# US 5,347,578 A · Computer system security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 5,347,578 A
- Document ID: US5347578A
- Status: Granted
- Kind: A
- Application number: 08/022,058
- Filed: 1993-02-24
- Granted: 1994-09-13
- Earliest claimed: 1992-03-17
- Assignees: International Computers Limited
- Inventors: Paul Duxbury
- Web page: https://patentgrep.com/patent/US5347578A

## CPC

- G06F 21/6281: {at program execution time, where the protection is within the operating system}
- G06F 2221/2101: Auditing as a secondary aspect
- Y10S 707/99939: Privileged access
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y10S: TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS

## Abstract

A computer system is described in which users can access a protected resource only by way of a call to a user monitor command, specifying the protected resource as a parameter. The user monitor command checks that certain conditions are satisfied and performs specified actions before permitting access to the protected resource. The checks may include checking whether options and argument values supplied by the user satisfy specified conditions. The actions may include dynamically modifying a supplementary groups list of a current process temporarily granting or removing privileges to or from the user.

## Claims

### Claim 1

A computer system comprising
(a) a computer providing a plurality of protected resources,
(b) a plurality of user access means attached to the computer for allowing each user to send commands to the computer, said commands including a user monitor command containing an argument specifying one of said protected resources, and
(c) command execution means in said computer, for executing said user monitor command by checking that predetermined conditions are satisfied and then, provided that said predetermined conditions are satisfied, for acessing said one of said protected resources on behalf of said user, and then returning a result to the user.

### Claim 2 (depends on 1)

A system according to claim 1 wherein the checks performed by the user monitor command include checking whether options and argument values supplied by the user satisfy specified conditions.

### Claim 3 (depends on 1)

A system according to claim 1 including means responsive to said monitor command for performing predetermined actions before access is permitted in order to ensure that access is made in a controlled manner.

### Claim 4 (depends on 3)

A system according to claim 3 wherein said actions include dynamically modifying a current process's supplementary groups list.

### Claim 5 (depends on 3)

A system according to claim 3 wherein said actions include granting or removing privileges to or from the user while said user monitor command is being executed.

### Claim 6 (depends on 1)

A system according to claim 1, including a database accessible by said monitoring means, for indicating which users are permitted to indirectly access which resources.

### Claim 7 (depends on 6)

A system according to claim 6 wherein said database also indicates the conditions that are to be satisfied and actions that are to be performed before permitting access.

### Claim 8 (depends on 6)

A system according to claim 6 wherein said database also indicates which of a predetermined set of roles are available to each user, and indicates which roles are permitted to access which resources.

### Claim 9 (depends on 1)

A system according to claim 1 wherein said protected resources comprise means for executing commands.