Enhanced computer objects security
OwnerElias HADDADinventor
Life of this patent
Estimating the term…
Abstract
A computer has an operating system configured to intercept requests for access to data objects and to check in a look-up table whether the combination of requesting program and location for the requesting program is recorded in the table for a confidential data object. The data object can be a database table, but can be any file to which access is to be restricted, such as a text document, an image file, and an audio file. The invention further provides a method of controlling access to data objects stored in data storage, in which access to confidential objects is restricted to application programs run from specific locations and registered in the system.
Claims9
A computer comprising:
- one or more hardware processors;
- data storage for storing data objects;
- a computer operating system in the form of computer-executable instructions which can be executed by one or more of the hardware processors, the operating system comprising:
- an object security system for controlling access to objects, the object security system being configured to receive requests for access to data objects stored in the data storage and to determine, upon receipt of a request for access, whether the request is from an authorised user of the object and to block access if the request is not from an authorised user, characterised in that the security system further comprises:
- a) a confidential objects register, data objects being designated as confidential by entry in said register;
- b) an application program register listing application programs installed to operate on the computer and the location of each said program in the computer;
- and
- c) a matrix register containing, for each data object designated as confidential in the confidential objects register, the or each application program in the application program register permitted to access the data object and at least one designated location in the computer for the or each application program, the system being further configured to determine from each request if the data object is entered in the confidential objects register and, if it is, to further determine the application program from which the request originated and the location of the application program, and to block access if the application program is not present in the matrix register as a permitted application program in a designated location.
A method of controlling access to confidential data objects stored in computer data storage, the method comprising:
- a) entering in a confidential objects register data objects that are to be treated as confidential;
- b) establishing an application program register listing application programs installed to operate on the computer and the location of each said program in the computer;
- c) establishing a matrix register recording, for each confidential data object, each application program in the application program register permitted to open said data object and the designated storage location for the application program;
- and then processing each subsequent request for access to a data object in the computer data storage to determine from the confidential objects register whether the requested data object is entered in the confidential objects register and, if it is entered in the confidential objects register:
- d) determining the application program from which the request originated and the location thereof;
- and
- e) blocking access to the data object if the application program is not present in the matrix register as a permitted application program for the data object and in a designated location.
Dependencies are inferred from the claim text.