[54] PROTECTION OF DATA FILE CONTENTS
[75] Inventor: Dennis M. Ritchie, Summit, N.J.

[73] Assignee: Bell Telephone Laboratories,
Incorporated, Murray Hill, N.J.

[21] Appl. No.: 377,591
[22] Filed: Jul. 9, 1973

[SU] Unt, C02 oonceccceeccsssescoeees GOG6F 11/10; GOGF 13/00

52] U.S. CL ccccseccssccssssecssscccssssecsssecsssuecossesesnee 364/200

[58] Field Of Search o..scccccccsssssssssssscscssssonee 340/172.5;
364/200 MS File, 900 MS File

[56] References Cited
U.S. PATENT DOCUMENTS

LU/1971 «9 Ullrich .u....0............eccceneseeee 340/172.5
12/1971 Amdahl et al. ................... 340/172.5
2/1968  Beausoleil et al. ................ 340/172.5
4/1968 Nelson et al. ...............c0000. 340/ 172.5
9/1969 Richmond ...................... 340/172.5
4/1971 Cordero et al. .........0.....0... 340/172.5
8/1971 Creech et all. ..........cccc:ceee 340/172.5
W2/1971 — Hofh oon. c eee ccee cece cccepsecene ences 364/200

- GB ,

Re. 27,239
Re. 27,251
3,368,207
3,377,624
3,469,239
3,576,544
3,599,159
3,631,405

STORED DATA e02

+

205 -~> a
R ID

204

COMPUTER

7
207
ACTUAL
USER ID

[45] Jan. 16, 1979

3,683,418 «= 8/1972 Martin 2.00... sseccosescceoneseee 340/172.5
3,735,364 S/197S =—§-_ attr once cccccseersenes 340/172.5
3,742,458 6/1973 Inoue et al... cee 340/172.5
3,761,883 9/1973 A] VALET ..........ceessecersreccennrcen 364/200

Primary Examiner—James D. Thomas
Attorney, Agent, or Firm—Stephen J. Phillips

[57] ABSTRACT

An improved arrangement for controlling access to
data files by computer users. Access permission bits are
used in the prior art to separately indicate permissions
for the file owner and nonowners to read, write and
execute the file contents. An additional access control
bit is added to each executable file. When this bit 1s set
to one, the identification of the current user is changed
to that of the owner of the executable file. The program
in the executable file then has access to all data files
owned by the same owner. This change is temporary,
the proper identification being restored when the pro-
gram is terminated.

4 Claims, 2 Drawing Figures

MEMORY

201 ;

AC
AE

EXECUTE
SEQUENCE

U.S. Patent 4,135,240

Sheet 1 of 2

FIG. [At

USER PASSWORD a D PROGRAM 2

Jan. 16, 1979
BOB LXR2
TED FRTE

JIM STPA

10
lot SUID BIT 07
102 OWNER ID 18

OWNER
03 RD WR EX
re ee

NON- OWNERS
WR EX

“oto
'PROGI" FILE
CONTENTS

I
SUID BIT 0.
OWNER ID  § |

RD WR
pot | tt

NON-OWNERS
EX

104

105

RD WR
"EDIT" FILE
CONTENTS

12
SUID BIT a
OWNER ID

OWNER
WR

RD EX
tt tt

NON-OWNERS
WR EX

"PROLL" FILE
CONTENTS
|

PASSWORD FILE

FILE STORAGE

PROLL

8 PROG|
6 EDIT

13

SUID BIT

OWNER ID

OWNER
RD WR EX

aE :
» NON DRNERS

CONTENTS

E
SUID BIT. 0”
OWNER ID | 6.

OWNER
RD WR EX

NON-OWNERS
RD WR EX

"BFILE" FILE
CONTENTS
|

aT BIT 2.
OWNER ID
OWNER
RD WR EX
tit {| ji [| 0
NON-OWNERS
RD wR EX
o | o | 0
CFILE" FILE

CONTENTS

Td

U.S. Patent Jan. 16, 1979 Sheet 2 of 2 4,135,240

STORED DATA 2° col
USER ID
OWNER ID STORED
SUID BIT \NSTRUCTIONS

OWNER RD WR EX
NON-OWNERS RD WR EX

218 | INSTRUCTION

LOCATION
COUNTER

ACCESS
DENIED

INSTRUCT ION
DECODER

EXECUTE FILE

ACCESS
REQUEST
| 216~} COMPARATOR ACCESS
OWNER ID
UID SIT | a REQUEST
| JOWNER_ID EXECUTE
220 SEQUENCE
1 2084 EFFECTIVE
USER ID
| 2005) (225K
luseR 1p _| LOGIN
204—Sts«* SEQUENCE

207 3
ACTUAL 4
USER ID | .
FILE
COMPUTER CONTROL

4,135,240

1

PROTECTION OF DATA FILE CONTENTS

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to computer systems, and more
particularly, to computer systems having multiple users
and multiple data files.

2. Description of the Prior Art

Computer systems are more efficiently operated
when there are multiple users, and file storage devices
are more efficiently used when many users share stor-
age space on the same physical device. Each user then
has the potential for accessing files belonging to other
users. Free access is not generally permissable since files
may contain programs or data of sensitive nature.

Virtually all computer systems provide means for
protecting sensitive files against access by users legiti-
mately present in the computer system but not autho-
rized to use all files. Hardware or software control
mechanisms are provided to decide at the time of a user
request for file access whether access permission is to be
granted or denied. In general the information necessary
for this decision are (1) file identity (2) user identity and
(3) access purpose.

Computer systems have been designed which include
elaborate lists identifying which users are permitted to
access which files for which purposes. The result is a
complex internal bookeeping task. As users share pro-
grams and data, the lists of permitted functions must be
interchanged. See the article “Dynamic Protection
Structures” by B. W. Lampson, AFIPS Fall Joint Com-
puter Conference, 1969, pp. 27-38. The scheme de-
scribed by Lampson solves the access permission prob-
lem in a general way, but the result is so complex that it
has not found wide acceptance in the computer field.

This improvement is addressed to the simpler
schemes which are in wide use. Each user of the com-
puter system is preassigned an identification number
(user ID). Whenever a user creates a file by reserving
file space for his own use, his user ID ts stored along
with the file to identify the file owner (owner ID). In
creating the file, the owner also specifies certain permis-
sions which are to be granted or denied to himself as
owner, and to everyone else as nonowners. Generally,
these permissions are for reading and for writing the
file. This information may be contained in as few as four
binary digits or “permission bits,” a modest addition to
each stored file. Also, in systems having a common
format for files containing programs and files contain-
ing data, it is usual to have permission information to

2

computer usage by the various users of the system. The
accounting programs and the accounting files are
owned by the same user who has permission to read and
write the accounting file to permit regular updates.
Suppose now that it is desired to permit each user to
read from the accounting file the information associated
with that user’s own computer usage. This 1s certainly a
legitimate access purpose so long as the user does not
attempt to read other accounting information which ts

10 considered private as far as he is concerned.

|)

20

25

30

33

45

indicate that the file contents may or may not be loaded —

into the computer and executed as a program. This may
comprise an additional execute permission bit, or an
additional two bits, separate permissions for owners and
nonowners.

The described scheme takes into account file identity
because access control information ts stored in associa-
tion with each file individually. User identity is taken
into account in a gross but useful distinction between
owner and nonowner. Access purpose is also a factor
because of the coarse selection between reading, writ-
ing and execution permissions.

A shortcoming with this scheme is its lack of ability
to include fine distinctions of access purpose. Consider,
for example, the problem of accessing a computer time
usage accounting data file. Such a file is used by com-
puter time accounting programs to store elapsed time of

35

65

Under the described scheme there is no simple way to
permit this kind of special purpose data file access. A
general user wishing to read the accounting file cannot
do so directly because he will not have nonowner per-
mission to read. He cannot execute the general account-
ing programs to read for him and return the information
because he will not have nonowner permission to exe-
cute the general accounting programs. Such permis-
sions must generally be denied to nonowners to assure
privacy of the accounting file contents. This problem is
further described in the article “MOO in Multics” by J.
M. Grochow, Software - Practice and Experience, Vol.
2, pp. 303-308 (1972).

SUMMARY OF THE INVENTION

The present invention adds a facility to the basic
protection scheme just described which permits com-
puter users to access a data file for any specific purpose.
This is done by providing for the execution of a com-
puter program to access the file, which program is sup-
plied by the file owner and thus can impose any degree
of control which the file owner wishes to include. This
new facility uses an additional file access control bit for
each stored file of executable program. This additional
bit is termed the “set user identification bit” (SUID bit).

The user ID which is stored by the computer and ts
effective to control subsequent file access is changed
whenever a stored file containing an executable pro-
gram (executable file) is loaded into computer memory
for execution and whenever the associated SUID bit is
set to one. The effective user ID is changed from that of
the actual user to that of the owner of the executable
file. During the execution of the program, therefore, the
current user appears to be the owner of the executable
file and all of the data files accessible to the owner of the
executable file are available to the program. The user
may request the program to access those data files, and
the program will operate to satisfy that access request in
the manner it was designed to do, making whatever
tests and restricting access in any manner intended by
the program designer, the actual owner of the execut-
able file and the data files. For the duration of the pro-
gram execution the change in user ID ts effective. When
the program is terminated, as for example the attempted
execution of a new program, the user ID of the actual
user is restored.

Under this improved scheme, the problem of ac-
counting file access 1s easily solved. The computer user
who owns the accounting programs and accounting file
provides a special program for nonaccounting users
which reads the accounting file. This special program
reads the user ID of the actual current user and com-
pares this with the user ID for the accounting file re-
cord sought to be read. If they match, the information
concerns the requesting user and can therefore be re-
turned to him. This special program is stored in a file
which has nonowner permission for execution, and
which has the SUID bit set to one.

4,135,240

3

When the general user executes the special program,
the SUID bit causes the effective user ID to be changed
to the owner ID of the special program, the accounting
user ID. Thus, during the execution of the special pro-
gram, access to the accounting files is allowed by the
owner permission bits of the accounting file. Now the
user requests the special program to read the account-
ing file. The special program has the proper permission,
but the action of the special program ts determined by
the accounting user who designed the special program.
The special program therefore reads the actual user [ID
of the requesting user and only returns to him the ac-
counting information from the accounting file which
relates to himself. The general user can therefore access
the accounting files only for the specific bona fide pur-
pose for which the special program was provided by the
accounting user. After the execution of the special pro-
gram is terminated, the effective user ID is restored to
the user ID of the actual user.

10

15

The accounting file access problem ts exemplary of 20

the type of problem this new facility alleviates. Other
applications will become apparent from the following
description of one embodiment of the invention.

BRIEF DESCRIPTION OF THE DRAWING

Taken together,

FIGS. 1a and 15 comprise a single Figure showing a
computer system embodying the present invention.

FIG. 1a illustrates a plurality of files stored in a com-
puter storage device, having access control information

FIG. 10 illustrates a digital computer and its memory
which operate in conjunction with the files stored in the
previous Figure to embody the present invention.

DETAILED DESCRIPTION

The drawing shows in a single Figure (comprising
FIGS. 1¢ and 16 together) a computer system compris-
ing computer 1 which accesses file storage Z by means

25

30

35

of file control 4 and accesses memory 3 by means of 40

memory control 5. Files 10, 11, and 12 contain stored
program information and are read from file storage 2
into memory 3 for execution by computer 1. Files 15,
14, 15 and 16 contain stored data information and are
read from file storage 2 into memory 3 in order that the
stored data contents may be accessed. Computer 1 is
controlled, for the most part, by instructions read from
memory 3 and executed by instruction decoder 6. In-
struction location counter 7 controls the location within
memory 3 of the stored instruction to be next executed
by computer 1.

In computer systems, it is common practice to refer
to files of programs or data by means of arbitrarily
chosen symbolic reference names. In keeping with this
practice files 10 through 16 will hereinafter be referred
to by such symbolic names as they appear in the Figure,
e.g., PROG1, EDIT, PROLL, AFILE, BFILE,
CFILE and PASSWORD, respectively. For conve-
nience, these names will also be used to denote program
or data contents of the respective files as well as the files
themselves. Thus PROG1 will be used to refer to file 10
as it appears in file storage 2 and also to the program
contained in file PROGI after being read into memory
3 for execution by computer 1.

As will become apparent the program PROGI regu-
larly accesses the data AFILE, the program EDIT
regularly accesses data BFILE and the program
PROLL regularly accesses data CFILE. Each of these

45

55

65

4

six files has associated with them various access control
information including: set user identification bit 101
(SUID bit), owner identification number 102 (owner
ID) owner permission bits 103 and nonowner permis-
sion bits 104. This information controls access to stored
file contents 105 in a manner to be described.

Each user of the computer system 1s identified by a
unique preassigned user identification number 106 (user
ID) which is retained in the PASSWORD file and
which is retrieved when the user begins requesting
computer services. A user may create a new file to
contain data or program by reserving space in file stor-
age 2 for that purpose. The owner ID of the new file is
then set to be equal to the user ID of the creating user.
Thus, the creating user is identified as the owner of the
file. When the new file is thereafter to be accessed, the
owner ID is compared with the user ID of the request-
ing user. If they match, owner permission bits 103 con-
trol file usage; if they do not match, nonowner permis-
sion bits 104 are used. Permission bits 103 and 104 are
set to values prescribed by the owner when the file is
created.

There are three permission bits each for owners and
nonowners labeled RD, WK and EX in the Figure
corresponding to read, write and execute permission,
respectively. When a permission bit is set to 1, the asso-
ciated function is permitted; when set to 0, the function
is denied.

In the Figure read, write and execute permission, are
granted for the respective owners of PROGI, EDIT,
and PROLL. Thus user “TED” with user ID equal to
18 in the PASSWORD file is permitted to read from the
contents of the PROGI file, write into the PROGI file,
and load the contents of the PROG! file for execution
as a program. Similarly, AFTLE, BFILE and CFILE
have permission for reading and writing by their respec-
tive owners. Execution permission is denied to both
owners and nonowners of AFILE, BFILE and CFILE
since these files contain data and now executable pro-
gram instructions.

In the Figure al] nonowner permissions are denied for
PROGI and AFILE. Thus only user “TED”, the
owner of PROG1 and AFILE, may access them. If user
“TED” executes PROGI, and if PROG1 contains ap-
propriate read and write instructions, PROG1 would be
capable of reading and writing AFILE. PROGI could
therefore represent a program written by user “TED”
for maintaining AFILE as a file of private data.

Nonowners are permitted to read and execute EDIT,
but not write into the EDIT file. EDIT could therefore
represent a program provided by user “JIM” its owner,
for public use but with a restriction upon its alteration
by any user other than its owner. This prevents unau-
thorized changes from being made in the EDIT pro-
gram. Nonowners of BFILE are granted both read and
write permission making it universally available.
BFILE may be a temporary storage file available to any
user.

PROLL has nonowner permission bits similar to
EDIT, making PROLL similarly publicly usable but
privately alterable only by user “BOB,” its owner.
CFILE has no permissions granted for nonowners.

In the Figure, each file has associated with it an addi-
tional file access control bit, the set user identification
bit (SUID bit). When the SUID bit is set to zero for a
given file, the effect of the various permission bits ts
exactly that which has been so far described; owners
and nonowners are identified by reference to their user

Operating system for a data processing system


GUIDED TRANSMISSION OF ULTRA HIGH FREQUENCY WAVES |

Filed March 16, 1953

E
2 SAN SE LE EMEAAAAN #8 AXAAA
F, " :

Hisulaiion

sp

ee ee

san

Ftg.10
a

nectbhets

S

Lo

S

T Sheets-—oheet 1:

[peas
TS

2b TE
=19.69
a ~
2b TO DG 2b 30
Aa.
4 287
20 3
\
\
QO
2b } 3b b 26 ey,
? INVENTOR
G. C. Southworth

OC wane

2,129,711

G. C. SOUTHWORTH

Sept. 13, 1938.

ATTORNEY

S
~
3 ,
» OD | |
\ t.
* G > % | ° ‘ ow
® l 7 wy} ©
ra }-7 AN AY Ll
Op: A RA Ke Welty y) J, } 4 E am |
Ee S27) SN : - SS
| <=
> 2 ¥ MSKSLES V % SS >
= 0 My PESXST= . i cn
é SSS .
™~
ce »
g g
2 } VD
fs ro
Ba | vi on Hatiny
B® Sy
oc * a re (rn fen\ (rn)
co ss (IS Clay hy
re " = Ws IS 7
aS uO
-  g B78
kK, 2
oO
z % ,
+6
ma ah
t) jy 26 tL-
i Nn
a OZ 2/4
8 $2'Ol -
ca
: 83
am | .
= 3
wD DH it
: ! L [ ~~
A ™
RB © N © H F S.

APIONIA _
IAIN D 2104 Wx NY. SH

Sept. 13, 1938.

GUIDED TRANSMISSION OF ULTRA HIGH FREQUENCY WAVES

xr.

_ Veloctty of Light
Veloctty of Wowe tn Guide

S

[a

a Ny

Sd

G. C. SOUTHWORTH

Filed March 15,

2,129,

711

1933 Yt Sheets—-sheet 3

=e

| l sul .
&O J7O =§=§=— G0 200 240 280 520

Wawe Lengt!z ~ Crs.

—_ eee —

1 hn.

A
\ — a

ee Poe ae Jy, OTCEeE oF Co ed Td é red

a) wgrals Modulator £Fittlter mit?

Wave
Guide

¥

GF || SF [+153

Osciidator

Coupling

Ch2tt” Demodulator Amplifier

7
pt bs 5g OF

| Hig. 13

5

|

aS OF || GF |—>

60

59 KE G2

G7

Gscitiater
" INVENTOR

Lay 7 4-

G.C. Scuthwortt
BY :

fi tee
ATTORNEY

Sept. 13, 1938. | G. C. SOUTHWORTH 2,129,711
GUIDED TRANSMISSION OF ULTRA HIGH FREQUENCY WAVES

Filed March 16, 1933 7 Sheets-Sheet 4

1
|

3 Parallel wires of
aadzustable length

SSeS ee

_ = = ee

me i oe

—7

Coup (tmg AL}

QOO A ) ‘ , 73
\ | G .
Modulation ~ 000 wk =) Oscullatory nf Lita. 10

— 000
af | Co | 412 | ib -

L Ny
Z, z, Ey fower SUBILY

MeLt
+ <*ys *

4 way td

y are eed

OF Ge aot Ped ae

f
bAtelded.
Conductors —
Jor Lower_and
Signal input

=
* a *
Ce i oe 2 bala |
Cc! *" art |
pov | y ' a oun np

-
¥F
qf a

SPiielded

Shielded Llug Oscillator fA LY- 1S

‘Copper Plate 25 Bayonet Connecttowm

a A

Se te Yat
en) ; .
ees r “Pa*

= s ® - .
' * Tal a“, % *

phates geal reriflaant eileen a, ih ok” ak a a a eel ae a ar ae
F

oy “SD. ( :

afar
Ye eid

}

+
-

a
_

a

i

|
a1
a
ay
4 .
+

i

=

1
oe

/ vi) oo on agon8 6

Shielded 7

Pug ANA Leaas 4 JR veeeees 4

Jor Lower ang NSS 65 =
i ae

Sigal 1a a at
6G Glass -cogoer Seals

INVENTOR
LAGI 37 G.C. Southworth,
Y

PEAR

ATTORNEY

4
-
a
aoig

ete te

a Fa ar
a

vm,
a =
— weeks wea ety a+

*
ste

'

Teer

a4ye a iy al

a!

FIP PS Oe 2S P.O Pee

44% de
I

'

S

Sept. 13, 1938. = 3 ~— 6. © SOUTHWORTH 2,129,711
GUIDED TRANSMISSION OF ULTRA HIGH FREQUENCY ‘WAVES
Filed March 16, 1933 7 Sheets-Sheet 5

Detector Amplifier,
4 \ Chokes +

Wi Fig. 20
TE AMajustable coupling ~
a a Almypalsfter
Yy Conductors of - : —_
ag estabile ERG. | |
LAG) 22

COU
pang - Detector
—, eee

og 4 estab tris

Dielectric wie

LAG LF | | Leo

Oscriiltator

Coupling Tuned
met Detector Amplifier Detector Amplifier

(2 EKO fF FE

|

ror

.  Oscvator

INVENTOR

G.C. Southworth
BY

¢ ATTORNEY

Guided transmission of ultra high frequency waves