Method for adding and enforcing enhanced authorization policy on devices in computer operation systems

A method for controlling access to a computing system device being accessed through a device file, said access control being through an externally stored resource and comprising the steps of:

• monitoring the computing system for activities related to creating and accessing special device files that represent system devices;
• restricting the creation of special device files based on rules defined in the externally stored resource;
• and
• restricting special device file accesses based on rules defined in the externally stored resource.

A computer program product in a computer readable medium for controlling access to a computer system device, being accessed through a special device file, with externally stored resources comprising the steps of:

• instructions for retrieving the file attributes for the device file used in the system device access attempt;
• instructions for determining whether the resource that is making the access attempt is a special device file;
• instructions for searching a mapping database for device files that represent the system device that is the object of the access attempt and generating a device file entry list of all protected device files that represent said system device;
• and
• instructions for generating an authorization decision for the access attempt to the system device based on the security policy that governs each device file in the device file entry list.

A computer connectable to a distributed computing system, which includes special device files containing information, related to corresponding system devices comprising:

• a processor;
• a native operating system;
• application programs;
• an externally stored authorization program overlaying said native operating system and augmenting the standard security controls of said native operating system;
• a mapping database within said external authorization program containing a system device to a protected object name entries for each protected file system object;
• and
• a decision component within said authorization program for controlling access to special device files representing system devices.