Method and system for providing restricted access to a storage medium
A method of restricting file access is disclosed wherein a set of file write access commands are determined from data stored within a storage medium. The set of file write access commands are for the entire storage medium. Any matching file write access command provided to the file system for that storage medium results in,an error message. Other file write access commands are, however, passed onto a device driver for the storage medium and are implemented. In this way commands such as file delete and file overwrite can be disabled for an entire storage medium.
1. A method of applying an operation access privilege to at least a logical portion of a logical storage medium in communication with a computer, the method comprising the steps of:
(a) providing an operation access privilege indicative of at least one of an enabled operation and/or a restricted operation to be performed on at least one logical portion of a logical storage medium;
(b) associating said operation access privilege with at least one logical portion of said logical storage medium;
(c) intercepting in a trap layer an attempted operation on said at least one logical portion identified by at least one data identifier, wherein said intercepting occurs regardless of an identity of a user attempting said attempted operation, and transparently to the user and transparently to a computer application invoking said operation; and
(d) at least one of allowing said attempted operation if matching said enabled operation, modifying and allowing said modified attempted operation, and/or denying said attempted operation if matching said restricted operation.
2. The method as defined in claim 1 , wherein said at least one logical portion of said logical storage medium comprises at least one of a volume, a partition, a directory, a special file, and/or a file.
3. The method as defined in claim 1 , wherein said at least one logical portion of said logical storage medium comprises an entire logical storage medium.
4. The method as defined in claim 1 , wherein said at least one data identifier comprises at least one of a file name, a file mask, a special file, and/or a directory.
5. The method as defined in claim 1 , wherein said operations comprise at least one of reading, executing, appending, creating new objects, deleting, renaming, moving, overwriting, modifying attributes, and/or modifying data object security.
6. The method as defined in claim 1 , further comprising:
(e) applying a plurality of operation access privileges to said at least one data identifier.
7. The method as defined in claim 1 , further comprising:
(e) applying a plurality of operation access privileges to said logical portion of said logical storage medium.
8. The method as defined in claim 1 , further comprising:
(e) applying said operation access privilege to said logical storage medium wherein said logical storage medium is itself a logical portion of another logical storage medium, and wherein a logical portion of said another logical storage medium is specified by at least one data identifier.
9. The method as defined in claim 8 , wherein said at least one data identifier comprises a free space portion.
10. The method as defined in claim 8 , wherein said at least one data identifier comprises newly created data.
11. The method according to claim 1 , wherein said operation access privilege comprises a file input/output (I/O) operation access privilege.
12. A system for applying an operation access privilege to at least a logical portion of a logical storage medium in communication with a computer, the system comprising:
providing means for providing an operation access privilege indicative of at least one of an enabled operation and/or a restricted operation to be performed on at least a logical portion of a logical storage medium;
associating means for associating said operation access privilege with at least one logical portion of said logical storage medium;
interception means for intercepting in a trap layer an attempted operation on said at least one logical portion identified by at least one data identifier, wherein said interception means performs regardless of an identity of a user attempting said attempted operation, and transparently to the user and transparently to a computer application invoking said operation; and
at least one of allowing means for allowing said attempted operation if matching said enabled operation, modifying and allowing means for modifying and allowing said modified attempted operation, and/or denial means for denying said attempted operation if matching said restricted operation.
13. The system as defined in claim 12 , wherein said at least one logical portion of said logical storage medium comprises at least one of a volume, a partition, a directory, a special file, and/or a file.
14. The system as defined in claim 12 , wherein said at least one logical portion of said logical storage medium comprises an entire logical storage medium.
15. The system as defined in claim 12 , wherein said at least one data identifier comprises at least one of a file name, a file mask, a special file, and/or a directory.
16. The system as defined in claim 12 , wherein said operations comprise means for at least one of reading, executing, appending, creating new objects, deleting, renaming, moving, overwriting, modifying attributes, and/or modifying data object security.
17. The system as defined in claim 12 , further comprising:
means for applying a plurality of operation access privileges to said at least one data identifier.
18. The system as defined in claim 12 , further comprising:
means for applying a plurality of operation access privileges to said portion of said logical storage medium.
19. The system as defined in claim 12 , further comprising:
means for applying said operation access privilege to said logical storage medium wherein said logical storage medium is itself a logical portion of another logical storage medium, and wherein a logical portion of said another logical storage medium is specified by at least one data identifier.
20. The system as defined in claim 12 , wherein said at least one data identifier comprises a free space portion.
21. The system as defined in claim 12 , wherein said at least one data identifier comprises newly created data.
22. A computer program product embodied on a computer readable media wherein the computer program product comprises logic which when executed performs the following method of applying an operation access privilege to at least a logical portion of a logical storage medium in communication with a computer, the method comprising the steps of:
(a) providing an operation access privilege indicative of at least one of an enabled operation and/or a restricted operation to be performed on at least a logical portion of a logical storage medium;
(b) associating said operation access privilege with at least one logical portion of said logical storage medium;
(c) intercepting in a trap layer an attempted operation on said at least one logical portion identified by at least one data identifier, wherein said intercepting occurs regardless of an identity of a user attempting said attempted operation, and transparently to the user and transparently to a computer application invoking said operation; and
(d) at least one of allowing said attempted operation if matching said enabled operation, modifying and allowing said modified attempted operation, and/or denying said attempted operation if matching said restricted operation.
23. The computer program product as defined in claim 22 , wherein said at least one logical portion of said logical storage medium comprises at least one of a volume, a partition, a directory, a special file, and/or a file.
24. The computer program product as defined in claim 22 , wherein said at least one logical portion of said logical storage medium comprises an entire logical storage medium.
25. The computer program product as defined in claim 22 , wherein said at least one data identifier comprises at least one of a file name, a file mask, a special file, and/or a directory.
26. The computer program product as defined in claim 22 , wherein said operations comprise at least one of reading, executing, appending, creating new objects, deleting, renaming, moving, overwriting, modifying attributes, and/or modifying data object security.
27. The computer program product as defined in claim 22 , wherein the method further comprises:
(e) applying a plurality of operation access privileges to said at least one data identifier.
28. The computer program product as defined in claim 22 , wherein the method further comprises:
(e) applying a plurality of operation access privileges to said portion of said logical storage medium.
29. The computer program product as defined in claim 22 , wherein the method further comprises:
(e) applying said operation access privilege to said logical storage medium wherein said logical storage medium is itself a logical portion of another logical storage medium, and wherein a logical portion of said another logical storage medium is specified by at least one data identifier.
30. The computer program product as defined in claim 22 , wherein said at least one data identifier comprises a free space portion.
31. The computer program product as defined in claim 22 , wherein said at least one data identifier comprises newly created data.