# US 12,223,074 B2 · System and method for securing windows discretionary access control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,074 B2 - Document ID: US12223074B2 - Status: Granted - Kind: B2 - Application number: 17/900,458 - Filed: 2022-08-31 - Published: 2023-05-25 - Granted: 2025-02-11 - Earliest claimed: 2021-09-17 - Assignees: Xerox Corporation - Applicants: Palo Alto Research Center Incorporated - Inventors: Marc E. Mosko - Web page: https://patentgrep.com/patent/US12223074B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/45: Structures or tools for the administration of authentication - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method are provided to facilitate securing windows discretionary access control. During operation, the system determines a Windows domain model including capability assignments of principals on resources, wherein a respective capability assignment comprises a permission of a respective principal to a respective resource and wherein a respective principal comprises a user or a group of users. The system specifies desired effective permissions of each principal to each resource. The system generates, based on the specified desired effective permissions, access control entries for the respective principal to the respective resource. The system generates, based on the specified desired effective permissions, group memberships indicating which users belong to which groups. ## Claims ### Claim 1 A computer-implemented method, the method comprising: determining a Windows domain model including capability assignments of principals on resources, wherein a respective capability assignment comprises a permission of a respective principal to a respective resource and wherein the respective principal comprises a user or a group of users; specifying desired effective permissions of each principal to each resource; generating, based on the specified desired effective permissions, access control entries for the respective principal to the respective resource; and generating, based on the specified desired effective permissions, group memberships indicating which users belong to which groups. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the access control entries enumerate a local allow permission, a local deny permission, an inherited allow permission, and an inherited deny permission of the respective principal to the respective resource, and wherein at least one of the following rules is applied: the local deny permission trumps the local allow permission; the local allow permission trumps the inherited allow permission and the inherited deny permission; the inherited deny permission trumps the inherited allow permission; and inheritance of permissions is prohibited. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the respective resource comprises a Windows element or entity which uses role-based access control (RBAC). ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the group of users is configured by bundling principals based on at least one of: configuring principals for the group; and assigning and using a notional role for the principals of the group. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein generating the Windows domain model and specifying the desired effective permissions is based on a scenario file, wherein the scenario file includes: a desired specification which defines a physical structure of the Windows domain model and a desired state of the capability assignments; a current configuration of the Windows domain model; and a policy file with rules indicating how to achieve the desired state of capability assignments. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein generating the access control entries and the group memberships is further based on the policy file. ### Claim 7 (depends on 5) The computer-implemented method of claim 5, wherein generating the access control entries and the group memberships based on the specified desired effective permissions comprises: solving for the desired state of the capability assignments by reducing a number of changes to be made to the current configuration. ### Claim 8 (depends on 5) The computer-implemented method of claim 5, wherein the current configuration specifies at least one of: current capability assignments; and current local allow permissions and local deny permissions. ### Claim 9 (depends on 5) The computer-implemented method of claim 5, wherein the policy file indicates preferences of relationships between the users, groups, and resources within a single domain or between multiple domains in the Windows domain model. ### Claim 10 (depends on 5) The computer-implemented method of claim 5, wherein generating the group memberships based on the specified desired effective permissions comprises: caching enabled paths used to generate, based on the specified desired effective permissions, the access control entries for the respective principal to the respective resource, wherein the enabled paths conform to the rules indicated in the policy file; and determining an expanded membership parameter for each group, wherein the expanded membership parameter includes transitive nesting of group memberships based on enabled paths. ### Claim 11 (depends on 5) The computer-implemented method of claim 5, further comprising: transmitting, to a python role-based access control (RBAC) module, the scenario file for processing to obtain a multi-layer graph; executing, by a reasoner component, a process on the multi-layer graph to obtain a recommended configuration, wherein the process optimizes a functionality, security, and utility of components while minimizing an impact of vulnerabilities; and generating, by the reasoner component based on the recommended configuration, a report comprising at least one of: choices made by the reasoner component in selecting the recommended configuration, including prioritization of a first constraint over a second constraint; a description of capabilities assigned to users and resources; and a description of group memberships. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein generating the access control entries based on the specified desired effective permissions comprises: determining a convolved matrix for the desired effective permissions of a first resource, wherein columns in the convolved matrix indicate capabilities as pairs of a principal and a permission and wherein rows in the convolved matrix indicate a local allow permission, a local deny permission, an inherited allow permission, and an inherited deny permission for a respective pair; and setting entries in the convolved matrix based on at least one of: whether a respective principal is a member of a respective group; an entry in a corresponding row of an assigned permission vector indicating the local allow permission or the local deny permission for the respective group; whether the first resource is a child resource that inherits permissions from a parent resource; and an entry in a corresponding row of a convolved matrix for the parent resource indicating the local deny permission and the local allow permission and at least one of the inherited allow permission and the inherited deny permission. ### Claim 13 A computer system, comprising: a processor; and a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising: determining a Windows domain model including capability assignments of principals on resources, wherein a respective capability assignment comprises a permission of a respective principal to a respective resource and wherein the respective principal comprises a user or a group of users; specifying desired effective permissions of each principal to each resource; generating, based on the specified desired effective permissions, access control entries for the respective principal to the respective resource; and generating, based on the specified desired effective permissions, group memberships indicating which users belong to which groups. ### Claim 14 (depends on 13) The computer system of claim 13, wherein the access control entries enumerate a local allow permission, a local deny permission, an inherited allow permission, and an inherited deny permission of the respective principal to the respective resource, and wherein at least one of the following rules is applied: the local deny permission trumps the local allow permission; the local allow permission trumps the inherited allow permission and the inherited deny permission; the inherited deny permission trumps the inherited allow permission; and inheritance of permissions is prohibited. ### Claim 15 (depends on 13) The computer system of claim 13, wherein the respective resource comprises a Windows element or entity which uses role-based access control (RBAC). ### Claim 16 (depends on 13) The computer system of claim 13, wherein generating the Windows domain model and specifying the desired effective permissions is based on a scenario file, wherein the scenario file includes: a desired specification which defines a physical structure of the Windows domain model and a desired state of the capability assignments; a current configuration of the Windows domain model; and a policy file with rules indicating how to achieve the desired state of capability assignments, and wherein generating the access control entries and the group memberships is further based on the policy file, which indicates preferences of relationships between the users, groups, and resources within a single domain or between multiple domains in the Windows domain model. ### Claim 17 (depends on 16) The computer system of claim 16, wherein generating the access control entries and the group memberships based on the specified desired effective permissions comprises: solving for the desired state of the capability assignments by reducing a number of changes to be made to the current configuration. ### Claim 18 (depends on 13) The computer system of claim 13, wherein generating the access control entries based on the specified desired effective permissions comprises: determining a convolved matrix for the desired effective permissions of a first resource, wherein columns in the convolved matrix indicate capabilities as pairs of a principal and a permission and wherein rows in the convolved matrix indicate a local allow permission, a local deny permission, an inherited allow permission, and an inherited deny permission for a respective pair; and setting entries in the convolved matrix based on at least one of: whether a respective principal is a member of a respective group; an entry in a corresponding row of an assigned permission vector indicating the local allow permission or the local deny permission for the respective group; whether the first resource is a child resource that inherits permissions from a parent resource; and an entry in a corresponding row of a convolved matrix for the parent resource indicating the local deny permission and the local allow permission and at least one of the inherited allow permission and the inherited deny permission. ### Claim 19 A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising: determining a Windows domain model including capability assignments of principals on resources, wherein a respective capability assignment comprises a permission of a respective principal to a respective resource and wherein the respective principal comprises a user or a group of users; specifying desired effective permissions of each principal to each resource; generating, based on the specified desired effective permissions, access control entries for the respective principal to the respective resource; and generating, based on the specified desired effective permissions, group memberships indicating which users belong to which groups. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein generating the Windows domain model and specifying the desired effective permissions is based on a scenario file, wherein the scenario file includes: a desired specification which defines a physical structure of the Windows domain model and a desired state of the capability assignments; a current configuration of the Windows domain model; and a policy file with rules indicating how to achieve the desired state of capability assignments, and wherein generating the access control entries and the group memberships is further based on the policy file, which indicates preferences of relationships between the users, groups, and resources within a single domain or between multiple domains in the Windows domain model.