Restricting access to hardware for which a driver is installed on a computer
Users of a computer are prevented from directly accessing certain hardware for which a driver is installed on the computer. The users are provided a limited, indirect manner to access the hardware for a specific purpose or to do a specific job. One example of such hardware is a wireless hardware communication interface. The wireless activity of the computer may be restricted so that the wireless hardware communication interface is prevented from communicating with any devices compatible with the wireless hardware communication interface other than one or more specific devices.
1. A method for restricting wireless activity in a computer, the method comprising:
controlling, via an access control list, access to a software element that is installed in the computer, wherein the software element is designed to support communication via a wireless hardware communication interface of the computer, and wherein the access control list does not provide permissions to any user account to access the software element;
running a system-account process under a system account of an operating system, wherein the system account has more privileges than any user account, wherein the access control list provides the system account with access to the software element, and wherein the system-account process has specific functions, including being able to manage wireless communication via the wireless hardware communication interface with one or more specific wireless devices that are compatible with the wireless hardware communication interface, and wherein the system-account process, due to its specific functions, is unable to conduct wireless communication via the wireless hardware communication interface with any wireless device other than the one or more specific wireless devices, even if such other wireless device is within wireless communication range of the computer and is compatible with the wireless hardware communication interface;
preventing access by any user-account process running on the computer under any user account to a control panel application for the wireless hardware communication interface; and
permitting any user-account process running on the computer under any user account to access the software element only by providing one or more commands to the system-account process,
wherein the wireless hardware communication interface is compatible with a wireless personal area network standard.
2. The method of claim 1 , wherein the software element comprises a radio frequency communication module that is designed to emulate in the computer a serial port for use in wireless communications via the wireless hardware communication interface.
3. The method of claim 1 , wherein the software element comprises a radio driver for a radio in the wireless hardware communication interface.
4. The method of claim 1 , wherein one of the one or more specific wireless devices includes a smart card reader, and wherein the system-account process communicates with the smart card reader to access a smart card coupled to the smart card reader.
5. The method of claim 1 , further comprising:
permitting any administrative-account process or system-account process running on the computer to directly access the software element.
6. The method of claim 1 , further comprising:
running under a user account another user-account process that provides one or more commands to the system-account process.
7. The method of claim 1 , further comprising:
disabling an authentication agent that provides an alert when a device is attempting to connect to the computer using the wireless hardware communications interface.
8. The method of claim 1 , further comprising:
deleting one or more encryption keys stored in a cache of the computer, wherein the one or more encryption keys were previously used to encrypt wireless communications conducted via the wireless hardware communication interface.
9. The method of claim 1 , further comprising:
programmatically disabling a serial port defined in the computer for wireless communications via the wireless hardware communication interface.
10. The method of claim 1 , wherein the wireless personal area network standard comprises a Bluetooth standard.
11. The method of claim 1 , further comprising:
preventing access by any user-account process running on the computer under any user account to one or more files in the group consisting of: library function modules for the standard, an application programming interface for the standard, and a file transfer application for the standard.
12. A computer comprising:
a processor;
a wireless hardware communication interface compatible with a wireless personal area network standard; and
a memory coupled to the processor, the memory storing:
an operating system for the computer,
a software element that is designed to support communication via the wireless hardware communication interface,
an access control list which when applied by the operating system controls access to the software element, wherein the access control list does not provide permissions to any user account to access the software element, and wherein the access control list provides a system account of the operating system with access to the software element, and
an application which when executed by the processor runs a system-account process on the computer under the system account, wherein the system account has more privileges than any user account, wherein the system-account process has specific functions, including being able to manage wireless communication via the wireless hardware communication interface with one or more specific wireless devices that are compatible with the wireless hardware communication interface and wherein the system-account process, due to its specific functions, is unable to conduct wireless communication via the wireless hardware communication interface with any wireless device other than the one or more specific wireless devices, even if such other wireless device is within wireless communication range of the computer and is compatible with the wireless hardware communication interface,
wherein any user-account process running on the computer under any user account is permitted to access the software element only by providing one or more commands to the system-account process,
and wherein any user-account process running on the computer under any user account is prevented from accessing a control panel application for the wireless hardware communication interface.
13. The computer of claim 12 , wherein the software element comprises a radio frequency communication module that is designed to emulate in the computer a serial port for use in wireless communications via the wireless hardware communication interface.
14. The computer of claim 12 , wherein the software element comprises a radio driver.
15. The computer of claim 12 , wherein one of the one or more specific wireless devices includes a smart card reader, and wherein the system-account process communicates with the smart card reader to access a smart card coupled to the smart card reader.
16. The computer of claim 12 , wherein the wireless personal area network standard comprises a Bluetooth standard.