Method of administering user access to application programs on a computer system

• US 20030163510A1
• Filed: 02/28/2002
• Published: 08/28/2003
• Est. Priority Date: 02/28/2002
• Status: Abandoned Application

• Current Assignee: Real Enterprise Solutions Development B.V. (Ivanti Software, Inc.)
• Original Assignee: Real Enterprise Solutions Development B.V. (Ivanti Software, Inc.)
• Inventors: Janssen, Bob
• Application Number:
  US10/086,818
• Publication Number:
  US 20030163510A1
• Time in Patent Office: Days
• US Class Current: 718/100
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A method of administering user access to application programs on a computer system comprises providing a user database, a database of tasks and a user-specific list of allowed tasks, comprising allowed application programs, configuring the list of allowed tasks on the basis of the user database and the database of tasks, detecting a command to execute a task, and preventing execution of tasks that are not on the list of allowed tasks.

Claims

1. A method of administering user access to application programs on a computer system, comprising providing a user database, a database of tasks and a user-specific list of allowed tasks, comprising allowed application programs, configuring the list of allowed tasks on the basis of the user database and the database of tasks, detecting a command to execute a task, and preventing execution of tasks that are not on the list of allowed tasks.

2. A method according to claim 1, wherein the list of allowed tasks is configured at least once every time a user has entered a request to log on to the computer system.

3. A method according to claim 2, wherein the database of tasks comprises information specifying time intervals in which a task may be executed, comprising configuring the list of allowed tasks on the basis of this information and the time indicated by a system clock.

4. A method according to claim 1, wherein the database of tasks comprises information linking tasks to other tasks that can invoke the tasks during execution of an application program.

5. A method according to claim 1, wherein, in a simulation mode, at least one task that is not on the list of allowed tasks is allowed to execute, and tasks started during execution are registered.

6. A method according to claim 2, wherein the computer system is a distributed computer system comprising a plurality of computer terminals connected to a network, and wherein the database of tasks comprises location-dependent information, the method comprising registering the terminal on which the user has entered the request and configuring the list of allowed tasks on the basis of the location-dependent information and the registered terminal.

7. A method according to claim 1, wherein a plurality of user groups are defined, a group membership list is provided with the user database for each user, links are provided between the tasks in the database of tasks and the groups, and the links and the group membership list are used to configure the list of allowed tasks.

8. Method according to claim 7, wherein a plurality of user functions are defined, a user function list is provided with the user database for each user, links are provided between the tasks in the database of tasks and the user functions, and the links and the user function list are used to configure the list of allowed tasks.

9. A method according to claim 1, wherein prevention of the execution of an application program or task is registered, and wherein a notification of the prevention is sent to a system administrator.

10. A method according to claim 1, wherein one or more tasks of which the execution should never be prevented are defined in the database of tasks, and wherein execution of such a task is also not prevented if it is not on the list of allowed tasks.

11. Method according to claim 5, wherein one or more tasks of which the execution should always be prevented are defined in the database of tasks, and wherein execution of such a task is prevented in the simulation mode.

12. A computer system comprising means for generating a user-specific list of allowed tasks, comprising allowed application programs, means for detecting a command to execute a task, means for preventing execution of tasks that are not on the list of allowed tasks, a user database and a database of tasks, and means for configuring the list of allowed tasks on the basis of the user database and the database of tasks.

13. A computer system according to claim 12, programmed to configure the list of allowed tasks at least once every time a user has entered a request to log on to the computer system.

14. A computer system according to claim 12, wherein the database of tasks comprises information linking tasks to other tasks that can invoke the tasks during execution of an application program.

15. A computer system according to claim 12, capable of being run in a simulation mode in which mode the computer system is programmed to allow at least one task that is not on the list of allowed task to execute and to register tasks started during execution.

16. A computer system according to claim 12, comprising means for defining a plurality of user groups, and a group membership list, stored with the user database, for each user, wherein information linking tasks to the groups is comprised in the database of tasks for each task, the computer system being programmed to use the links and the group membership list to configure the list of allowed tasks.

17. A computer program comprising one or more routines for generating a user-specific list of allowed tasks, comprising allowed application programs, one or more routines for reading a user database and a database of tasks, and one or more routines for configuring the list of allowed tasks on the basis of the user database and the database of tasks, one or more routines for detecting a command to execute a task, and one or more routines for preventing execution of tasks that are not on the list of allowed tasks.

18. A computer program according to claim 17, which, when run, configures the list of allowed tasks at least once every time a user has entered a request to log on to the computer system.

19. A computer program according to claim 17, capable of being run in a simulation mode in which mode at least one task that is not on the list of allowed tasks is allowed to execute and tasks started during execution are registered.

20. A computer program according to claim 17, comprising one or more routines for defining a plurality of user groups, one or more routines for reading a group membership list, stored with the user database, for each user, and one or more routines for retrieving information linking tasks to the groups, comprised in the database of tasks for each task, which program, when run, is capable of using the links and the group membership list to configure the list of allowed tasks.