# US 11,907,405 B2 · Secure data storage device access control and sharing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,405 B2 - Document ID: US11907405B2 - Status: Granted - Kind: B2 - Application number: 17/070,565 - Filed: 2020-10-14 - Published: 2022-04-14 - Granted: 2024-02-20 - Earliest claimed: 2020-10-14 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Xiaohan Qin; Pedro V. Torres; Xinya Wang; Amit Agarwal - Web page: https://patentgrep.com/patent/US11907405B2 ## CPC - G06F 21/629: {to features or functions of an application} - G06F 9/54: Interprogram communication - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A return address of a caller of a software function within an access control component is determined, the caller comprising a software component seeking access to a protected resource protected by the access control component. From the return address, a filename of the caller is determined. Responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller is allowed to access the protected resource. ## Claims ### Claim 1 A computer-implemented method comprising: determining a return address of a caller of a software function within an access control component, the caller comprising a software component seeking access to a protected resource protected by the access control component; determining, from the return address, a filename of the caller using a kernel function, the kernel function being configured to take the return address as input and return the filename if the caller executes code at the return address; and allowing, responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller to access the protected resource, wherein the set of filenames of components allowed to access the protected resource is stored within the protected resource, and wherein the allowing is based on a comparison of a label, formed by combining a calling module tag with an object label supplied by the caller, to a plurality of labels stored within the protected resource. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: preventing, responsive to determining that the filename is not included in the set of filenames of components allowed to access the protected resource, the caller from accessing the protected resource. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: storing a plurality of digital signatures, a digital signature in the plurality of digital signatures being associated with at least one software component in a safelist, wherein the allowing is performed responsive to determining that a stored digital signature previously computed for the software component is valid. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: storing, responsive to the allowing, a first portion of data in the protected resource, the storing including tagging the first portion of data with a tag corresponding to the caller. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, further comprising: determining, responsive to the allowing, that a second portion of data in the protected resource is tagged with a second tag corresponding to the caller; and providing, responsive to the determining, the second portion of data to the caller. ### Claim 6 (depends on 4) The computer-implemented method of claim 4, further comprising: determining, responsive to the allowing, that a second portion of data in the protected resource is tagged with a second tag that does not corresponding to the caller; and preventing, responsive to the determining, the second portion of data from being provided to the caller. ### Claim 7 A computer program product for secure data storage device access control and sharing, the computer program product comprising: one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising: program instructions to determine a return address of a caller of a software function within an access control component, the caller comprising a software component seeking access to a protected resource protected by the access control component; program instructions to determine, from the return address, a filename of the caller using a kernel function, the kernel function being configured to take the return address as input and return the filename if the caller executes code at the return address; and program instructions to allow, responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller to access the protected resource, wherein the set of filenames of components allowed to access the protected resource is stored within the protected resource and wherein the allowing is based on a comparison of a label, formed by combining a calling module tag with an object label supplied by the caller, to a plurality of labels stored within the protected resource. ### Claim 8 (depends on 7) The computer program product of claim 7, further comprising: program instructions to prevent, responsive to determining that the filename is not included in the set of filenames of components allowed to access the protected resource, the caller from accessing the protected resource. ### Claim 9 (depends on 7) The computer program product of claim 7, further comprising: storing a plurality of digital signatures, a digital signature in the plurality of digital signatures being associated with at least one software component in a safelist, wherein the allowing is performed responsive to determining that a stored digital signature previously computed for the software component is valid. ### Claim 10 (depends on 7) The computer program product of claim 7, further comprising: program instructions to store, responsive to the allowing, a first portion of data in the protected resource, the storing including tagging the first portion of data with a tag corresponding to the caller. ### Claim 11 (depends on 10) The computer program product of claim 10, further comprising: program instructions to determine, responsive to the allowing, that a second portion of data in the protected resource is tagged with a second tag corresponding to the caller; and program instructions to provide, responsive to the determining, the second portion of data to the caller. ### Claim 12 (depends on 10) The computer program product of claim 10, further comprising: program instructions to determine, responsive to the allowing, that a second portion of data in the protected resource is tagged with a second tag that does not corresponding to the caller; and program instructions to prevent, responsive to the determining, the second portion of data from being provided to the caller. ### Claim 13 (depends on 7) The computer program product of claim 7, wherein the stored program instructions are stored in the at least one of the one or more storage media of a local data processing system, and wherein the stored program instructions are transferred over a network from a remote data processing system. ### Claim 14 (depends on 7) The computer program product of claim 7, wherein the stored program instructions are stored in the at least one of the one or more storage media of a server data processing system, and wherein the stored program instructions are downloaded over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system. ### Claim 15 (depends on 7) The computer program product of claim 7, wherein the computer program product is provided as a service in a cloud environment. ### Claim 16 A computer system comprising one or more processors, one or more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising: program instructions to determine a return address of a caller of a software function within an access control component, the caller comprising a software component seeking access to a protected resource protected by the access control component; program instructions to determine, from the return address, a filename of the caller using a kernel function, the kernel function being configured to take the return address as input and return the filename if the caller executes code at the return address; and program instructions to allow, responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller to access the protected resource, wherein the set of filenames of components allowed to access the protected resource is stored within the protected resource and wherein the allowing is based on a comparison of a label, formed by combining a calling module tag with an object label supplied by the caller, to a plurality of labels stored within the protected resource. ### Claim 17 (depends on 16) The computer system of claim 16, further comprising: program instructions to prevent, responsive to determining that the filename is not included in the set of filenames of components allowed to access the protected resource, the caller from accessing the protected resource. ### Claim 18 (depends on 16) The computer system of claim 16, further comprising: storing a plurality of digital signatures, a digital signature in the plurality of digital signatures being associated with at least one software component in a safelist, wherein the allowing is performed responsive to determining that a stored digital signature previously computed for the software component is valid. ### Claim 19 (depends on 16) The computer system of claim 16, further comprising: program instructions to store, responsive to the allowing, a first portion of data in the protected resource, the storing including tagging the first portion of data with a tag corresponding to the caller. ### Claim 20 (depends on 19) The computer system of claim 19, further comprising: program instructions to determine, responsive to the allowing, that a second portion of data in the protected resource is tagged with a second tag corresponding to the caller; and program instructions to provide, responsive to the determining, the second portion of data to the caller.