figure 1. Implementing file protection is the basic function of the access control verification module. The working process is usually to compare the access request made by the user with the access control setting information specified in the file control block, and to check whether the user's access is legal.

Access control setting information is the basis for file access control work. The Access Matrix is a typical type of existing access control setup information. The Access Matrix uses rows to represent the initiator of an access action, that is, the access subject. The Access Matrix uses columns to represent the objects being accessed, ie access objects. Each element in the access matrix stores some access rights. The Access Control List (ACL) and the Capability List are the most common implementations of the Access Matrix. The file system access control core based on the access matrix is to limit the access authority of the access subject to the access object. The type range of the access subject is predefined by the operating system.

In the context of the rapid development of the Internet and the increasing popularity of mobile storage, the portability of electronic documents is gradually increasing and the speed of dissemination is increasing. Distribution is an important feature of today's electronic documents. The access control of the existing file system is based on the access matrix protection in the operating system, that is, the access rights of the access subject to the access object are defined. In the network environment, file managers and visitors are often distributed at both ends of the network. The meaning of the access subject needs to be defined by the remote file manager, that is, the access subject is characterized by networking. Since the access subject in the access control requirement is not limited to a single operating system In the scope of the system, the access control methods provided by the file system can no longer meet the file management needs under the distributed state.

In order to address the need for file management in distributed state, more and more file editors or file access tools have begun to provide file content access control by changing the file content format. For example, Fi leSecure provides content control using a specific file format. Word added an access password to the document, and even 0ffice2003 further proposed the IRM management mechanism.

There are also some shortcomings in the application tool to add file content access control measures to meet specific file management needs. First, the diversity and variability of user requirements has made it simple for application-level solutions to increase the complexity of application development. Second, the management of the application layer is fundamentally content-level management. The decentralization of electronic files and the physical access around electronic files are still not effectively managed. Summary of the invention

Due to the special status of the file system, if the file system can provide a custom access control method, the administrator and the application can customize the required access by providing a configurable access control interface and basic access control. The control process will have the following advantages:

1 Through the configurable interface, administrators and applications can set the verification conditions that meet their requirements, and even add new verification methods, which can easily realize the purpose of personalized file management without waiting for support from other application software.

2 The basic and general access control means are stored in the file system, which can save a lot of work of application development and improve development efficiency.

In the present invention, the core idea of providing a custom access control method in a file system is to subdivide the access control verification work of the access operation into a plurality of independent verification steps, each of which is determined by a preset verification method and The input information that performs the verification method consists of. The meaning of customization is reflected in the certification process that the administrator and the application can specify for the access control verification work, the operational flow that can specify each verification step, and the various data content that can be specified for the verification step, and can even add The required verification method. Specifically, the method of providing a custom access control method in the file system includes the following four aspects:

1 File system provides a variety of verification methods for access control verification work, and supports the addition of new verification methods. Each verification method and the input information that performs the verification method can together form a verification step.

In the file system, the access control setting information of the files and directories is composed of access control requirements of one or more access operations. Access control requires that the necessary information required for each verification method to be executed be recorded in addition to the verification method associated with the access operation.

3 When the access operation occurs, the basic process of the access control verification module works as follows: In the first step, the access control requirements affecting the access operation are collected, and the second step is performed in association with the access operation for the collected access control requirements. Verification method. The third step is to decide whether to approve the access operation according to the execution result of all the executed verification methods. The file system allows the tool program and application to operate on the data structure that records the access control setting information by providing an access interface.

In the above scheme, the verification method is a verification code implementation, which exists in the form of a static code module contained in the file system itself and a dynamic link library added from outside the file system.

The verification method has three types: user identity verification, access program verification, and use environment verification. The function of user authentication is to verify that the visitor has a legal identity for the specified authentication system, for example, to require a legal identity on the network authentication server, and to require a specific identity with the local operating system. The verification of the access program is used to ensure that the access operation can only be performed by a prescribed computer software program, for example, requiring the access program to have a specified program name and the process requiring access to the program to be a system process. Verification of the usage environment is used to ensure that access operations can only be performed in a specific computer environment, for example, requiring a specific server on the network, requiring specific hardware to be installed on the computer, and requiring specific software to run on the computer.

In the access control requirements of the access operation, each of the recorded verification methods is a verification step of the access operation access verification. The data information required to perform the verification step is also recorded in the access control requirements corresponding to the access operation, and the scope includes the identification information of the software program, the hardware device, the network element, the user, the data acquisition path, and the like, and also affects the Verification method Control information for the working process.

The access operation of the access control setting information management in the custom access control mode includes a file system conventional access operation, an access operation around the access control setting information, an individual management operation of a file (directory), and the like. For an access operation of a file (directory), the location of the access control requires two aspects, one is in the access control setting information of the file (directory) itself, and the other is in the file (directory). The access control setting information that the superior directory has.

The data structure of the record access control setting information is directly associated with the content storage of the file (directory) in the file system and exists as part of the file (directory).

Based on the above scheme, the administrator and the application select the desired verification method in the access control setting information of the file (directory) and give the required data information, and the file system providing the customized access control mode is stored according to the above. Manage access operations associated with files (directories) by taking control of the settings information.

For example: By selecting the verification method for performing remote authentication in the access control request of the file reading operation, and given the access path of the network authentication server, the administrator can utilize the access control verification module of the file system on the remote computer. The read operation of the guaranteed file can only be performed by the user authorized by the network authentication server. This approach is more convenient than providing a document viewer that looks or waits to provide a compliant authentication mode, even without changing the document format for the browsing tool.

Compared with the traditional file system, the file system with custom access control mode is responsible for managing and storing file information. In addition to the basic functionality, it can also be the underlying platform for supporting personalized content management applications. Embodiments are given later in the text, which will be explained above. DRAWINGS

Figure 1 is an internal block diagram of a typical file system.

FIG. 2 is a diagram showing an example of various common verification methods.

Fig. 3 is a diagram showing an example of a storage form of access control setting information.

Fig. 4 is a diagram showing an example of an access control setting information recording format. detailed description

A file system with a custom access control method is first a file system, and the main function of the custom access control method is added to the traditional file system. An embodiment of the present invention will be described below, and the specific content is divided into the following aspects:

Authentication method

In this implementation, the verification method is a function code called by the access control verification module, and is a verification step that does not include identification information of hardware, software, network equipment, users, and the like. Identification information such as software programs, hardware devices, network elements, users, data acquisition paths, and control information affecting the verification step workflow will be passed to the verification method as input data.

In this implementation, the verification method has two types: static form and dynamic form. The static form of the verification method is the verification method that the file system comes with, and its essence is a piece of function code that the file system itself has. The other is a verification method that exists in a dynamic form, added to the application or administrator, and located in a dynamic link library accessible to the file system.

In this implementation, the access control verification module uses a static form of the verification method in the form of a function call. For the dynamic form verification method, the access control verification module first needs to use the technology of the dynamic link library to obtain the access point of the verification method, and then use it.

In this implementation, regardless of the static form or the dynamic form of the verification method, there are only differences in function names between different verification methods, and the return type, number of parameters, parameter type, and parameter order are all the same. For example, the following functional forms are used:

Int function name (void * data pointer, int data size, void * result description)

The function return value is used to mark whether the verification is successful, and the non-zero value is used to indicate true, that is, the verification is successful, and the zero value is used to indicate fal se, that is, the verification fails. The data pointer and data size parameters are used to pass data information to the verification method, specifically the data pointer points to the data area in which all input data information is stored, and the data size represents the size of the data area in which all input data information is stored. The result indicates that the content pointed to by the parameter is the verification result description information returned by the verification method. In this implementation, each verification method has one and only identification string, and the identification strings are different between different verification methods. The verification method identification string consists of the verification method type, the verification method category, the verification method provider, and the verification method name. The verification method type indicates that the verification method is static or dynamic. The purpose of the verification method is to indicate the purpose of the verification method, such as accessing program verification. The validation method provider is a string that characterizes the verification method developer or developer. The verification method name is the name given by the developer or developer for the verification method.

In this implementation, the verification method type, the verification method category, the verification method provider, and the verification method name are connected together by an underscore to form a verification method identification string. The specific form is as follows:

Authentication Method Type - Authentication Method Category - Authentication Method Provider - Authentication Method Name

For example, an authentication method identifier string is static—user—majie—remotessh, where static indicates that the verification method is static, user indicates that the verification method works as user authentication, majie is the authentication method developer's identification string, and remotessh is the developer. The name given to the verification method.

In this implementation, the added dynamic verification method needs to record the correspondence between the identification string and the dynamic link library and the function name of the verification method in the specified configuration file. The main function of the configuration file is for the access control verification module to query the dynamic link library to be used according to the identification string of the dynamic verification method, and finally access the verification method.

In this implementation, the dynamic verification method is added to copy the dynamic link library corresponding to the dynamic method to a directory accessible by the file system, and add corresponding entries in the configuration file of the record identification string and the dynamic link library.

In this implementation, according to the purpose of the work, the verification method can be divided into three categories: verification of the user identity, verification of the access procedure, and verification of the usage environment. among them:

1 User authentication can be divided into three cases: local authentication, network authentication, and device authentication. Local authentication is when both the authentication information and the authentication process are on the local computer, such as the user identity of the operating system. Network authentication refers to the need to obtain authentication information over the network or the authentication process needs to be used on the network, for example through an authentication server. Device authentication is when you need to use a specific device to obtain authentication information or the authentication process requires a specific device, such as using USB-key.

2 Access program verification has direct verification procedures, program certification and other verification methods. A direct verification procedure is to confirm that an access program meets the requirements based on the given program information, such as the name of the verification program and the process attribute of the verification program. Procedural verification means that the access program provides data information that proves that it has access rights, such as a digital certificate with the meaning of access authorization.

3 use environment verification can be divided into computer hardware environment, computer software environment, computer network environment. Hardware environment verification is the verification of hardware that contains a specific identity or specific functionality within a computer, such as a network card that specifies a MAC address. Software environment verification refers to verifying that specific software is installed or running on a computer, such as running specific security detection software. A computer network environment means that the authentication is in a specific network, such as a specific network computer.

In Fig. 2, a partial type of verification method is illustrated. Access control setting information

In the present embodiment, on the basis that the file system stores the file and the directory using the index method, the access control setting information is saved in the form of the internal data structure of the file system. The specific storage method is:

The access control setting information of 1 file (directory) is recorded on a separate physical block, and the number of occupied physical blocks is determined by the content size of the access control setting information.

2 On the index block of the record file (directory) information, add the data item of the record access control setting information storage location. The data structure type of the data item is an array of pointers, and each pointer points to a physical block that records the contents of the access control settings.

Figure 3 shows the storage method of the access control setting information by taking a file as an example. Among them, there is a special area in the index block for recording the physical block holding the access control setting information.

In the present embodiment, the access control setting information records the access control requirements of the access operation, specifically the verification method associated with the access operation and the necessary information required for each verification method to be executed.

In the present embodiment, the xml markup language is used as a recording tool for access control setting information, and the contents of the access control setting information are recorded in a hierarchically nested form. Specific records can be taken in the following examples:

The content of a document is a company phone book, owned by ABC. ABC hopes that the reading of the phone book will require a network authentication license, and that the phone book modification must be on a computer with a specific MAC address and must pass a software tool called DocWriter.exe.

The access control setting information that satisfies the above requirements is shown in Fig. 4. The meanings of the main tags are as follows:

The access control is used to mark the entire access control setting information.

Operation is used to mark the access control requirements of an access operation.

The check method is used to mark content related to a verification method.

Param is used to mark the parameters used by the verification method.

The operationID is used to mark the identification string of the access operation.

checkID is used to mark the identification string of the authentication method.

In this implementation, the access operations associated with itself in the access control setting information of the file (directory) mainly include the following three types:

1 Content access operations around a directory or file. For example, for reading, writing, and executing files, reading and writing to directories. 2 Individual management operations around directories or files. For example, copying, renaming, deleting, moving, and modifying attribute operations for files and directories.

3 Access operations around access control settings information. For example, read and write operations for access control setting information. In this implementation, the access control setting information of the directory has the function of affecting the lower directory access operation and the lower file access operation, and the specific way is to store the access control requirements of the lower directory or the lower file to the directory access control setting. Information. For example, for an access operation, all files in the same directory have the same access control requirements, and the access control requirements of the access operation can be recorded in the access control setting information of the directory where the file is located.

In this implementation, each access operation within the storage control setup information is represented by a globally unique identification string. The naming rules for accessing the action ID string are:

1 The operation associated with the file (directory) itself directly uses the access operation name as the identification string. For example, the read operation is identified by read, and the read of the storage control setting information is identified by readconf ig.

2 The access operation associated with the subordinate directory or subordinate file uses the name of the access operation followed by '― dir ' or '-fi le ' as the identification string. For example, the identifier string corresponding to the read operation of all files in the directory is read_f i 1 e, and the identifier string corresponding to the write operation of all directories in the directory is write_dir.

Access control verification module

In this implementation, the substantive work of auditing access rights is performed by the access control verification module in a manner that performs various authentication methods associated with the access operations. The implementation work includes four aspects: (1) obtaining the access control requirements associated with the operation; (2) obtaining access methods for the verification methods included in each access control request; (3) executing each access control request in turn. The verification method included; (4) Determine the execution of the operation based on the verification result.

In this implementation, the access control requirements associated with the access operation mainly have two sources, one is the access control setting information of the file (directory) itself, and the other is carried by the upper directory on the path where the file (directory) is located. Access control settings information.

In this implementation, obtaining access control requirements associated with an access operation requires completion of both aspects of the work. First, the access control setting information of the file (directory) itself is traversed, and the identification string corresponding to the access operation is used to find the access control request corresponding to the access operation. Secondly, according to the path of the file (directory), starting from the root directory, the access control setting information of each level of the directory is retrieved by using the identification string representing the access operation of the lower-level file (directory), and is used to find the access that affects the access operation. Control requirements.

In this implementation, the access control setting information accessing process of the file (directory) is: accessing the index node of the record file (directory) information, finding the data item of the record storage access control setting information access location; traversing the data item Each pointer member realizes the purpose of accessing the access control setting information content by accessing the physical block pointed to by the pointer.

In this implementation, since the verification methods in the access control setting information are all characterized by the identification string, after the storage control requirements associated with the access operation are collected, the verification method included in each access control request is also required. The identity string is converted to a form that can be called by the execution code.

In this implementation, in order to complete the conversion of the verification method identification string to the execution code calling form, the file system maintains a static method mapping table and a dynamic method mapping table for the static verification method and the dynamic verification method, respectively. The two mapping tables respectively store the mapping relationship between the static verification method identification string and the static verification method function pointer, and the dynamic verification method identifier The mapping between the string and the dynamic authentication method access entry.

In this implementation, the initial construction and runtime updates of the data content of the static method mapping table and the dynamic method mapping table follow the following principles:

1 The construction of the static method mapping table is completed directly when the file system is loaded. The data content of the static method map remains unchanged during the run.

The construction of the dynamic method mapping table is completed when the access control verification module first uses the dynamic verification method. The basic way of constructing is to read the configuration file that records the mapping between the dynamic authentication method access path and the dynamic authentication method identification string. When the dynamic authentication method identifies the string query failure, the access control verification module directly views the configuration file and updates the data content of the dynamic method mapping table.

In this implementation, in order to use the verification method, the access control verification module needs to first extract the verification method category information from the verification method identification string, and then obtain the dynamic method mapping table or the static method mapping table according to the category of the verification method. The access point to the authentication method.

In the present embodiment, after obtaining the access entries of the respective verification methods, the access control verification module sequentially executes the verification methods covered by the access control requirements. The execution order of the specific verification method is divided into two levels:

1 Between different access control setting information, the verification method of each associated access control request record is stepwise executed from the upper layer to the lower layer according to the path of the file (directory).

2 Within the same access control requirement, the associated verification method is executed according to the order of the records.

In the present embodiment, when the verification method is executed, the parameters recorded in the access control request are used as the input data required for the verification method, that is, the content of the parameter keyword tag in the access control request is used to pass the verification method. For example, the content marked by the param keyword in Figure 4.

In this implementation, the access control verification module will obtain the verification result after executing each verification method, and if the verification result indicates that the verification step fails to execute, the execution of the access operation is denied.

In this implementation, the access control verification module cannot find the access entry of the associated authentication method in the access control request, and then denies the access operation.

Program access interface

In this implementation, the program access interface provided by the file system to the upper layer application is composed of three parts, which are: 1. A common access interface of a typical file system, such as file reading, file writing, etc.; 2. Access control setting information Access interfaces, such as read, write, delete, etc. of access control settings information. 4. Individual management access interfaces for files and directories, such as file and directory movement and replication.

In this implementation, when the upper application implements the file (directory) individual management function through the universal access interface, the access control verification process involved is not the same as directly calling the corresponding individual management access interface. For example, for a file, two common access operations, read and write, can be used to implement operational replication in the individual management access interface. However, in the access control verification, the former involves the read operation of the source file and the access control of the target directory, and the latter involves the copy operation of the source file and the access control verification of the write operation of the target directory.

other aspects

In this implementation, when a file (directory) with access control setting information is moved or copied between a file system supporting and supporting a custom access control mode, file (directory) access setting information is to be encapsulated. Or disassembly operations. Specifically:

1 When a file is moved from a file system that supports a custom access control mode to a file system that does not support the custom access control mode, the access control setting information is saved as a file system that does not support the access control setting information. A separate file.

2 When a file is moved from a file system that does not support the custom access control mode to a file system that supports the custom access control mode, the access control setting information is derived from the separate file of the record access control setting information, and is Store the storage location in the file system that supports the custom access control mode.

In the present embodiment, in a file system that does not support the custom access control mode, the file in which the access control setting information is recorded has the same file name as the content file, but the suffix name uses a dedicated suffix.

In addition, although an embodiment of the invention has been disclosed above, the invention is not limited to the specific forms or forms disclosed. Those skilled in the art will understand that the equivalents obtained without departing from the scope, scope and spirit of the invention are also in the scope of the invention.

Claims

Claim 1 is a method for providing a custom access control method in a file system, comprising the steps of:

(1) The file system provides multiple verification methods and supports the addition of new verification methods;

(2) recording the verification method associated with the access operation and the necessary information required for the execution of the associated verification method in the access control setting information of the file (directory);

(3) for the access operation of the file (directory), the access control work process is each verification method associated with performing the access operation;

(4) The file system provides an access interface for operating access control setting information.

The verification method according to claim 1, characterized in that the verification method exists in the form of a function function for verifying whether the access operation meets the execution condition.

The execution condition as set forth in claim 2, characterized in that the content of the execution condition is determined by the work process of the verification method and the necessary information required for the execution of the verification method.

4. Execution conditions as recited in claim 2, characterized by: requiring the visitor to have a legal identity specifying the authentication system. 5. An execution condition as recited in claim 2, characterized by: requiring the access program to have a specified attribute.

6. Execution conditions as recited in claim 2, characterized by: requiring the computer hardware, software or network environment to have defined characteristics.

The access control work process of claim 1 wherein: the execution results of all associated verification methods collectively determine whether the access operation is approved for execution.