System for and methods of controlling user access and/or visibility to directories and files of a computer
View Patent ↗A system includes a file access manager driver and a kernel file system driver stack in a kernel-mode address space of an operating system (OS). The system also includes session processes, a public file whitelist; a public file whitelist manager; a user/group file whitelist, which is a private whitelist; and a user/group file whitelist manager in a user-mode address space of the OS. A method includes receiving a request for access and/or visibility to a directory and/or file and then determining whether the request is allowed to execute based on whether the file access manager driver identifies that the directory and/or file is allowed in either public or private whitelists.
1. A method for controlling user access to directories and files of a computer, the method comprising:
receiving an user/group file whitelist, wherein the received user/group file whitelist is stored in a data storage medium and comprises published directories and/or files associated with a group of one or more users;
determining that an administrator has performed an act of publishing one or more previously unpublished directories and/or files, wherein the act of publishing specifies that the previously unpublished directories and/or files are to be published to the group of one or more users that is associated with the stored user/group file whitelist;
authenticating a user as belonging to the specified group of one or more users to whom the previously unpublished directories and/or files are published; and
automatically adding, based on the act of publishing to the specified group, the previously unpublished directories and/or files to the stored user/group file whitelist, wherein the stored user/group file whitelist in the data storage medium is updated with the previously unpublished directories and/or files.
2. The method of claim 1 , further comprising restricting the specified group of one or more users from viewing the previously unpublished directories and/or files prior to publication; and allowing the specified group of one or more users to run one or more processes in the previously unpublished directories and/or files after publication.
3. The method of claim 1 , further comprising storing a public file whitelist in the data storage medium and automatically denying user access to directories and/or files that are not in the public file whitelist.
4. The method of claim 1 , further comprising bringing the user/group file whitelist into a kernel-mode address space.
5. The method of claim 1 , wherein the specified group is associated with a blacklist comprising one or more directories and/or files that are not allowed to be accessed or viewed by the specified group.
6. The method of claim 1 , further comprising reading the stored user/group file whitelist into a searchable data structure.
7. The method of claim 6 , wherein the searchable data structure comprises an array list.
8. An apparatus for controlling user access to directories and files of a computer, comprising:
a communication network for receiving an user/group file whitelist comprising published directories and/or files associated with a group of one or more users;
a data storage medium for storing the received user/group file whitelist; and
a processor for executing instructions stored in memory, wherein the execution of the instructions by the processor:
determines that an administrator has performed an act of publishing one or more previously unpublished directories and/or files, wherein the act of publishing specifies that the previously unpublished directories and/or files are to be published to the group of one or more users that is associated with the user/group file whitelist;
authenticates a user as belonging to the specified group of one or more users to whom the previously unpublished directories and/or files are published; and
automatically adds, based on the act of publishing to the specified group, the previously unpublished directories and/or files to the user/group file whitelist, wherein the stored user/group file whitelist in the data storage medium is updated with the previously unpublished directories and/or files.
9. The apparatus of claim 8 , wherein the processor further restricts the specified group of one or more users from viewing the previously unpublished directories and/or files prior to publication, and allows the specified groups of one or more users to run one or more processes in the previously unpublished directories and/or files after publication.
10. The apparatus of claim 8 , wherein the data storage medium further stores a public file whitelist, and wherein the processor automatically denies user access to one or more of directories and/or files that are not in the public file whitelist.
11. The apparatus of claim 8 , wherein data storage medium further stores user data of the authenticated user and wherein the user/group file whitelist is stored in association with the user data of the authenticated user.
12. The apparatus of claim 8 , wherein the data storage medium further stores a blacklist associated with the specified group, the blacklist comprising one or more directories and/or files that are not allowed to be accessed by members of the specified group.
13. The apparatus of claim 8 , wherein the user/group file whitelist is read into a searchable data structure in the data storage medium.
14. The method of claim 13 , wherein the searchable data structure comprises an array list in the data storage medium.
15. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to perform a method for controlling user access to directories and files of a computer, the method comprising:
receiving an user/group file whitelist, wherein the received user/group file whitelist comprises directories and/or files associated with a group of one or more users;
determining that an administrator has performed an act of publishing one or more previously unpublished directories and/or files, wherein the act of publishing specifies that the previously unpublished directories and/or files are to be published to the group of one or more users that is associated with the stored user/group file whitelist;
authenticating a user as belonging to the specified group of one or more users to whom the previously unpublished directories and/or files are published; and
automatically adding, based on the act of publishing to the specified group, the previously unpublished directories and/or files to the stored user/group file whitelist, wherein the stored user/group file whitelist is updated with the previously unpublished directories and/or files.
16. The non-transitory computer-readable storage medium of claim 15 , further comprising instructions executable to restrict the specified group of one or more users from viewing the previously unpublished directories and/or files prior to publication; and to allow the specified group of one or more users to run one or more processes in the previously unpublished directories and/or files after publication.
17. The non-transitory computer-readable storage medium of claim 15 , further comprising storing a public file whitelist in a data storage medium and automatically denying user access to directories and/or files that are not in the public file whitelist.
18. The non-transitory computer-readable storage medium of claim 15 , further comprising bringing the user/group file whitelist into a kernel-mode address space.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the specified group is associated with a blacklist comprising one or more directories and/or files that are not allowed to be accessed or viewed by the specified group.
20. The non-transitory computer-readable storage medium of claim 15 , further comprising reading the stored user/group file whitelist into a searchable data structure.