-
公开(公告)号：US20060248585A1
公开(公告)日：2006-11-02
申请号：US11117621
申请日：2005-04-28
申请人： Richard Ward , Jeffrey Hamblin , Peter Brundrett
发明人： Richard Ward , Jeffrey Hamblin , Peter Brundrett
IPC分类号： H04L9/32
CPC分类号： G06F21/6218 , G06F2221/2141 , G06F2221/2149
摘要： The contemplated embodiments of the invention provide a method for implementing a mandatory integrity control (MIC) system that provides access control for each and every object and subject that need access control, but in a way that allows legacy operating systems to continue with little modification. The invention provides a novel method that selects an integrity level designator for a subject, when the subject logs onto the computer system. The selected integrity level designator is then added to an existing data structure in the computer system. The existing data structure may be a part of a security descriptor stored in a system access control list of an object. The existing data structure may be a part of a list of security permissions that constitute an access token for a process executing as a subject.
摘要翻译： 本发明的预期实施例提供了一种用于实现强制完整性控制（MIC）系统的方法，该系统为需要访问控制的每个对象和对象提供访问控制，但是允许传统操作系统继续进行很少的修改。 本发明提供了一种当主体登录到计算机系统时为对象选择完整性级别指示符的新颖方法。 然后，将所选择的完整性级别指示符添加到计算机系统中的现有数据结构。 现有数据结构可以是存储在对象的系统访问控制列表中的安全描述符的一部分。 现有数据结构可以是构成作为主体执行的进程的访问令牌的安全许可列表的一部分。
-
2.发明申请Providing user on computer operating system with full privileges token and limited privileges token 有权在计算机操作系统上为用户提供完全权限令牌和有限权限令牌公开(公告)号：US20070005961A1
公开(公告)日：2007-01-04
申请号：US11171744
申请日：2005-06-30
申请人： Jeffrey Hamblin , Jonathan Schwartz , Kedarnath Dubhashi , Klaus Schutz , Peter Brundrett , Richard Ward , Thomas Jones
发明人： Jeffrey Hamblin , Jonathan Schwartz , Kedarnath Dubhashi , Klaus Schutz , Peter Brundrett , Richard Ward , Thomas Jones
CPC分类号： G06F21/62 , G06F2221/2145 , G06F2221/2149
摘要： An operating system for a computing device has a first session for a user that includes a first base process that has a first privileges token attached thereto. The first privileges token includes substantially a full set of privileges of the user on the operating system. The operating system also has a second session for the user that includes a second base process that has a second privileges token attached thereto. The second privileges token is derived from the first privileges token and includes only a minimum set of privileges of the user on the operating system. Thus, the second, limited token does not have all privileges associated with the first, full token but instead has a limited set of privileges and not extra privileges that could be employed to take actions that would be harmful, deceptive, or malicious.
摘要翻译： 用于计算设备的操作系统具有用于用户的第一会话，所述第一会话包括具有连接到其的第一权限令牌的第一基本进程。 第一权限令牌在操作系统上基本上包括用户的一整套特权。 操作系统还具有用户的第二会话，其包括具有附加到其的第二权限令牌的第二基本进程。 第二个权限令牌是从第一个权限令牌导出的，并且仅包含操作系统上用户的一组最小权限。 因此，第二个有限令牌不具有与第一个完整令牌相关联的所有权限，而是具有一组有限的权限，而不是可以用于采取有害，欺骗性或恶意行为的额外权限。
-
公开(公告)号：US08646044B2
公开(公告)日：2014-02-04
申请号：US11117621
申请日：2005-04-28
IPC分类号： G06F7/04
CPC分类号： G06F21/6218 , G06F2221/2141 , G06F2221/2149
摘要： The contemplated embodiments of the invention provide a method for implementing a mandatory integrity control (MIC) system that provides access control for each and every object and subject that need access control, but in a way that allows legacy operating systems to continue with little modification. The invention provides a novel method that selects an integrity level designator for a subject, when the subject logs onto the computer system. The selected integrity level designator is then added to an existing data structure in the computer system. The existing data structure may be a part of a security descriptor stored in a system access control list of an object. The existing data structure may be a part of a list of security permissions that constitute an access token for a process executing as a subject.
摘要翻译： 本发明的预期实施例提供了一种用于实现强制完整性控制（MIC）系统的方法，该系统为需要访问控制的每个对象和对象提供访问控制，但是以允许传统操作系统继续进行很少修改的方式。 本发明提供了一种当主体登录到计算机系统时为对象选择完整性级别指示符的新颖方法。 然后，将所选择的完整性级别指示符添加到计算机系统中的现有数据结构。 现有数据结构可以是存储在对象的系统访问控制列表中的安全描述符的一部分。 现有数据结构可以是构成作为主体执行的进程的访问令牌的安全许可列表的一部分。
-
-
搜索结果
3 条记录 (耗时 0.016 秒)
