Methods and systems for network-based management of application security
To control privileges and access to resources on a per-process basis, an administrator creates a rule that may be applied to modify a process's token. The rule includes an application-criterion set and changes to be made to the groups and/or privileges of a token. The rule is set as a policy within a group policy object (GPO), where a GPO is associated with one or more groups of computers. When a GPO containing a rule is applied to a computer, a driver installed on the computer accesses the rule(s) anytime a logged-on user executes a process. If the executed process satisfies the criterion set of a rule the changes contained within the rule are made to the process token, and the user has expanded and/or contracted access and/or privileges for only that process.
1. A computer program product for modifying access to securable objects, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
providing a rule that includes an application-criterion set including at least one criterion for modifying a token of a process during execution of the process in accordance with the rule, the rule specifying at least one group to be added to the token of the process that satisfies the application-criterion set and whose access to securable objects is controlled by an operating system in accordance with the token, at least one said specified group being a group other than the Administrators group; and
before the operating system employs the process's token to determine the process's access to securable objects:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, adding to or removing from the process's token in response to the rule each group or user that the rule specifies, wherein the rule further includes an inheritance option set to either block or allow inheritance, by any child process, of any group or groups added to the token of a parent process; and
if the inheritance option is set to block and the process does not satisfy any said of the rule's application-criterion set, the method further comprises determining if the process is the child of another process and if the process is the grandchild of another process, and if both determinations are affirmative, make the process's token the same as the token of its grandparent process, and if not, make the process's token the same as an unmodified access token.
2. The computer program product according to claim 1 , wherein:
the rule is one of a plurality of rules;
the method carries out assigning relative priorities to the plurality of rules; and
adding a group to the process's token in response to a given rule occurs only if the process satisfies the application-criterion set of no rule whose priority is higher than the priority of the rule.
3. The computer program product according to claim 1 , wherein:
the process executes an executable entity; and
the at least one criterion is that the executable entity matches an executable-entity identifier specified by the at least one criterion.
4. The computer program product according to claim 3 , wherein the executable entity is an executable file.
5. The computer program product according to claim 4 , wherein the executable-entity identifier is a hash on the executable file's contents.
6. The computer program product according to claim 4 , wherein the executable-entity identifier represents the executable file's path.
7. The computer program product according to claim 1 , wherein:
the rule further specifies at least one privilege to be added to or removed from the token of the process that satisfies the application-criterion set; and
the method further comprises adding or removing each privilege that the rule specifies to a process's token if the process satisfies the application-criterion set.
8. The computer program product according to claim 1 , wherein the at least one criterion is that the user match a user identifier specified by the at least one criterion.
9. A computer program product that modifies a user's privileges to perform system-related operations, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
providing a rule that includes an application-criterion set including at least one criterion for token modification in accordance with the rule, the rule specifying at least one privilege to be added to a token of a process that satisfies the application-criterion set and whose performance of system operations is controlled by an operating system in accordance with the token; and
before the operating system employs a process's token to determine the process's privileges:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, adding to the process's token in response to the rule each privilege that the rule specifies, wherein the rule further includes an inheritance option set to either block or allow inheritance, by any child process, of any group or groups added to the token of a parent process; and
if the inheritance option is set to block and the process does not satisfy any said of the rule's application-criterion set, the method further comprises determining if the process is the child of another process and if the process is the grandchild of another process, and if both determinations are affirmative, make the process's token the same as the token of its grandparent process, and if not, make the process's token the same as an unmodified access token.
10. The computer program product according to claim 9 , wherein:
the rule is one of a plurality of such rules;
the method includes assigning relative priorities to the plurality of rules; and
the method includes adding a privilege to the process's token in response to a given rule only if the process satisfies the application-criterion set of no rule whose priority is higher than the given rule's.
11. The computer program product according to claim 9 , wherein:
the process executes an executable entity; and
the at least one application-criterion is that the executable entity match an executable-entity identifier specified by the at least one criterion.
12. The computer program product according to claim 9 , wherein:
the rule further specifies at least one group to be added to or removed from the token of a process that satisfies the application-criterion set; and
the method further comprises adding each group that the rule specifies to a process's token if the process satisfies the application-criterion set.
13. The computer program product according to claim 9 , wherein the at least one criterion is that the user match a user identifier specified by the at least one criterion.
14. A computer program product that blocks inheritance of a modified token of a process, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
providing at least one rule that includes an application-criterion set including at least one criterion for token modification in accordance with the rule, the rule specifying
at least one change to be made to a token of a process that satisfies the application-criterion set and whose privileges and access to securable objects are controlled by an operating system in accordance with the token, and
an inheritance option set to either block or allow inheritance, by any child process, of any changes made to the token of a parent process; and
if the inheritance option is set to block and the process does not satisfy the rule's application-criterion set, before the operating system of the computer employs a process's token to determine the process's privileges and access to securable objects, determining if the process is the child of another process and if the process is the grandchild of another process, and if both determinations are affirmative, make the process's token the same as the token of its grandparent process, and if not, make the process's token the same as an unmodified access token.
15. The computer program product according to claim 14 , where the at least one change is one of adding a group, removing a group, adding a privilege, and removing a privilege.
16. The computer program product according to claim 14 , wherein:
the process executes an executable entity; and
the at least one criterion is that the executable entity match an executable-entity identifier specified by the at least one criterion.
17. The computer program product according to claim 14 , wherein the at least one criterion is that the user match a user identifier specified by the at least one criterion.
18. A computer program product that limits changes made to a token of a process, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
providing a rule that includes an application-criterion set including at least one criterion for token modification in accordance with the rule, wherein the at least one criterion is that the user match a user identifier specified by the at least one criterion, the rule specifying at least one change to be made to a token of a process that satisfies the application-criterion set and whose access to securable objects and privileges is controlled by an operating system in accordance with the token; and
before the operating system employs a process's token to determine the process's access to securable objects and privileges:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, changing the process's token in response to rule according to each change that the rule specifies, wherein the rule further includes an inheritance option set to either block or allow inheritance, by any child process, of any group or groups added to the token of a parent process; and
if the inheritance option is set to block and the process does not satisfy any said of the rule's application-criterion set, the method further comprises determining if the process is the child of another process and if the process is the grandchild of another process, and if both determinations are affirmative, make the process's token the same as the token of its grandparent process, and if not, make the process's token the same as an unmodified access token.
19. The computer program product according to claim 18 , where the at least one change is one of adding a group, removing a group, adding a privilege, and removing a privilege.
20. The computer program product according to claim 18 , wherein:
the rule is one of a plurality of rules;
the method includes assigning relative priorities to the plurality of rules; and
the method includes changing the process's token in response to a given rule only if the process satisfies the application-criterion set of no rule whose priority is higher than the relative priority of the one of the plurality of rules.
21. The computer program product according to claim 18 , wherein:
the process executes an executable entity; and
the at least one criterion further includes that the executable entity match an executable-entity identifier specified by the at least one criterion.
22. The computer program product according to claim 18 , wherein:
the rule further includes an inheritance option set to either block or allow inheritance, by any child process, of any changes made to the token of a parent process; and
if the inheritance option is set to block and the process does not satisfy the rule's application-criterion set, the method further comprises determining if the process is the child of another process and if the process is the grandchild of another process, and if both determinations are affirmative, make the process's token the same as the token of its grandparent process, and if not, make the process's token the same as an unmodified access token.
23. A computer program product that manages, over a network, changes to process tokens created in computers operatively coupled to the network, the computer program product comprising program instructions stored on a non-transitory computer readable medium, the program instructions to be executed by a processor to perform a method, the method comprising:
creating a rule that includes an application-criterion set including at least one criterion for token modification in accordance with the rule, the rule specifying at least one change to be made to a token of a process that satisfies the application-criterion set and whose access to securable objects and privileges is controlled by an operating system in accordance with the token;
associating each created rule to respective selected ones of group policy objects, where at least one selected group policy object applies to at least one of the groups of computers or users; applying each group policy object to its group of computers or users; and
for each computer or user in each group, before the operating system of the each computer or user employs a process's token to determine the process's access to securable objects and privileges:
making a determination of whether the process satisfies the application-criterion set; and
if and only if the determination is affirmative, changing the process's token in response to the rule according to each change that the rule specifies, wherein the rule further includes an inheritance option set to either block or allow inheritance, by any child process, of any group or groups added to the token of a parent process; and
if the inheritance option is set to block and the process does not satisfy any said of the rule's application-criterion set, the method further comprises determining if the process is the child of another process and if the process is the grandchild of another process, and if both determinations are affirmative, make the process's token the same as the token of its grandparent process, and if not, make the process's token the same as an unmodified access token.
24. The computer program product according to claim 23 , where the at least one change is one of adding a group, removing a group, adding a privilege, and removing a privilege.
25. The computer program product according to claim 23 , wherein:
a plurality of rules are created;
the method includes assigning relative priorities to the plurality of rules; and
the method includes changing the process's token in response to a given rule only if the process satisfies the application-criterion set of no rule whose priority is higher than the relative priority of the rule.
26. The computer program product according to claim 23 , wherein:
the process executes an executable entity; and
the at least one criterion further includes that the executable entity matching an executable-entity identifier specified by the at least one criterion.
27. The computer program product according to claim 23 , wherein the at least one criterion is that the user match a user identifier specified by the at least one criterion.
28. The computer program product according to claim 23 , further comprising: adding, in response to user input, at least one user-defined filter criterion to a selected group policy object.
29. The computer program product according to claim 28 , wherein applying each group policy object to its group of computers or users further comprises applying each group policy object to each computer or user in its associated group of computers or users if the computer or user satisfies the user-defined filter criterion.
30. The computer program product according to claim 29 , wherein the at least one user-defined filter criterion includes at least one user identifier.