Network system and method for changing access rights associated with account IDs of an account name

• US 10,129,173 B2
• Filed: 01/15/2014
• Issued: 11/13/2018
• Est. Priority Date: 01/31/2013
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Kayaba, Seijiro
• Primary Examiner(s): Duong, Oanh
• Application Number:
  US14/759,760
• Publication Number:
  US 20150350107A1
• Time in Patent Office: 1,763 Days
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 47/808 User-type aware
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/306 User profiles

Abstract

In an account association table the account IDs and account names of accounts created at nodes are associated and recorded. In response to an access control list change request including the account name of an account the access control entry of which is to be changed and the contents of the change, an access control list change unit retrieves an account ID recorded while being associated with the account name from the account association table and changes, in accordance with the contents of the change, an access control entry in which the retrieved account ID is recorded among account control entries in an access control list to be changed.

Claims

1. A network system comprising:

a memory;

an account association table storage in which account IDs and account names are associated with each other;

a shared storage storing at least one object file to be accessed from nodes; and

an access control for unit, stored in the memory, for managing access rights to the at least one object file for associated account IDs, the access control unit being implemented by a computer processor;

wherein in response to receiving a request for changing the access rights to the at least one object file, the access control unit;

searches account IDs associated with an account name attached to the request in the account association table storage, and

when multiple account IDs associated with the account name are detected, changes the access rights associated with the detected account IDs at a time.

2. The network system according to claim 1, further comprising:

an account management unit, stored in the memory, for receiving an account association table registration request including an account ID and an account name, and registering the account ID and the account name in the account association table storage.

3. The network system according to claim 1, further comprising:

the access control unit for sending an access request to access to an object file in the shared storage.

4. The network system according to claim 1, further comprising:

a file registration unit, stored in the memory, that, in response to a file registration request, registers a registration target file in the shared storage, and creates an access control entry in an access control list of the registration target file.

5. An access control list change method for a network system, the network system comprising an account association table storage in which account IDs and account names are associated with each other, and a shared storage storing at least one object file to be accessed from nodes, the access control list change method comprising:

managing access rights to the at least one object file for associated account IDs;

wherein in response to receiving a request for changing access rights to the at least one object file, the method further comprises;

searching account IDs associated with an account name attached to the request in the account association table storage, and

when multiple account IDs associated with the account name are detected, changing the access rights associated with the detected account IDs at a time.

6. A non-transitory computer readable storage medium recording thereon a program, causing a computer to run the program to:

refer to an account association table storage in which account IDs and account names are associated with each other, and a shared storage storing at least one object file to be accessed from nodes; and

manage access rights to the at least one object file for associated account IDs;

wherein in response to receiving a request for changing the access rights to the at least one object file, the computer runs the program to;

search account IDs associated with an account name attached to the request in the account association table storage, and

when multiple account IDs associated with the account name are detected, change the access rights associated with the detected account IDs at a time.