Method for controlling access to the resources of a data processing system, data processing system, and computer program

• US 20030078932A1
• Filed: 09/26/2002
• Published: 04/24/2003
• Est. Priority Date: 09/26/2001
• Status: Active Grant

• Current Assignee: Siemens It Solutions and Services GmbH (Atos SE)
• Original Assignee: Siemens AG
• Inventors: Kopper, Harald, Kaiserwerth, Rudolf, Weidinger, Rupert, Woehrl, Rudolf, Wildgruber, Rudolf, Wagner, Hermann Josef
• Granted Patent: US 7,730,093 B2
• Time in Patent Office: Days
• US Class Current: 707/100
• CPC Class Codes: G06F 16/25 Integrating or interfacing systems involving database management systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

In a data processing system with at least one data processing device, a large number of databases allocated to the data processing system and having user-specific data are linked together for forming a single resulting user database. Access permissions for resources provided by the at least one data processing device are awarded by predefined user roles. At least one user role is allocated to at least one user of the data processing system.

Claims

1. Method for the control of access to resources of a data processing system with at least one data processing device, wherein

a large number of databases having user-specific data and being allocated to the data processing system are linked together to form a single resulting user database,

access permissions for resources provided by the at least one data processing device are awarded by predefined user roles,

at least one user role is allocated to at least one user of the data processing system.

2. Method according to claim 1, wherein responsibility regions of users in business processes are determined by the predefined user roles.

3. Method according to claim 1, wherein the user-specific data include the at least one user role allocated to the at least one user.

4. Method according to claim 1, wherein the predefined user roles are made available for allocation by a role catalog.

5. Method according to claim 1, wherein the at least one user role allocated to the at least one user is resolved by an interface device allocated to one of the data processing devices into application-specific access permissions for a program application provided by the data processing device.

6. Method according to claim 1, wherein the at least one user role allocated to the at least one user is resolved by an interface device allocated to the data processing device into operating system specific access permissions for memory regions of a memory medium of the data processing device.

7. Method according to claim 5, wherein, with a change of role-defined user-specific data in the user database, a message comprising the changed role-defined user-specific data is sent to the interface device and due to this an inspection is made for a change of application-specific and/or operating system specific access permissions.

8. Data processing system with

at least one data processing device,

a large number of databases, in which user-specific data are stored, and which are linked together for forming a single resulting user database,

at least one means for awarding, by predefined user roles, access permissions for resources provided by the at least one data processing device,

at least one means for allocation of at least one user role to at least one user of the data processing system.

9. Computer program which can be loaded into a working memory of a data processing device and has at least one software code section, in the execution of which:

a large number of databases allocated to a data processing system and having user-specific data are linked together for forming a single resulting user database,

access permissions for resources provided by at least one data processing device are awarded by predefined user roles,

at least one user role is allocated to at least one user of the data processing system,

when the computer program runs on the data processing device.