CA2167791A1 - Method and apparatus for preventing inadvertent changes to system-critical files in a computing system - Google Patents
Method and apparatus for preventing inadvertent changes to system-critical files in a computing systemInfo
- Publication number
- CA2167791A1 CA2167791A1 CA002167791A CA2167791A CA2167791A1 CA 2167791 A1 CA2167791 A1 CA 2167791A1 CA 002167791 A CA002167791 A CA 002167791A CA 2167791 A CA2167791 A CA 2167791A CA 2167791 A1 CA2167791 A1 CA 2167791A1
- Authority
- CA
- Canada
- Prior art keywords
- access
- identification
- sub
- disk
- modifying
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
- G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
Abstract
System-critical files are protected from being inadvertently modified or deleted by placing them in a Reserve name space of storage that requires any process seeking modifying access to the Reserve name space to have a "Right"
to do so. The right to modifying access is garnered by a process first making a call to a system library procedure that causes a memory-stored data structure associated with the calling process to be modified, identifying the process as one with a Right to make modifying access to the Reserve name space. Any attempt to modify, delete, or create any file residing in the Reserve name space without the Right will be refused.
to do so. The right to modifying access is garnered by a process first making a call to a system library procedure that causes a memory-stored data structure associated with the calling process to be modified, identifying the process as one with a Right to make modifying access to the Reserve name space. Any attempt to modify, delete, or create any file residing in the Reserve name space without the Right will be refused.
Description
" 216779~
PATENT
Attorney Docket No. 10577-349 METHOD AND APPARATUS FOR PREVENTING INADVERTENT
CHANGES TO SYSTEM-CRITICAL FILES IN A COMPUTING
SYSTEM
BACKGROUND OF THE lNv~NllON
The present invention is directed to data processing systems, and in particular to a method, and apparatus for implementing that method, of protecting files carried by a storage medium from inadvertently being modified, changed, or deleted.
In computing systems there are often created sensitive, system-critical files that must remain inviolate and/or protected against inadvertent modification. One example, and one to which the present invention is directed, of a system-critical file is an audit trail file that is used to track the history of changes made to a dat~hA~. The audit trail file can be relied upon to reconstruct the database should it, for whatever reason, become corrupted, or otherwise lost. The application program or "process" responsible for managing and maint~; ni ~g the dat~hAce will periodically make changes or modifications to the managed database (e.g., ~;ng or modifying a record, etc.). Each such change or modification to the datAhA~e will result in the creation of an audit record to reflect the change. The audit record is ~rr~nAed to the associated audit trail file kept on disk.
Should some other process not associated with the audit trail file for some reason inadvertently modify or delete it, the likelihood exists that the ability to reconstruct the associated datAh~e has been lost. For this r~ACon the audit trail file must be protected from inadvertent changes that will affect the ability to correctly reconstruct the associated data base. Thus, while read-only access may be ., . . . . . _ . . . . .
216~7~1 granted to an audit trail file of a database (or other maintained data segment/structure), any modifying access to that audit trail file must be limited only those process~c n~e~i ng such access.
SUMMARY OF THE lNv~NllON
The present invention is used in the context of a processing system having secondary storage (e.g., disk) for keeping various files, including audit trail files. It is convenient for purposes not related to this invention to partition the name of the secondary storage according to component (i.e., which physical disk if more than one), sub-volume, and file name for all files on disk, including system-critical files, such as an audit trail file. Associated or related files may be stored in different sub-volumes.
According to the invention, one of the sub-volumes is designated as a "Reserve" sub-volume for system-critical files, such as audit trail files of associated dat~h~D
structures.
Further, the system with which the invention is used is structured to provide various services, in the form of service procecseC~ to the application proc~cs~s (e.g., the dat~h~-c~
management process) in generally conventional fashion. Thus, if an application needs to access secondary storage, e.g., disk, it sends a request to the service process (the "disk process") responsible for managing that secondary storage (disk).
The present invention provides a method, of limiting modifying access to the Reserve sub-volume to only those application procesceC having a need to make such access. All other proceCc~c may make read access for viewing any files maintained in the Reserve sub-volume, but any attempt to modify, delete, or create any file residing in the Reserve sub-volume will be refused.
216~91 Broadly, the method of the present invention involves providing application processes with the ability to identify themselves as having a "Right" to make modifying access to the sub-volume. This Right is included in the request for disk service sent by the application process to the disk process.
If the request seeks modifying access to the reserve sub-volume, the disk process will check to see if the request contains the Right, and if not refuse to comply with the request.
According to an embodiment of the invention, the requests to the disk process for access will include a "Flag Word,"
contAin;~g information describing and relative to the requesting process. One bit of the Flag Word, when set to one state, identifies the requesting process as having the Right to make a modifying access of the reserved sub-volume area.
According to an additional embodiment of the invention, requests are assembled by an application process from information pulled from a data segment kept in a main memory and associated with the application process. The data segment includes information used by the associated process. Certain of that information is included in the service request to provide details about the requesting process (e.g., identity, and type, etc.), and will of course include the Flag Word. In order to obtain the Right to make a modifying access to a Reserve sub-volume, the application process must, at some time, make a call to a system library procedure which, in turn, will cause the bit in the Flag Word n~AeA for modifying A~c~sc to a Reserve sub-volume to be set to the proper state ~eA~A by the requesting ~L~e~s. This bit in the flag word will remain set for the life of the process.
There are a number of advantages to the method of the present invention. First, there i8 no need to create ~reri Al service pror~C-e~, as has been done in the past, for providing modifying access to system critical files. Rather, a service process may be conventional and available for use by any 21~7~91 application process, including those neeAing to make a modifying access to a Reserve sub-volume. The particular service process need only the ability to determine, from the request, whether an application process requesting modifying access to a Reserve sub-volume has the proper Right.
The security afforded system-critical files by the present invention is in addition to the security fur~i-ch~ by more the conventional methods of requiring passwords or other known security devices.
These and other aspects and advantages of the present invention will become evident to those skilled in this art upon a re~ g of the following detailed description of the invention, which should be taken in conjunction with the accompanying drawings.
BRIEF DESCRIPTION OF ln~ DRAWINGS
Fig. 1 is a representation of a processing system with which the invention may be used: and Fig. 2 is a cQnc~ptual representation of the portion of secondary storage space of Fig. 1, in the form of a disk system, that includes the sub-volume space reserved for system-critical files according to the teachings of the present invention.
DETATt~n DESCRIPTION OF THE lNv~NllON
The present invention was developed for use in a multiple processor system such as illustrated in U.S. Patent No.
4,228,496. In the context of such a system, application pro~cse-C operating on one of the multiple procQC~Qrs may request the service of a _ervice ~vce~s residing on another prsc~C~or~ such as a disk process e_roncible for managing, main~ ing~ and accessing that portion of the system's -Q~Q~ry storage implemented by disk storage. Inte~ o~eCcor requests for service of a service process use a messaging system, and an inte ~ocessor bus archite~u-e, that permits messages to be routed between the multiple processors.
However, if the application process requesting service and the requested service process reside on the same processor, the same messaging terh~ique is used, except that the request message is not put on the interprocessor communication architecture, but is transferred internally within the processor and placed on a queue of the service process for processing. The details of the particular messaging system are not n~C~sc~ry to the underst~ing or use of the present invention, and therefore are not described. It C~o~ be mentioned, as those skilled in this art most likely have surmised, that the invention can be used in a variety of environments, including a single pro~e60r environment.
Further, the invention is described in the context of a dat~h~-ce management system comprising an application management process and a disk process. In this context he disk process is responsible for recron~ing to requests to create, modify, and/or delete data files, including audit trail files, in the secondary storage space implemented by disk. The actual implementation of the management system, and the creation and management of audit trail files, in cecon~ry storage is somewhat complex, involving as it does the application management process, and the services of a data disk process (for performing the tasks of the actual formation, management, access to the stored da~AhA~e), an audit trail disk process (for maintAi~inq and updating the audit trail file), and a transaction monitor process ~ ible for, among other things, creating the audit trail file). In this actual implementation, the data disk procesæ
generates audits that are p~c~e~ to the audit trail disk process for update of the audit trail file.
However, since the actual environment in which the present invention is not believed ~e~ CcArily relevant to the unders~An~ i n~ and use of the invention, and in order not to unduly complicate the description of the invention, the i invention is described in the context of a single procescor 216~7~1 and associated input/ouL~L (I/0) system, ~l~nin~ an application management process, and a disc process. The application management process performs the creation of both the da~h~e and the audit trail file through the services of the disk process, and has the responsibility of maint~inin~
and updating both. For those interested in the actual environment with which this invention is used, reference may be made to Application Ser. No. for "Multi-Volume Audit Trails for Fault Tolerant Computers," filed con~uL el-Lly herewith (Attorney's Docket No. 10577-034200), and assigned to the assignee of this application.
Referring now to Fig. 1, there is illustrated a processing system, designated generally with the reference numeral 10, comprising a central processing unit (CPU) 12, including a memory 14, coupled by an I/0 bus 18 to a secQ~Ary storage 15 that includes a disk system 16. Although not shown, it will be appreciated that the cecon~ry storage 15 can also include other storage mediums, such as tape, or semiconductor. In addition, the secondary storage 15 may share the I/0 bus 18 with other peripheral devices (e.g., communications devices, printers, terminals, and the like).
Data, CO~.~LO1 information, and the like are communicated between the CPU 12 and disk system 16 via the I/0 bus 18 in conventional fashion. It will be appreciated that multiple disk units may used to form the disk system 16.
The CPU 12 may have ~-n~i n~ ( for example, using conventional time-share or multi-t~in~ techniques) application or other programs or "~LO~-c~c" Pl, P2,..., Pn, including a service (disk) ~Lo~ess Pi. ~ociated with each process Pl,..., PN, and stored in the memory 14, may be a data structure D(Pl),..., D(Pn).
Assuming, for example, the process Pl is a datAhA~e management process, Le_~ol-sible for managing and maintAining a database that is stored on the disk system 16. In addition, and as is often conventional, an associated audit trail file _ 7 will be created and periodically updated by the database process Pl. Both the database and the audit trail file may be stored on the disk system 16, but preferably on different disk units for reasons of improved performance fault tolerance. In order to access either, the database process Pl will use the services of a disk process Pi. The disk process Pi is structured to perform the operations nec~C~ry to initiate acc SR~C to the disk system, in accordance with requests for such access, to create, move, purge (delete), modify files, or other related operations. Thus, for example, the dat~h~-?
managed by the dat~h~ process P1 will send the requests to the disk process Pi n~cecs~ry to first create the datAhAce file on the disk system 16. Subsequently, as the database process Pl manages and maintains the dat~h~, it will send additional requests to the disk process Pi to perform these tasks.
Files stored in secondary storage 15 of the processing system 10 use the naming convention described above of compo~nt, sub-volume, file name to identify the storage space within the cecn~Ary storage 15 of those files. Thus, the datAh~D created and maintAine~ by the database process Pl would be identified by the physical disk unit at which it is stored, together with a sub-volume qualifier, and a file name.
The audit trail file created to maintain the history of any and all changes, modifications, etc. to the database managed by the datAh~? process P1 would be similarly created, maintA i n~, and named. As indicated above, although the dat~h~? and its associated audit trail file could be stored on the same medium (i.e., disk unit) in se~o~ry storage 15, it is preferred that they be kept at different units.
Turning for the moment to Fig. 2 there is illustrated a disk unit 16a the disk unit forming that part of c~co~ry storage cont~i ni ~ the Reserve sub-volume space 22. It should be appreciated that the Reserve sub-volume space 22, as shown in Fig. 2, is not a physical partition of the disk unit 16a, but is a ~ ual representation of the Reserve sub-volume ... ..
'` 21677gl _ 8 space 22 only; it is a name space, not a physical location on any medium.
Continuing with Fig. 2, the disk process P1, as is conventional, is structured to determine from requests for access to secondary storage where in the storage space of the e~cnn~ry storage lS the access is to be made from the component/sub-volume/file name that accompanies the request.
The disk process also identifies the requesting process, the type of access reguested, and whatever other information its needs to perform the request. In addition, if the request is to modify a file with the sub-volume 22 qualifier, the disk process Pl will determine if the request has a "Right" to make such request from the request. If the request does not identify the Right, the request is denied, and the requesting process will be so notified.
Pror~eees P1, P2,..., Pn may obtain the Right to modifying access by making a call to a system library procedure specifically for granting that Right. The called system library procedure, in turn, will access the data segment D associated with the calling process, and set a bit in a Flag Word that forms a part of the data segment to a particular state. Only those processes te.g., the dat~hAr~
process P1 of the above example) are structured to make such calls, so that only those ~LO~e-7C~S n~e~nq modifying ~rceæs to fiies in the Reserve sub-volume space 22 of cecon~ry storage can obtain the Right.
A an example, assume that the dat~h~o process P1 will want to protect the audit trail file associated with the dat~h~o it is maintAinin~. In order to effect such protection, the dat~h~ce process P1 will want to create and maintain the audit trail file in the Reserve sub-volume space 3S 22 to prevent unauthorized modifying access to that file.
Accordingly, in order to gain the Right to make such access to create the audit trail file, the dat~h~ce process Pl will make a system library proc~ re call to a predetermined p-o~
216~79~
_ 9 which will, when called, modify the Flag Word of the data segment D1 stored in memory 14, and associated with the process P1, to modify the Flag bit of the Flag Word. The modification will set the Flag bit to a state that identifies the da~h~s~ process P1 as having a Right to make modifying accesses to the Reserve sub-volume space of secondary storage 16, i.e., the sub-volume space 22.
When the database process P1 creates, or subsequently modifies, the audit trail file associated with the dat~h~ is managing, the database process P1 will form a request message to be forwarded to the disk process Pi. The access request message will be formed by using certain information from the data segment D1 associated with the dat~h~ce process P1, including the Flag Word. Thus, when the access request message is received by the disk process Pi, the message will be inspected in order to determine what is requested. At the time of inspection, if the disk process Pi determines that the request is for a modifying access to the Reserved sub-volume 22, it will also check to see if the Right Flag bit is set.
If not, the request will be refused, and not acted upon. If, however, the bit is set to the requisite state, the request will be honored.
In summary, there has been disclosed a mech~n;sm for protecting system-critical files kept in a storage space from inadvertent modifying access by reserving modifying access to only those proceccec having the need to do so. Although the invention has been described in the context of a simplistic dat~h~ management system, it will be evident to those skilled in the art that the invention can be used in co~otion with maint~i~ing and similarly protecting other system-critical files. For example, although the invention has been described in terms of its use in protecting audit trail files, the invention is just as applicable for use in similarly protecting other system-critical files such as password files, or database catalog files.
PATENT
Attorney Docket No. 10577-349 METHOD AND APPARATUS FOR PREVENTING INADVERTENT
CHANGES TO SYSTEM-CRITICAL FILES IN A COMPUTING
SYSTEM
BACKGROUND OF THE lNv~NllON
The present invention is directed to data processing systems, and in particular to a method, and apparatus for implementing that method, of protecting files carried by a storage medium from inadvertently being modified, changed, or deleted.
In computing systems there are often created sensitive, system-critical files that must remain inviolate and/or protected against inadvertent modification. One example, and one to which the present invention is directed, of a system-critical file is an audit trail file that is used to track the history of changes made to a dat~hA~. The audit trail file can be relied upon to reconstruct the database should it, for whatever reason, become corrupted, or otherwise lost. The application program or "process" responsible for managing and maint~; ni ~g the dat~hAce will periodically make changes or modifications to the managed database (e.g., ~;ng or modifying a record, etc.). Each such change or modification to the datAhA~e will result in the creation of an audit record to reflect the change. The audit record is ~rr~nAed to the associated audit trail file kept on disk.
Should some other process not associated with the audit trail file for some reason inadvertently modify or delete it, the likelihood exists that the ability to reconstruct the associated datAh~e has been lost. For this r~ACon the audit trail file must be protected from inadvertent changes that will affect the ability to correctly reconstruct the associated data base. Thus, while read-only access may be ., . . . . . _ . . . . .
216~7~1 granted to an audit trail file of a database (or other maintained data segment/structure), any modifying access to that audit trail file must be limited only those process~c n~e~i ng such access.
SUMMARY OF THE lNv~NllON
The present invention is used in the context of a processing system having secondary storage (e.g., disk) for keeping various files, including audit trail files. It is convenient for purposes not related to this invention to partition the name of the secondary storage according to component (i.e., which physical disk if more than one), sub-volume, and file name for all files on disk, including system-critical files, such as an audit trail file. Associated or related files may be stored in different sub-volumes.
According to the invention, one of the sub-volumes is designated as a "Reserve" sub-volume for system-critical files, such as audit trail files of associated dat~h~D
structures.
Further, the system with which the invention is used is structured to provide various services, in the form of service procecseC~ to the application proc~cs~s (e.g., the dat~h~-c~
management process) in generally conventional fashion. Thus, if an application needs to access secondary storage, e.g., disk, it sends a request to the service process (the "disk process") responsible for managing that secondary storage (disk).
The present invention provides a method, of limiting modifying access to the Reserve sub-volume to only those application procesceC having a need to make such access. All other proceCc~c may make read access for viewing any files maintained in the Reserve sub-volume, but any attempt to modify, delete, or create any file residing in the Reserve sub-volume will be refused.
216~91 Broadly, the method of the present invention involves providing application processes with the ability to identify themselves as having a "Right" to make modifying access to the sub-volume. This Right is included in the request for disk service sent by the application process to the disk process.
If the request seeks modifying access to the reserve sub-volume, the disk process will check to see if the request contains the Right, and if not refuse to comply with the request.
According to an embodiment of the invention, the requests to the disk process for access will include a "Flag Word,"
contAin;~g information describing and relative to the requesting process. One bit of the Flag Word, when set to one state, identifies the requesting process as having the Right to make a modifying access of the reserved sub-volume area.
According to an additional embodiment of the invention, requests are assembled by an application process from information pulled from a data segment kept in a main memory and associated with the application process. The data segment includes information used by the associated process. Certain of that information is included in the service request to provide details about the requesting process (e.g., identity, and type, etc.), and will of course include the Flag Word. In order to obtain the Right to make a modifying access to a Reserve sub-volume, the application process must, at some time, make a call to a system library procedure which, in turn, will cause the bit in the Flag Word n~AeA for modifying A~c~sc to a Reserve sub-volume to be set to the proper state ~eA~A by the requesting ~L~e~s. This bit in the flag word will remain set for the life of the process.
There are a number of advantages to the method of the present invention. First, there i8 no need to create ~reri Al service pror~C-e~, as has been done in the past, for providing modifying access to system critical files. Rather, a service process may be conventional and available for use by any 21~7~91 application process, including those neeAing to make a modifying access to a Reserve sub-volume. The particular service process need only the ability to determine, from the request, whether an application process requesting modifying access to a Reserve sub-volume has the proper Right.
The security afforded system-critical files by the present invention is in addition to the security fur~i-ch~ by more the conventional methods of requiring passwords or other known security devices.
These and other aspects and advantages of the present invention will become evident to those skilled in this art upon a re~ g of the following detailed description of the invention, which should be taken in conjunction with the accompanying drawings.
BRIEF DESCRIPTION OF ln~ DRAWINGS
Fig. 1 is a representation of a processing system with which the invention may be used: and Fig. 2 is a cQnc~ptual representation of the portion of secondary storage space of Fig. 1, in the form of a disk system, that includes the sub-volume space reserved for system-critical files according to the teachings of the present invention.
DETATt~n DESCRIPTION OF THE lNv~NllON
The present invention was developed for use in a multiple processor system such as illustrated in U.S. Patent No.
4,228,496. In the context of such a system, application pro~cse-C operating on one of the multiple procQC~Qrs may request the service of a _ervice ~vce~s residing on another prsc~C~or~ such as a disk process e_roncible for managing, main~ ing~ and accessing that portion of the system's -Q~Q~ry storage implemented by disk storage. Inte~ o~eCcor requests for service of a service process use a messaging system, and an inte ~ocessor bus archite~u-e, that permits messages to be routed between the multiple processors.
However, if the application process requesting service and the requested service process reside on the same processor, the same messaging terh~ique is used, except that the request message is not put on the interprocessor communication architecture, but is transferred internally within the processor and placed on a queue of the service process for processing. The details of the particular messaging system are not n~C~sc~ry to the underst~ing or use of the present invention, and therefore are not described. It C~o~ be mentioned, as those skilled in this art most likely have surmised, that the invention can be used in a variety of environments, including a single pro~e60r environment.
Further, the invention is described in the context of a dat~h~-ce management system comprising an application management process and a disk process. In this context he disk process is responsible for recron~ing to requests to create, modify, and/or delete data files, including audit trail files, in the secondary storage space implemented by disk. The actual implementation of the management system, and the creation and management of audit trail files, in cecon~ry storage is somewhat complex, involving as it does the application management process, and the services of a data disk process (for performing the tasks of the actual formation, management, access to the stored da~AhA~e), an audit trail disk process (for maintAi~inq and updating the audit trail file), and a transaction monitor process ~ ible for, among other things, creating the audit trail file). In this actual implementation, the data disk procesæ
generates audits that are p~c~e~ to the audit trail disk process for update of the audit trail file.
However, since the actual environment in which the present invention is not believed ~e~ CcArily relevant to the unders~An~ i n~ and use of the invention, and in order not to unduly complicate the description of the invention, the i invention is described in the context of a single procescor 216~7~1 and associated input/ouL~L (I/0) system, ~l~nin~ an application management process, and a disc process. The application management process performs the creation of both the da~h~e and the audit trail file through the services of the disk process, and has the responsibility of maint~inin~
and updating both. For those interested in the actual environment with which this invention is used, reference may be made to Application Ser. No. for "Multi-Volume Audit Trails for Fault Tolerant Computers," filed con~uL el-Lly herewith (Attorney's Docket No. 10577-034200), and assigned to the assignee of this application.
Referring now to Fig. 1, there is illustrated a processing system, designated generally with the reference numeral 10, comprising a central processing unit (CPU) 12, including a memory 14, coupled by an I/0 bus 18 to a secQ~Ary storage 15 that includes a disk system 16. Although not shown, it will be appreciated that the cecon~ry storage 15 can also include other storage mediums, such as tape, or semiconductor. In addition, the secondary storage 15 may share the I/0 bus 18 with other peripheral devices (e.g., communications devices, printers, terminals, and the like).
Data, CO~.~LO1 information, and the like are communicated between the CPU 12 and disk system 16 via the I/0 bus 18 in conventional fashion. It will be appreciated that multiple disk units may used to form the disk system 16.
The CPU 12 may have ~-n~i n~ ( for example, using conventional time-share or multi-t~in~ techniques) application or other programs or "~LO~-c~c" Pl, P2,..., Pn, including a service (disk) ~Lo~ess Pi. ~ociated with each process Pl,..., PN, and stored in the memory 14, may be a data structure D(Pl),..., D(Pn).
Assuming, for example, the process Pl is a datAhA~e management process, Le_~ol-sible for managing and maintAining a database that is stored on the disk system 16. In addition, and as is often conventional, an associated audit trail file _ 7 will be created and periodically updated by the database process Pl. Both the database and the audit trail file may be stored on the disk system 16, but preferably on different disk units for reasons of improved performance fault tolerance. In order to access either, the database process Pl will use the services of a disk process Pi. The disk process Pi is structured to perform the operations nec~C~ry to initiate acc SR~C to the disk system, in accordance with requests for such access, to create, move, purge (delete), modify files, or other related operations. Thus, for example, the dat~h~-?
managed by the dat~h~ process P1 will send the requests to the disk process Pi n~cecs~ry to first create the datAhAce file on the disk system 16. Subsequently, as the database process Pl manages and maintains the dat~h~, it will send additional requests to the disk process Pi to perform these tasks.
Files stored in secondary storage 15 of the processing system 10 use the naming convention described above of compo~nt, sub-volume, file name to identify the storage space within the cecn~Ary storage 15 of those files. Thus, the datAh~D created and maintAine~ by the database process Pl would be identified by the physical disk unit at which it is stored, together with a sub-volume qualifier, and a file name.
The audit trail file created to maintain the history of any and all changes, modifications, etc. to the database managed by the datAh~? process P1 would be similarly created, maintA i n~, and named. As indicated above, although the dat~h~? and its associated audit trail file could be stored on the same medium (i.e., disk unit) in se~o~ry storage 15, it is preferred that they be kept at different units.
Turning for the moment to Fig. 2 there is illustrated a disk unit 16a the disk unit forming that part of c~co~ry storage cont~i ni ~ the Reserve sub-volume space 22. It should be appreciated that the Reserve sub-volume space 22, as shown in Fig. 2, is not a physical partition of the disk unit 16a, but is a ~ ual representation of the Reserve sub-volume ... ..
'` 21677gl _ 8 space 22 only; it is a name space, not a physical location on any medium.
Continuing with Fig. 2, the disk process P1, as is conventional, is structured to determine from requests for access to secondary storage where in the storage space of the e~cnn~ry storage lS the access is to be made from the component/sub-volume/file name that accompanies the request.
The disk process also identifies the requesting process, the type of access reguested, and whatever other information its needs to perform the request. In addition, if the request is to modify a file with the sub-volume 22 qualifier, the disk process Pl will determine if the request has a "Right" to make such request from the request. If the request does not identify the Right, the request is denied, and the requesting process will be so notified.
Pror~eees P1, P2,..., Pn may obtain the Right to modifying access by making a call to a system library procedure specifically for granting that Right. The called system library procedure, in turn, will access the data segment D associated with the calling process, and set a bit in a Flag Word that forms a part of the data segment to a particular state. Only those processes te.g., the dat~hAr~
process P1 of the above example) are structured to make such calls, so that only those ~LO~e-7C~S n~e~nq modifying ~rceæs to fiies in the Reserve sub-volume space 22 of cecon~ry storage can obtain the Right.
A an example, assume that the dat~h~o process P1 will want to protect the audit trail file associated with the dat~h~o it is maintAinin~. In order to effect such protection, the dat~h~ce process P1 will want to create and maintain the audit trail file in the Reserve sub-volume space 3S 22 to prevent unauthorized modifying access to that file.
Accordingly, in order to gain the Right to make such access to create the audit trail file, the dat~h~ce process Pl will make a system library proc~ re call to a predetermined p-o~
216~79~
_ 9 which will, when called, modify the Flag Word of the data segment D1 stored in memory 14, and associated with the process P1, to modify the Flag bit of the Flag Word. The modification will set the Flag bit to a state that identifies the da~h~s~ process P1 as having a Right to make modifying accesses to the Reserve sub-volume space of secondary storage 16, i.e., the sub-volume space 22.
When the database process P1 creates, or subsequently modifies, the audit trail file associated with the dat~h~ is managing, the database process P1 will form a request message to be forwarded to the disk process Pi. The access request message will be formed by using certain information from the data segment D1 associated with the dat~h~ce process P1, including the Flag Word. Thus, when the access request message is received by the disk process Pi, the message will be inspected in order to determine what is requested. At the time of inspection, if the disk process Pi determines that the request is for a modifying access to the Reserved sub-volume 22, it will also check to see if the Right Flag bit is set.
If not, the request will be refused, and not acted upon. If, however, the bit is set to the requisite state, the request will be honored.
In summary, there has been disclosed a mech~n;sm for protecting system-critical files kept in a storage space from inadvertent modifying access by reserving modifying access to only those proceccec having the need to do so. Although the invention has been described in the context of a simplistic dat~h~ management system, it will be evident to those skilled in the art that the invention can be used in co~otion with maint~i~ing and similarly protecting other system-critical files. For example, although the invention has been described in terms of its use in protecting audit trail files, the invention is just as applicable for use in similarly protecting other system-critical files such as password files, or database catalog files.
Claims (6)
1. In a data processing system of a type including a processing unit and a storage system arranged to store data files in one or more sub-volumes spaces, the processing unit operating in response to a number of application processes, including a storage process responsible for making accesses to the storage system in response to requests therefor by ones of the number of processes, a method of protecting against inadvertent modification or creation of files in a reserved one of the sub-volumes, comprising the steps of:
providing each of the processes needing modifying access to the one of the number of sub-volumes with an identification; and requesting access to the reserved one of the sub-volumes through the storage process with the identification, for requests seeking modifying access to the reserved sub-volume, the storage process checking the identification and refusing access if the identification is not for a modifying access, and granting access if the identification so permits.
providing each of the processes needing modifying access to the one of the number of sub-volumes with an identification; and requesting access to the reserved one of the sub-volumes through the storage process with the identification, for requests seeking modifying access to the reserved sub-volume, the storage process checking the identification and refusing access if the identification is not for a modifying access, and granting access if the identification so permits.
2. The method of claim 1, wherein the step of providing includes having the processes needing modifying access to call a library procedure.
3. The method of claim 1, wherein the step of requesting access includes forming a request message that is communicated to the storage process.
4. The method of claim 3, wherein the processing system includes a memory for storing data, and the step of forming the request message includes retrieving from the memory message data including the identification.
5. The method of claim 4, wherein the providing step includes calling to a system library procedure for the identification.
6. The method of claim 5, wherein the step of calling the system library procedure includes modifying the message data in the memory to provide the identification.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US08/377,385 | 1995-01-23 | ||
| US08/377,385 US5978914A (en) | 1995-01-23 | 1995-01-23 | Method and apparatus for preventing inadvertent changes to system-critical files in a computing system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CA2167791A1 true CA2167791A1 (en) | 1996-07-24 |
Family
ID=23488909
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA002167791A Abandoned CA2167791A1 (en) | 1995-01-23 | 1996-01-22 | Method and apparatus for preventing inadvertent changes to system-critical files in a computing system |
Country Status (5)
| Country | Link |
|---|---|
| US (1) | US5978914A (en) |
| EP (1) | EP0723231B1 (en) |
| JP (1) | JPH08263356A (en) |
| CA (1) | CA2167791A1 (en) |
| DE (1) | DE69613722T2 (en) |
Families Citing this family (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO1999066383A2 (en) * | 1998-06-15 | 1999-12-23 | Dmw Worldwide, Inc. | Method and apparatus for assessing the security of a computer system |
| US6256646B1 (en) * | 1998-07-13 | 2001-07-03 | Infraworks Corporation | Method and system for identifying the state of a media device by monitoring file system calls |
| CA2244626A1 (en) * | 1998-07-31 | 2000-01-31 | Kom Inc. | A hardware and software system |
| US7536524B2 (en) | 1998-07-31 | 2009-05-19 | Kom Networks Inc. | Method and system for providing restricted access to a storage medium |
| US8234477B2 (en) | 1998-07-31 | 2012-07-31 | Kom Networks, Inc. | Method and system for providing restricted access to a storage medium |
| US9361243B2 (en) | 1998-07-31 | 2016-06-07 | Kom Networks Inc. | Method and system for providing restricted access to a storage medium |
| US6862683B1 (en) | 2000-03-24 | 2005-03-01 | Novell, Inc. | Method and system for protecting native libraries |
| US6775668B1 (en) * | 2000-09-11 | 2004-08-10 | Novell, Inc. | Method and system for enhancing quorum based access control to a database |
| US10963179B2 (en) | 2019-01-29 | 2021-03-30 | International Business Machines Corporation | Accidental-volume-removal prevention |
Family Cites Families (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US4228496A (en) * | 1976-09-07 | 1980-10-14 | Tandem Computers Incorporated | Multiprocessor system |
| JPS60107155A (en) * | 1983-11-16 | 1985-06-12 | Hitachi Ltd | Data protection system of storage volume |
| US5107443A (en) * | 1988-09-07 | 1992-04-21 | Xerox Corporation | Private regions within a shared workspace |
| US5146593A (en) * | 1989-03-06 | 1992-09-08 | International Business Machines Corporation | Procedure call interface |
| US5113442A (en) * | 1989-03-06 | 1992-05-12 | Lachman Associates, Inc. | Method and apparatus for providing access control in a secure operating system |
| GB9003890D0 (en) * | 1990-02-21 | 1990-04-18 | Rodime Plc | Method and apparatus for controlling access to and corruption of information in computer systems |
| US5032979A (en) * | 1990-06-22 | 1991-07-16 | International Business Machines Corporation | Distributed security auditing subsystem for an operating system |
| US5325519A (en) * | 1991-10-18 | 1994-06-28 | Texas Microsystems, Inc. | Fault tolerant computer with archival rollback capabilities |
| US5235642A (en) * | 1992-07-21 | 1993-08-10 | Digital Equipment Corporation | Access control subsystem and method for distributed computer system using locally cached authentication credentials |
| US5450593A (en) * | 1992-12-18 | 1995-09-12 | International Business Machines Corp. | Method and system for controlling access to objects in a data processing system based on temporal constraints |
| US5365587A (en) * | 1993-03-11 | 1994-11-15 | International Business Machines Corporation | Self modifying access code for altering capabilities |
-
1995
- 1995-01-23 US US08/377,385 patent/US5978914A/en not_active Expired - Lifetime
-
1996
- 1996-01-15 DE DE69613722T patent/DE69613722T2/en not_active Expired - Lifetime
- 1996-01-15 EP EP96300261A patent/EP0723231B1/en not_active Expired - Lifetime
- 1996-01-22 CA CA002167791A patent/CA2167791A1/en not_active Abandoned
- 1996-01-23 JP JP8008884A patent/JPH08263356A/en active Pending
Also Published As
| Publication number | Publication date |
|---|---|
| DE69613722T2 (en) | 2002-05-08 |
| JPH08263356A (en) | 1996-10-11 |
| DE69613722D1 (en) | 2001-08-16 |
| EP0723231B1 (en) | 2001-07-11 |
| US5978914A (en) | 1999-11-02 |
| EP0723231A3 (en) | 1996-09-18 |
| EP0723231A2 (en) | 1996-07-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US6108654A (en) | Method and system for locking resources in a computer system | |
| US6289458B1 (en) | Per property access control mechanism | |
| US7536524B2 (en) | Method and system for providing restricted access to a storage medium | |
| EP0834132B1 (en) | Security for computer system resources | |
| US7076624B2 (en) | Method and system for providing restricted access to a storage medium | |
| US6625603B1 (en) | Object type specific access control | |
| US4930073A (en) | Method to prevent use of incorrect program version in a computer system | |
| US5737600A (en) | Method and system for log management in a coupled data processing system | |
| JP2739029B2 (en) | How to control access to data objects | |
| US6618735B1 (en) | System and method for protecting shared system files | |
| US8054765B2 (en) | Systems and methods for providing variable protection | |
| US7526479B2 (en) | Configuration manager in enterprise computing system | |
| US6658571B1 (en) | Security framework for dynamically wrapping software applications executing in a computing system | |
| US5504814A (en) | Efficient security kernel for the 80960 extended architecture | |
| EP0803101B1 (en) | A mechanism for linking together the files of emulated and host system for access by emulated system users | |
| US20030009685A1 (en) | System and method for file system mandatory access control | |
| US20090271586A1 (en) | Method and system for providing restricted access to a storage medium | |
| US5884308A (en) | Updating distributed data files using active token distributed at different times to different sites | |
| JPH01188965A (en) | Data processing | |
| US20040030702A1 (en) | System and mehod for dynamically controlling access to a database | |
| JPH10232810A (en) | Device and method for permitting disconnected state write in client and server computer system | |
| WO1997026736A1 (en) | System for decryption and re-encryption of files | |
| CA2167791A1 (en) | Method and apparatus for preventing inadvertent changes to system-critical files in a computing system | |
| CA2177022A1 (en) | Customer information control system and method with temporary storage queuing functions in a loosely coupled parallel processing environment | |
| EP0049423B1 (en) | Multiprocessor system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| FZDE | Discontinued |