利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

7 条记录 (耗时 0.038 秒)

    Mandatory integrity control
    3.
    发明申请
    Mandatory integrity control 有权
    强制诚信控制

    公开(公告)号：US20060248585A1

    公开(公告)日：2006-11-02

    申请号：US11117621

    申请日：2005-04-28

    申请人： Richard Ward ,  Jeffrey Hamblin ,  Peter Brundrett

    发明人： Richard Ward ,  Jeffrey Hamblin ,  Peter Brundrett

    IPC分类号： H04L9/32

    CPC分类号： G06F21/6218 ,  G06F2221/2141 ,  G06F2221/2149

    摘要： The contemplated embodiments of the invention provide a method for implementing a mandatory integrity control (MIC) system that provides access control for each and every object and subject that need access control, but in a way that allows legacy operating systems to continue with little modification. The invention provides a novel method that selects an integrity level designator for a subject, when the subject logs onto the computer system. The selected integrity level designator is then added to an existing data structure in the computer system. The existing data structure may be a part of a security descriptor stored in a system access control list of an object. The existing data structure may be a part of a list of security permissions that constitute an access token for a process executing as a subject.

    摘要翻译： 本发明的预期实施例提供了一种用于实现强制完整性控制（MIC）系统的方法，该系统为需要访问控制的每个对象和对象提供访问控制，但是允许传统操作系统继续进行很少的修改。 本发明提供了一种当主体登录到计算机系统时为对象选择完整性级别指示符的新颖方法。 然后，将所选择的完整性级别指示符添加到计算机系统中的现有数据结构。 现有数据结构可以是存储在对象的系统访问控制列表中的安全描述符的一部分。 现有数据结构可以是构成作为主体执行的进程的访问令牌的安全许可列表的一部分。

    Controlling execution of computer applications
    4.
    发明申请
    Controlling execution of computer applications 有权
    控制计算机应用程序的执行

    公开(公告)号：US20070186112A1

    公开(公告)日：2007-08-09

    申请号：US11046607

    申请日：2005-01-28

    申请人： Eric Perlin ,  Klaus Schutz ,  Paul Leach ,  Peter Brundrett ,  Thomas Jones

    发明人： Eric Perlin ,  Klaus Schutz ,  Paul Leach ,  Peter Brundrett ,  Thomas Jones

    IPC分类号： H04L9/00

    CPC分类号： G06F21/62 ,  G06F21/31 ,  G06F21/54 ,  G06F2221/2141

    摘要： Systems and methods are described that control attempts made by an application to access data. In one embodiment, the application is associated with a security token that includes an application ID. In operation, the system receives a request, initiated by the application, for access to the data. The system is configured to evaluate the request for access based in part on comparison of the security token and a listing of approved application IDs associated with the data.

    摘要翻译： 描述了控制由应用访问数据的尝试的系统和方法。 在一个实施例中，该应用与包括应用ID的安全令牌相关联。 在操作中，系统接收由应用程序发起的用于访问数据的请求。 该系统被配置为基于安全令牌的比较和与数据相关联的已批准应用ID的列表来部分地评估访问请求。

    Controlling computer applications' access to data
    5.
    发明申请
    Controlling computer applications' access to data 有权
    控制计算机应用程序访问数据

    公开(公告)号：US20060174334A1

    公开(公告)日：2006-08-03

    申请号：US11046281

    申请日：2005-01-28

    申请人： Eric Perlin ,  Klaus Schutz ,  Paul Leach ,  Peter Brundrett ,  Thomas Jones

    发明人： Eric Perlin ,  Klaus Schutz ,  Paul Leach ,  Peter Brundrett ,  Thomas Jones

    IPC分类号： H04L9/32

    CPC分类号： G06F21/6218 ,  G06F21/6281 ,  G06F2221/2141

    摘要： Systems and methods are described that control attempts made by an application to access data. In one embodiment, the application is associated with a security token that includes an application ID. In operation, the system receives a request, initiated by the application, for access to the data. The system is configured to evaluate the request for access based in part on comparison of the security token and a listing of approved application IDs associated with the data.

    摘要翻译： 描述了控制由应用访问数据的尝试的系统和方法。 在一个实施例中，该应用与包括应用ID的安全令牌相关联。 在操作中，系统接收由应用程序发起的用于访问数据的请求。 该系统被配置为基于安全令牌的比较和与数据相关联的已批准应用ID的列表来部分地评估访问请求。

    Providing user on computer operating system with full privileges token and limited privileges token
    6.
    发明申请
    Providing user on computer operating system with full privileges token and limited privileges token 有权
    在计算机操作系统上为用户提供完全权限令牌和有限权限令牌

    公开(公告)号：US20070005961A1

    公开(公告)日：2007-01-04

    申请号：US11171744

    申请日：2005-06-30

    申请人： Jeffrey Hamblin ,  Jonathan Schwartz ,  Kedarnath Dubhashi ,  Klaus Schutz ,  Peter Brundrett ,  Richard Ward ,  Thomas Jones

    发明人： Jeffrey Hamblin ,  Jonathan Schwartz ,  Kedarnath Dubhashi ,  Klaus Schutz ,  Peter Brundrett ,  Richard Ward ,  Thomas Jones

    IPC分类号： H04N7/16 ,  H04L9/32 ,  G06F17/30 ,  H04L9/00 ,  G06F7/04 ,  G06K9/00 ,  H03M1/68 ,  H04K1/00

    CPC分类号： G06F21/62 ,  G06F2221/2145 ,  G06F2221/2149

    摘要： An operating system for a computing device has a first session for a user that includes a first base process that has a first privileges token attached thereto. The first privileges token includes substantially a full set of privileges of the user on the operating system. The operating system also has a second session for the user that includes a second base process that has a second privileges token attached thereto. The second privileges token is derived from the first privileges token and includes only a minimum set of privileges of the user on the operating system. Thus, the second, limited token does not have all privileges associated with the first, full token but instead has a limited set of privileges and not extra privileges that could be employed to take actions that would be harmful, deceptive, or malicious.

    摘要翻译： 用于计算设备的操作系统具有用于用户的第一会话，所述第一会话包括具有连接到其的第一权限令牌的第一基本进程。 第一权限令牌在操作系统上基本上包括用户的一整套特权。 操作系统还具有用户的第二会话，其包括具有附加到其的第二权限令牌的第二基本进程。 第二个权限令牌是从第一个权限令牌导出的，并且仅包含操作系统上用户的一组最小权限。 因此，第二个有限令牌不具有与第一个完整令牌相关联的所有权限，而是具有一组有限的权限，而不是可以用于采取有害，欺骗性或恶意行为的额外权限。

    Running internet applications with low rights
    7.
    发明申请
    Running internet applications with low rights 有权
    运行低权限的互联网应用程序

    公开(公告)号：US20060277218A1

    公开(公告)日：2006-12-07

    申请号：US11145530

    申请日：2005-06-03

    申请人： Roberto Franco ,  Anantha Ganjam ,  John Bedworth ,  Peter Brundrett ,  Roland Tokumi

    发明人： Roberto Franco ,  Anantha Ganjam ,  John Bedworth ,  Peter Brundrett ,  Roland Tokumi

    IPC分类号： G06F17/30

    CPC分类号： G06F21/53

    摘要： In various embodiments, applications that are configured to interact with the Internet in some way are executed in a restricted process with a reduced privilege level that can prohibit the application from accessing portions of an associated computing device. For example, in some embodiments, the restricted process can prohibit applications from read and write access to portions of a system's computer-readable media, such as the hard disk, that contains administrative data and settings information and user data and settings. In these embodiments, a special portion of the disk, termed a “containment zone”, is designated and used by applications in this restricted process.

    摘要翻译： 在各种实施例中，被配置为以某种方式与因特网进行交互的应用程序在具有降低的权限级别的受限进程中执行，所述权限级别可以禁止应用访问相关联的计算设备的部分。 例如，在一些实施例中，受限制的过程可以禁止应用程序对包含管理数据和设置信息以及用户数据和设置的系统的计算机可读介质（例如硬盘）的部分进行读取和写入访问。 在这些实施例中，称为“容纳区”的盘的特殊部分在该限制过程中由应用程序指定和使用。