Computer security system

• US 20010047485A1
• Filed: 03/05/2001
• Published: 11/29/2001
• Est. Priority Date: 03/06/2000
• Status: Active Grant

• Current Assignee: JDA Software Group Incorporated (RedPrairie Holding Incorporated)
• Original Assignee: i2 Technologies US Incorporated (Panasonic Holdings Corporation)
• Inventors: Brown, Daniel, Zapata, Fernando
• Granted Patent: US 7,013,485 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A security system for a computer system provides one or more security domains. Access to assets registered to the security system is controlled by rights and privileges. Rights are derived from roles, and each user is assigned one or more roles. Privileges are attached to assets, and an appropriate combination of rights and privileges is required before a user is granted the specified type of access to the asset.

Claims

1. A security system for a computer system, comprising:

a plurality of assets within the computer system;

a plurality of members registered to use the computer system;

a plurality of roles defining user rights, each member having at least one role;

a plurality of access control lists corresponding to the assets, each list defining at least one privilege for accessing the asset according to a member'"'"'s role; and

at least one domain, each domain having a subset of the assets and corresponding access control lists, and a subset of the members;

wherein access is allowed by a member to a requested asset within a domain when that member has a role corresponding to a privilege for that asset.

2. The system of

claim 1

, wherein the privileges for each asset include actions that can be performed on that asset, and wherein access is allowed when a requested access by a member includes an action to be performed form the access control list.

3. The system of

claim 1

, wherein the privileges include a read privilege.

4. The system of

claim 1

, wherein the privileges include a modify privilege.

5. The system of

claim 1

, wherein the privileges include a delete privilege.

6. The system of

claim 1

, wherein the system includes at least two domains.

7. A method for providing secure access to assets within a computer system, comprising the steps of:

when a user attempts to access an asset within a domain, determining a at least one role assigned to the user;

comparing rights corresponding to the role assigned to the user to a list of privileges corresponding to the asset;

if the attempted access is allowed for a role assigned to the user, allowing the user to access the asset.

8. The method of

claim 7

, wherein a requested access is one from the types read, modify, or delete.

9. The method of

claim 7

, further comprising the step of:

prior to the user attempting to access any assets, authenticating the user'"'"'s identification, and assigning at least one role to the user.