Access tester

• US 20020165960A1
• Filed: 02/26/2001
• Published: 11/07/2002
• Est. Priority Date: 07/10/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Chan, Christine Wai Han
• Granted Patent: US 7,464,162 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

The Access Tester allows an administrator, or any other authorized user, to determine who or what entities have access to a resource, whether a particular individual or set of individuals have access to a resource under certain conditions and whether the authorization rules associated with a resource operate as intended. In one embodiment, an administrator uses a graphical user interface to enter access information. Exemplar access information includes one or more URLs identifying the resource(s), one or more request methods, one or more IP addresses, date and time restrictions, and an identification of one or more users. The Access Tester determines whether the identified users are authorized to access the resource(s) associated with the URL(s) using the request methods, during the date and time provided.

Claims

1. A method for testing access to a resource available on a network, comprising the steps of:

receiving access information;

testing whether said resource is authorized for use based on said access information without granting authorization to said resource; and

reporting whether said resource is authorized for use based on said step of testing.

2. A method according to claim 1, wherein:

said step of receiving access information includes receiving said access information from a user interface.

3. A method according to claim 1, wherein:

said access information is capable of including an identification of said resource, identification information for one or more entities, one or more request methods, an address of a device, date information and time information.

4. A method according to claim 1, wherein:

said access information includes an identification of one or more entities;

said identification of one or more entities includes a user name; and

said step of testing includes determining whether an entity associated with said user name can access said resource.

5. A method according to claim 1, wherein:

said access information includes an identification of one or more entities;

said identification of one or more entities includes a user role; and

said step of testing includes determining whether a set of one or more entities satisfying said role can access said resource.

6. A method according to claim 1, wherein:

said access information includes an identification of one or more entities;

said identification of one or more entities includes a rule; and

said step of testing includes determining whether a set of one or more entities satisfying said rule can access said resource.

7. A method according to claim 1, wherein:

said access information includes timing information.

8. A method according to claim 7, wherein:

said timing information includes a time range; and

said step of testing includes determining whether a set of entities can access said resource within said time range.

9. A method according to claim 7, wherein:

said timing information includes a date range; and

said step of testing includes determining whether a set of entities can access said resource within said date range.

10. A method according to claim 1, wherein:

said access information includes an address of a device; and

said step of testing includes determining whether an entity using said device can access said resource.

11. A method according to claim 1, wherein:

said access information includes an access request method; and

said step of testing includes determining whether an entity can access said resource using said access request method.

12. A method according to claim 1, wherein:

said access information includes a URL identifying said resource.

13. A method according to claim 1, wherein:

said access information includes an identification of a set of entities; and

said step of testing includes the steps of;

(a) selecting an entity,

(b) checking authorization for said entity, and

(c) repeating steps (a) and (b) for each remaining entity in said set of entities.

14. A method according to claim 1, wherein:

said access information includes an identification of said resource and does not include an identification of any entities; and

said step of testing determines which entities can access said resource.

15. A method according to claim 1, wherein:

said access information includes an identification of an entity and does not include an identification of any resources; and

said step of testing includes determining which resources can be accesses by said entity.

16. A method according to claim 1, wherein:

said access information includes information for identifying a first user; and

said step of testing includes the steps of;

accessing an identity profile for said first user, and

comparing information in said identity profile to authorization criteria for said resource to determine whether said. first user is authorized to access said resource.

17. A method according to claim 1, wherein:

said step of testing includes determining whether an authorization rule is satisfied.

18. A method according to claim 17, wherein:

said access information includes information for identifying a set of one or more entities;

said authorization rule includes role criteria; and

said step of determining whether an authorization rule is satisfied includes evaluating whether said set of one or more entities meet said role criteria.

19. A method according to claim 17, wherein:

said access information includes information for identifying a set of one or more entities;

said authorization rule includes rule criteria; and

said step of determining whether an authorization rule is satisfied includes evaluating whether said set of one or more entities meet said rule criteria.

20. A method according to claim 1, wherein:

said step of reporting is user configurable so that a user an provide an indication of whether to display one or more authorization rules.

21. A method according to claim 1, wherein:

said step of reporting includes displaying first information indicating that a first user can access a first resource at a first time and second information indicating that said first user cannot access said first resource at a second time.

22. A method according to claim 1, wherein sad step of testing includes the steps of:

searching for a specific authorization rule;

determining authorization using said specific rule if said specific rule is found; and

determining authorization using a default rule if said specific rule is not found.

23. A method according to claim 1, wherein said step of testing includes the steps of:

identifying a policy domain;

searching for a policy;

determining authorization using a default rule for said policy domain if no policy is found; and

determining authorization using a specific rule for said policy if said policy is found.

25. One or more processor readable storage devices according to claim 24, wherein said processor readable code includes:

a user interface console;

an access tester; and

an authorization module.

26. One or more processor readable storage devices according to claim 24, wherein:

said access information is capable of including an identification of said resource, identification information for one or more entities, one or more request methods, an address of a device, date information and time information.

27. One or more processor readable storage devices according to claim 24, wherein:

said access information includes an identification of one or more entities;

said identification of one or more entities includes a user role; and

said step of testing includes determining whether a set of one or more entities satisfying said role can access said resource.

28. One or more processor readable storage devices according to claim 24, wherein:

said access information includes an identification of one or more entities;

said identification of one or more entities includes a rule; and

said step of testing includes determining whether a set of one or more entities satisfying said rule can access said resource.

29. One or more processor readable storage devices according to claim 24, wherein:

said access information includes timing information;

said timing information includes a time range; and

said step of testing includes determining whether a set of entities can access said resource within said time range.

30. One or more processor readable storage devices according to claim 24, wherein:

said access information includes an access request method; and

said step of testing includes determining whether an entity can access said resource using said access request method.

31. One or more processor readable storage devices according to claim 24, wherein:

said access information includes information for identifying a first user; and

said step of testing includes the steps of;

accessing an identity profile for said first user, and

comparing information in said identity profile to authorization criteria for said resource to determine whether said. first user is authorized to access said resource.

32. One or more processor readable storage devices according to claim 24, wherein:

said step of testing includes determining whether an authorization rule is satisfied;

said access information includes information for identifying a set of one or more entities;

said authorization rule includes rule criteria; and

said step of determining whether an authorization rule is satisfied includes evaluating whether said set of one or more entities meet said rule criteria.

33. One or more processor readable storage devices according to claim 24, wherein said step of testing includes the steps of:

searching for a specific authorization rule;

determining authorization using said specific rule if said specific rule is found; and

determining authorization using a default rule if said specific rule is not found.

34. One or more processor readable storage devices according to claim 24, wherein said step of testing includes the steps of:

identifying a policy domain;

searching for a policy;

determining authorization using a default rule for said policy domain if no policy is found; and

determining authorization using a specific rule for said policy if said policy is found.

36. An apparatus according to claim 35, wherein:

said access information is capable of including an identification of said resource, identification information for one or more entities, one or more request methods, an address of a device, date information and time information.

37. An apparatus according to claim 35, wherein:

said access information includes an identification of one or more entities;

said identification of one or more entities includes a user role; and

said step of testing includes determining whether a set of one or more entities satisfying said role can access said resource.

38. An apparatus according to claim 35, wherein:

said access information includes an identification of one or more entities;

said identification of one or more entities includes a rule; and

said step of testing includes determining whether a set of one or more entities satisfying said rule can access said resource.

39. An apparatus according to claim 35, wherein:

said access information includes timing information;

said timing information includes a time range; and

said step of testing includes determining whether a set of entities can access said resource within said time range.

40. An apparatus according to claim 35, wherein:

said access information includes an access request method; and

said step of testing includes determining whether an entity can access said resource using said access request method.

41. An apparatus according to claim 35, wherein:

said access information includes information for identifying a first user; and

said step of testing includes the steps of;

accessing an identity profile for said first user, and

comparing information in said identity profile to authorization criteria for said resource to determine whether said. first user is authorized to access said resource.

42. An apparatus according to claim 35, wherein said step of testing includes the steps of:

identifying a policy domain;

searching for a policy;

determining authorization using a default rule for said policy domain if no policy is found; and

determining authorization using a specific rule for said policy if said policy is found.

24. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method, comprising the steps of:

receiving access information; and

testing whether a resource is authorized for use based on said step of testing.

35. An apparatus, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to preform a method comprising the steps of;

receiving access information, and

testing whether a resource is authorized for use based on said step of testing.