Secure data storage device access control and sharing
AssigneeInternational Business Machines Corporation
InventorsXiaohan Qin, Pedro V. Torres, Xinya Wang, Amit Agarwal
Life of this patent
Estimating the term…
Abstract
A return address of a caller of a software function within an access control component is determined, the caller comprising a software component seeking access to a protected resource protected by the access control component. From the return address, a filename of the caller is determined. Responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller is allowed to access the protected resource.
Claims20
A computer-implemented method comprising:
- determining a return address of a caller of a software function within an access control component, the caller comprising a software component seeking access to a protected resource protected by the access control component;
- determining, from the return address, a filename of the caller using a kernel function, the kernel function being configured to take the return address as input and return the filename if the caller executes code at the return address;
- and
- allowing, responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller to access the protected resource, wherein the set of filenames of components allowed to access the protected resource is stored within the protected resource, and
- wherein the allowing is based on a comparison of a label, formed by combining a calling module tag with an object label supplied by the caller, to a plurality of labels stored within the protected resource.
A computer program product for secure data storage device access control and sharing, the computer program product comprising:
- one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising:
- program instructions to determine a return address of a caller of a software function within an access control component, the caller comprising a software component seeking access to a protected resource protected by the access control component;
- program instructions to determine, from the return address, a filename of the caller using a kernel function, the kernel function being configured to take the return address as input and return the filename if the caller executes code at the return address;
- and
- program instructions to allow, responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller to access the protected resource, wherein the set of filenames of components allowed to access the protected resource is stored within the protected resource and
- wherein the allowing is based on a comparison of a label, formed by combining a calling module tag with an object label supplied by the caller, to a plurality of labels stored within the protected resource.
A computer system comprising one or more processors, one or more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:
- program instructions to determine a return address of a caller of a software function within an access control component, the caller comprising a software component seeking access to a protected resource protected by the access control component;
- program instructions to determine, from the return address, a filename of the caller using a kernel function, the kernel function being configured to take the return address as input and return the filename if the caller executes code at the return address;
- and
- program instructions to allow, responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller to access the protected resource, wherein the set of filenames of components allowed to access the protected resource is stored within the protected resource and
- wherein the allowing is based on a comparison of a label, formed by combining a calling module tag with an object label supplied by the caller, to a plurality of labels stored within the protected resource.
Dependencies are inferred from the claim text.