Authorization model for administration

• US 20030041198A1
• Filed: 08/23/2001
• Published: 02/27/2003
• Est. Priority Date: 08/23/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Powell, Michael, Exton, Scott Anthony, Turner, Brian James
• Granted Patent: US 6,910,041 B2
• Time in Patent Office: Days
• US Class Current: 710/200
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure

Abstract

An administration model is provided that uses access control lists to define permissions for users and groups of users. The model identifies a number of objects to be administered. Associated with each of these objects is a set of administrative operations that can be performed on the object. For each of these operations a permission in an access control list entry is defined. The protected resources are arranged in a hierarchical fashion and an access control list can be associated with any point in the hierarchy. The access control list provides fine-grained control over the protected resources. At the time an administrator requests to perform an operation, the administrator'"'"'s identification is used to look up the prevailing access control list to determine whether the operation is permitted.

Claims

1. A method for administering managed resources, comprising:

defining a set of privileges for a managed resource; and

attaching an access control list to an object that represents the managed resource, wherein the access control list assigns at least one privilege from the set of privileges to an entity.

2. The method of claim 1, wherein the entity is an individual user.

3. The method of claim 1, wherein the entity is a group of users.

4. The method of claim 1, wherein the managed resource is one of a plurality of managed resources arranged in a hierarchy.

5. The method of claim 1, wherein the set of privileges comprises a set of operations that may be performed for the managed resource.

6. A method for administering a plurality of managed resources including at least one first level resource and at least one second level resource, wherein each of the at least one second level resource is a subresource of a first level resource, comprising:

defining a first set of permissions for the at least one first level resource; and

attaching a first access control list to a first object that represents a first managed resource,

wherein the first managed resource is a first level resource and the first access control list controls access to the first managed resource and at least one subresource of the first managed resource based on the first set of permissions.

7. The method of claim 6, wherein the first entity is an individual user.

8. The method of claim 6, wherein the first entity is a group of users.

9. The method of claim 6, wherein the set of privileges comprises a set of operations that may be performed for the at least one first level resource.

10. The method of claim 6, further comprising:

defining a second set of permissions for a second managed resource; and

attaching a second access control list to a second object that represents the second managed resource, wherein the second access control list controls access to the second managed resource and at least one subresource of the second managed resource based on the second set of permissions.

11. A method for administering managed resources, comprising:

receiving a request from a user to perform an operation on a managed resource;

finding an access control list corresponding to the managed resource; and

determining whether the operation is permitted for the user based on the access control list.

12. The method of claim 11, wherein the managed resource is one of a plurality of managed resources arranged in a hierarchy and wherein the step of finding an access control list comprises searching the hierarchy for an access control list which is attached closest to the managed resource.

13. The method of claim 11, wherein the step of finding an access control list comprises finding a first access control list that assigns a first permission for the user and a second access control list that assigns a second permission for the user.

14. The method of claim 13, wherein the step of determining whether the operation is permitted for the user comprises selecting the access control list, from the first access control list and the second access control list, with a permission that more specifically matches the user.

15. The method of claim 13, wherein the first permission identifies a first set of operations permitted for the user and the second permission identifies a second set of operations permitted for the user, and

wherein the step of determining whether the operation is permitted for the user comprises performing an OR operation on the first set of operations and the second set of operations.

16. The method of claim 11, wherein the method is performed by an authorization server.

17. An apparatus for administering managed resources, comprising:

definition means for defining a set of privileges for a managed resource; and

attachment means for attaching an access control list to an object that represents the managed resource, wherein the access control list assigns at least one privilege from the set of privileges to an entity.

18. The apparatus of claim 17, wherein the entity is an individual user.

19. The apparatus of claim 17, wherein the entity is a group of users.

20. The apparatus of claim 17, wherein the managed resource is one of a plurality of managed resources arranged in a hierarchy.

21. The apparatus of claim 17, wherein the set of privileges comprises a set of operations that may be performed for the managed resource.

22. An apparatus for administering a plurality of managed resources including at least one first level resource and at least one second level resource, wherein each of the at least one second level resource is a subresource of a first level resource, comprising:

definition means for defining a first set of permissions for the at least one first level resource; and

attachment means for attaching a first access control list to a first object that represents a first managed resource,

wherein the first managed resource is a first level resource and the first access control list controls access to the first managed resource and at least one subresource of the first managed resource based on the first set of permissions.

23. The apparatus of claim 22, wherein the first entity is an individual user.

24. The apparatus of claim 22, wherein the first entity is a group of users.

25. The apparatus of claim 22, wherein the set of privileges comprises a set of operations that may be performed for the at least one first level resource.

26. The apparatus of claim 22, further comprising:

means for defining a second set of permissions for a second managed resource; and

means for attaching a second access control list to a second object that represents the second managed resource, wherein the second access control list controls access to the second managed resource and at least one subresource of the second managed resource based on the second set of permissions.

27. An apparatus for administering managed resources, comprising:

receipt means for receiving a request from a user to perform an operation on a managed resource;

search means for finding an access control list corresponding to the managed resource; and

determination means for determining whether the operation is permitted for the user based on the access control list.

28. The apparatus of claim 27, wherein the managed resource is one of a plurality of managed resources arranged in a hierarchy and wherein the search means comprises means for searching the hierarchy for an access control list which is attached closest to the managed resource.

29. The apparatus of claim 27, wherein the search means comprises means for finding a first access control list that assigns a first permission for the user and a second access control list that assigns a second permission for the user.

30. The apparatus of claim 29, wherein the determination means comprises means for selecting the access control list, from the first access control list and the second access control list, with a permission that more specifically matches the user.

31. The apparatus of claim 29, wherein the first permission identifies a first set of operations permitted for the user and the second permission identifies a second set of operations permitted for the user, and

wherein the determination means comprises means for performing an OR operation on the first set of operations and the second set of operations.

32. The apparatus of claim 27, wherein the apparatus comprises an authorization server.

33. A computer program product, in a computer readable medium, for administering managed resources, comprising:

instructions for defining a set of privileges for a managed resource; and

instructions for attaching an access control list to an object that represents the managed resource, wherein the access control list assigns at least one privilege from the set of privileges to an entity.

34. A computer program product, in a computer readable medium, for administering a plurality of managed resources including at least one first level resource and at least one second level resource, wherein each of the at least one second level resource is a subresource of a first level resource, comprising:

instructions for defining a first set of permissions for the at least one first level resource; and

instructions for attaching a first access control list to a first object that represents a first managed resource,

wherein the first managed resource is a first level resource and the first access control list controls access to the first managed resource and at least one subresource of the first managed resource based on the first set of permissions.

35. A computer program product, in a computer readable medium, for administering managed resources, comprising:

instructions for receiving a request from a user to perform an operation on a managed resource;

instructions for finding an access control list corresponding to the managed resource; and

instructions for determining whether the operation is permitted for the user based on the access control list.