Security management tool for managing security attributes in computer systems

[0002] A computer system is typically purchased and supplied as a combined hardware-software system. Many computer system suppliers use high-capacity compact disk (CD) ROMs for supplying software images. The computer system suppliers that supply software on CD ROMs only sell a limited number of hardware configurations (for example 4 to 8) that utilize even fewer software configurations (for example 2 or 3). The software system includes a common operating system, hardware drivers, software utilities, and application programs for usage among all computer systems of a particular configuration. These computer system suppliers have the software diskettes pressed en masse, generally in batches in the ten thousand to the hundred thousands range, so that identical software systems are supplied interchangeably to many computer systems.

[0003] The conventional hardware computer system typically includes various different hardware subsystems. During installation of these conventional mass-produced software systems to hardware computer systems, some software configuration is generally performed. The downloading process often includes routines that automatically detect an identification of the hardware subsystems and build appropriate drivers for the detected subsystems.

[0004] Many different hardware vendors supply the hardware subsystems and often many different software suppliers supply software modules supplied on the mass-produced diskettes. A common problem with the conventional technique for supplying software to a computer system using mass-produced software is that various inconsistencies often arise among the various hardware subsystems and the software modules. The first time a particular hardware-software system configuration is combined is when a customer attempts to bring up the system, long after the system has left the factory. A customer typically does not have the expertise to correctly set up various configurable characteristics of the hardware and software to optimally execute the software on a particular hardware configuration. Therefore, bringing up a system is often a painful and time-consuming exercise for the both the computer system customer and the vendor with the customer making frequent usage of the vendor's customer help services.

[0005] Security configuration is another aspect of defining and setting the system configuration in business and personal computing. Companies and individuals invest greatly, both in money and time, in the purchase of executable software and the development of information contained in databases, textual documents, spreadsheets, and the like. The protection of information resources in an important concern.

[0006] Businesses and personal computer users demand the incorporation of security and integrity features into computers to protect access to critical files and to guarantee the trustworthiness of installed programs. An ideal implementation of security features interferes with normal computer operation only minimally.

[0007] Two causes of security breaches in computer systems are file corruption and viruses. File corruption occurs in an event such as a system failure that occurs during a file transfer. File corruption is thus largely avoided by controlling the power-down sequence of the computer system, particularly in computers with advanced operating systems such as Windows 95™ and Windows NT™. Operating systems control power-down by requiring the user to shut down using specified steps rather than by simply turning off the power switch. Restriction of the power-down sequence allows various status information and configuration data contained in a Windows Registry file to update only when the system is properly shut down. Data stored in a disk cache is flushed to the disk only when the user properly exits Windows 95™ or Windows NT™.

[0008] Network connections that are not properly terminated violate system security. For example, termination of power that violates the shutdown procedure can corrupt the Windows Registry file and compromise reliability of the computer during subsequent operations. It should be noted, however, that properly exiting these operating systems requires the user to take affirmative action via menu commands prior to toggling the on/off power switch.

[0009] Computer viruses are the second threat to software integrity and can be hostile, clandestine and created to target specific types of software or hardware. Viruses are introduced into a computer in any way the computer communicates externally including a floppy drive, a network connection, a modem connection, or the like. Viruses self-replicate, generating multiple copies and secretly attaching copies to files or boot records so that the user is unaware of the intrusion. Once a virus has attached to a host program, integrity of the host is violated. Once infected, any subsequent copies of the host file also contain the virus, thereby increasing the potential for destruction. The virus is then activated when the file is executed. Consequently, a virus attached to a data file may remain dormant because the data file is not executable.

[0010] A further aspect of system configuration in computer systems is the security configuration of a particular computer system within a network. One trend in computing is the development of client/server architectures in distributed computing environments to support transaction processing applications. Present-day distributed computing environments often include interconnected mainframes, minicomputers, servers and workstations. Integration of mainframes, minicomputers, servers and workstations into a distributive computing environment creates the need for system management tools sufficient for reliable operation.

[0011] Computer purchasers who deal with Dell Computer, Inc. frequently order computer systems configured with one or more software customizations. Some customizations include loading of specific application software and setting of specific software attributes. No automated procedure exists for setting software attributes. In particular, no automated procedure exists for setting system security attributes so that security attributes are either not set or are set using tedious and error-prone manual techniques.

[0012] Current manual techniques for setting security attributes in computer systems operating in a Windows NT™ environment, for example, include checking of security settings on a system using tools supplied by the Windows NT™ operating system. Tools include User Manager, Windows NT Explorer™, and a Microsoft™ Registry Editor. A user typically employs the tools to check security settings on one computer and then, using the same tool set, recreates the security settings on another computer. Microsoft™ supplies additional tools as part of a Windows NT™ resource kit and a Zero Administration Kit (ZAK) that partially automates configuration tasks.

[0013] What is needed is a configuration utility that efficiently and accurately configures security attributes for a large number of computer systems with variable security requirements. Existing general purpose utilities such as the Microsoft™ Registry Editor are error prone and do not have the ability to configure multiple computers simultaneously.

[0014] A Security Management Tool (SMT) is defined and created that solves the problem of efficiently and accurately configuring security attributes for multiple computer systems. To this end, a method of configuring security attributes in a computer system includes reaching a file in a storage medium, the file storing a plurality of security attributes acquired from a previously-configured computer system; and setting a security setting of the computer system, the security setting corresponding to a security attribute read from the file.

[0015] The features of the described embodiments believed to be novel are specifically set forth in the appended claims. However, embodiments of the disclosure relating to both structure and method of operation, may best be understood by referring to the following description and accompanying drawings.

[0016] FIG. 1 is a schematic block diagram showing a high-level logical structure of a network within which an embodiment of a Security Management Tool (SMT) is implemented.

[0017] FIG. 2 is a flow diagram showing a process flow used for configuring security attribute information under Security Management Tool (SMT) control.

[0018] FIG. 3 is a schematic block diagram that illustrates modes of operation of a Security Management Tool (SMT) that is used to configure security attributes in a computer system.

[0019] FIG. 4 is a schematic flow diagram illustrating operation of a configuration routine of a Set Mode operation.

[0020] FIG. 5 is a schematic block diagram that depicts a network system that is suitable for implementing the Security Management Tool.

[0021] FIG. 6 is a block diagram showing computer system hardware that is suitably configured using the Security Management Tool.

[0022] Referring to FIG. 1, a schematic block diagram shows a high-level logical structure of a network within which an embodiment of a Security Management Tool (SMT) 100 is implemented. A central security configuration database 110 stores security attribute information 116 in a security management system 112. The SMT 100 controls generation of and access to security attribute information 116 that is stored within the central security configuration database 110. The security attribute information 116 contains various types of security information which may be used by selected devices of a plurality of devices 114 in a distributed computing and networking system. In some embodiments, the devices 114 are computers or computing systems that are connected to the security management system 112.

[0023] The security attribute information 116 includes information that is used to configure a device 114 for a specified security functionality. The plurality of devices 114 generally includes devices that are dynamically connected to and disconnected from the security management system 112 network for the purpose of capturing and setting security attributes on the devices 114. A “model” or “master” device 118 has a known security attribute configuration that is stored in the central security configuration database 110 during a “capture” operation. Generally, a plurality of security attribute configurations, captured from a plurality of master devices 118, are stored in the central security configuration database 110. A particular security attribute configuration is selected from the central security configuration database 110 using the SMT 100 and set in a particular selected device 114.

[0024] Any number or combination of devices 114 and master devices 118 may be connected to the security management system 112 at one time. For example, a single master device 118 and no devices 114 may be connected to the security management system 112 during capture of the security attribute configuration for the connected master device 118. Subsequently either single devices 114 may be connected to the security management system 112 or multiple devices 114 may be connected in combination during setting of the configuration in the devices 114. The master device 118 may be connected or disconnected from the security management system 112 during setting of the security attribute configurations of the devices 114. In other examples, a plurality of master devices 118 may be connected to the security management system 112 while any number of devices 114 are connected.

[0025] Referring to FIG. 2, a flow diagram shows a process flow used for configuring security attribute information under Security Management Tool (SMT) control. The SMT 100 operates automatically to specially configure the security management operations of a particular computer system according to the hardware and software configuration of the system, and according to the requests and desires of the user. The flow diagram depicts an automated security configuration procedure 200 that selectively sets static security attributes of the computer system. The security attributes are divided into several attribute classifications including users, groups, access control list (ACL), files, and registry keys.

[0026] The process flow of the security configuration procedure 200 begins when a customer 210 generates an order and submits the order to the manufacturer/seller 212. During the ordering procedure, the customer 210 creates an order specification including specification of hardware, software, peripherals, and configuration information. The order specification includes a security image 214 that the customer 210 generates in combination with the manufacturer/seller 212. Content of the security image 214 is based upon the particular hardware, software, peripherals, and configuration information specified by the customer, in addition to any particular security features that are affirmatively requested by the customer 210.

[0027] The customer generates an order specification using one of a variety of ordering techniques including ordering at a retail or wholesale distributor, or other type of system supplier. Other ordering techniques include ordering by telephone, mail, or electronic mail. Other orders are produced and submitted by communication techniques such as ordering by internet or other network communication.

[0028] The manufacturer/seller 212 then accesses a configuration image database 216 which includes the central security configuration database 110 and assembles an image including user information, group information, file system information, and registry information, for example. The configuration image database 216 supports a plurality of operating environments, such as Windows NT™, Microsoft Office™, and other environments. The configuration image database 216 further includes various executable files including the Security Management Tool (SMT) file and including selected database files such as relational database files. A particular generated image 218 is produced from the configuration image database 216 and is selected based on the security image 214 generated by the customer 210 in conjunction with the manufacturer/seller 212.

[0029] The generated image 218 is transferred from the configuration image database 216 and supplied to a manufacturing facility 220 that integrates the hardware, software, and peripherals selected by the customer 210 to form a computer system having the selected configuration. Various manufacturing facilities may include differing aspects of manufacture. For example, various manufacturing facilities may perform differing amounts of hardware assembly, some completely assembling all components, others simply supplying a completely functional hardware system. Various manufacturing facilities install the generated image 218 using differing techniques such as loading from media such as diskette or CD ROM, and direct download via communication port.

[0030] One particular technique for generating the image is by system cloning, a sector-by-sector brute force copying of a master system hard drive. One problem with system cloning is that system security identifiers (SIDs) are copied along with the images, causing a breach in security. A utility program is supplied to modify the SIDs within the image so that the SIDs correspond to an appropriate security identifier. A further problem is that Microsoft Windows does not support system cloning.

[0031] A second technique for generating a security image includes creating desired executable images including control structures such as Access Control Lists (ACLs), then modifying the ACLs using an ACL editor utility.

[0032] A third technique for generating a security image uses a scripting language, for example, WinBatch, Pearl, REXX, and the like, to access and edit security attributes. The scripting languages typically use Win32 Application Program Interfaces (APIs) including C++ language modification of pointers to tailor security characteristics.

[0033] A fourth technique for generating a security image uses a Windows NT™ security editor to modify security attributes.

[0034] Referring to FIG. 3, a schematic block diagram illustrates modes of operation of a Security Management Tool (SMT) 100 that is used to configure security attributes in a computer system. The illustrative Security Management Tool (SMT) 100 is a stand-alone utility that solves the problem of efficiently and accurately configuring security attributes for multiple computer systems. The SMT 100 includes a graphical user interface that interactively and selectively operates in one of at least two functional modes. Two of the operating modes are a Capture Mode 310 and a Set Mode 312. Typically, an operator selects the mode of operation using an interface such as the graphical user interface (GUI) although other types of interfaces may otherwise be employed. Typical security information groupings for files in the security information database 330 include User/Group security information, file system security information, registry system security information groupings, and the like. SMT 100 stores security information in a security attribute file in the security information database 330 that serves as a central security configuration database.

[0035] In the Capture Mode 310, the SMT 100 captures previously specified security information and stores the information in a file in a security information database 330. Upon interactive request by the operator, the SMT 100 executes an automated operation that is controlled by operator instructions that invokes the Capture Mode 310. In the Capture Mode 310, the SMT 100 captures a definition of the security attributes on a particular, selected computer system. An exemplary Security Management Tool system operates to capture some or all of the security information from a previously-configured computer system that operates under the Windows NT™ operating system and to store the security information in a file in the security information database 330. In a subsequent operation, the operator invokes the Set Mode 312 which accesses an operator-specified file in the security information database 330 and sets the captured security attribute definition on one or more subsequently-configured systems. In the illustrative example, the SMT 100 replicates the captured Windows NT security information on another, subsequently-configured computer system.

[0036] The SMT 100 captures and configures, and thus duplicates, security attribute information according to selected security information groupings. In an illustrative system, the Capture Mode 310 begins with a Get User/Group Information 320 operation. The Get User/Group Information 320 operation captures a user name, a user comment, and associated user flags and stores the user and group information in a file in the security information database 330 for configuration of a subsequently-configured system. The Get User/Group Information 320 operation also captures any user rights and user profiles associated with the users for later configuration of user rights and profiles on the subsequently-configured system. The Get User/Group Information 320 operation also captures a group name, group comment, and identification of associated group members, as well as any rights granted to the particular group for later configuration of groups and group rights.

[0037] The Capture Mode 310 includes a Get File System Information 322 operation. The SMT 100 captures Access Control Lists (ACLs) associated with each file and directory on the system. The ACLs are stored in a file within the security information database 330 and used for configuration of other systems.

[0038] The exemplary Capture Mode 310 further includes a Get Registry System Information 324 operation. The SMT 100 captures Access Control Lists (ACLs) associated with each registry key on the system. The Get Registry System Information 324 operation also captures ownership settings for files and registry keys. The registry key ACLs and ownership setting are stored in the security information database 330.

[0039] In the Set Mode 312, the SMT 100 uses information from a specified security information file that is interactively selected from among security information files created by the Capture Mode 310 operation. A Set User/Group Information 332 operation accesses user and group information from the specified file in the security information database 330 and sets the configuration of a newly-configured system. In one embodiment, the SMT 100 supports user/group support for Windows NT™ regardless of the file system that is currently installed on the system. In one embodiment, SMT 100 supports files on Windows NT™ systems that use an NTFS (Windows NT ™ File System).

[0040] In a Set File System Information 334 operation, the SMT 100 accesses file and directory ACLs from the specified file in the security information database 330 and transfers the ACLs for usage in a newly-configured system. Similarly, in a Set Registry System Information 336 operation, the security information database 330 is accessed to read registry key ACLs and ownership settings to set registry and ownership in the newly-configured system.

[0041] Referring to FIG. 4, a schematic flow diagram illustrates the operation of a configuration routine that functions according to the Set Mode 312 operation described with respect to FIG. 3. The Security Management Tool (SMT) 100 is invoked at the initial bootstrap loading 410 of a computer system that is not yet configured, such as newly constructed computer system or a used system that has been initialized. Initial bootstrap loading 410 is typically invoked through a special initialization programming such as Basic Input/Output System (BIOS) programming 420, generally without operator interaction or intervention. Initial bootstrap loading 410 in the target BIOS 420 activates a, Set Security Attributes 412 functionally that is operational under control of an operating system 422 and accesses the security information database 330 in an Access Database 414 operation. The Access Database 414 operation functions as a manufacturer's process 424. The Access Database 414 operation is typically encrypted to ensure security.

[0042] The accessed information is then loaded to security attribute structures in the system under configuration in a Configure Attributes 416 operation that includes interaction of the operating system 422 and the manufacturer's process 424. The Configure Attributes 416 operation includes keying of Access Control Lists 426 using string identifiers.

[0043] Referring to FIG. 5, a schematic block diagram depicts a network system under which the Security Management System 100 is optionally implemented. A system administrator 510 controls operation of the SMT 100 within a network 500. The system administrator 510 is activated by an operator who interactively directs operations from a new account computer 512. An operator having an administrative priority logs onto the network system and the SMT 100 for configuration of a new system 514 using a Set Mode 312 operation, as described with respect to FIG. 3. Prior to configuration, an operator has captured security attributes and stored attributes on the security information database 330. The security information database 330 includes a compressed User Profile file 516. The operator interacts with the system administrator 510 to select desired security attributes for the new account computer 512 and creates a security information file 518 that holds the selected security attributes. After the security information file 518 is formed, the operator configures the new account computer 512 from the security information file 518.

[0044] Referring to FIG. 6, a block diagram shows computer system 600 that is suitably configured using the Security Management Tool (SMT) 600. The computer system 600, typically a personal computer, includes a processor 610, a system random access memory (RAM) 620, a system ROM 622, a CD-ROM drive 632, and various other input/output devices 640. The computer system 600 is shown to include a hard disk drive 630 connected to the processor 610 although some embodiments do not include the hard disk drive 630. In particular, an illustrative method for building a bootable operating system compact disk (CD) for use with a computer system with or without a hard disk drive installed and formatted is useful when the computer system 600 either does not include a hard disk drive 630 or the hard disk drive 630 does not have an operating system, for example the Windows™ operating system, installed on the hard disk drive 630.

[0045] The processor 610 communicates with the system components via a bus 650 which includes data, address and control lines. A CMOS clock nonvolatile RAM 660, which is connected to the processor 610 via the bus 650, is typically utilized to store information even when power to the computer system 600 is interrupted. Program instructions that make up the system for creating an operating system independent environment are stored in a storage device such as the hard disk drive 630 or the system ROM 622 connected to the processor 610. The processor 610, for example an x86 processor such as a 486, 586 or Pentium™ processor, executes the computing operations of the computer system 600.

[0046] While the disclosure has been described with reference to various embodiments, it will be understood that these embodiments are illustrative and that the scope of the disclosure is not limited to them. Many variations, modifications, additions and improvements of the embodiments described are possible. For example, those skilled in the art will readily implement the steps necessary to provide the structures and methods disclosed herein, and will understand that the process parameters, materials, and dimensions are given by way of example only and can be varied to achieve the desired structure as well as modifications which are within the scope of the disclosure. Variations and modifications of the embodiments disclosed herein may be made based on the description set forth herein, without departing from the scope and spirit of the disclosure as set forth in the following claims.

[0047] In the claims, unless otherwise indicated the article “a” is to refer to “one or more than one”.