Multi-level security profile refresh

• US 20040111413A1
• Filed: 12/04/2002
• Published: 06/10/2004
• Est. Priority Date: 12/04/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Yuan, Jack Chiu-Chiu, Ueno, Yoshinobu, Tollerud, Andrew D., Birbo, Getachew G., Sherrill, Sandra L., Zimmer, James E., Hsiao, Joyce Yuan-Sheng
• Granted Patent: US 7,136,856 B2
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99934 Query formulation, input preparation, or translation
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A request is received from a user associated with the client and a transaction aging value is copied to a security aging value associated with the cached user security profile if the transaction aging value is specified with the user request. A decay time is calculated utilizing a profile refresh time stamp associated with the cached user security profile and a system clock. The cached user security profile is then refreshed if a refresh event occurs.

Claims

1. A computer implemented method for performing a multi-level refresh of a cached user security profile associated with a client in a database management system comprising the steps of:

receiving a user request from a user associated with said client;

copying a transaction aging value to a security aging value associated with said cached user security profile if said transaction aging value is specified with said user request;

calculating a decay time utilizing a profile refresh time stamp associated with said cached user security profile and a system clock; and

refreshing said cached user security profile if a refresh event occurs.

2. The method of claim 1 wherein said refresh event occurs if said decay time exceeds said security aging value.

3. The method of claim 1 wherein said refresh event occurs if said security aging value prior to said copying step is larger than said transaction aging value.

4. The method of claim 1 wherein said refresh event occurs if said transaction value is specified with said user request.

5. The method of claim 1 further comprising the steps of:

receiving a client request from said client;

initializing a default aging value for said client;

creating said cached user security profile for said user wherein said cached user security profile comprises said security aging value, said profile refresh time stamp, a sub-dynamic aging value and a user security record; and

copying said default aging value to said security aging value.

6. The method of claim 5 wherein said refresh event occurs if a global command refresh encompasses said cached user security profile.

7. The method of claim 5 wherein creating said cached user security profile comprises:

allocating memory to contain said cached user security profile;

copying a master dynamic aging value to said sub-dynamic aging value;

copying said default aging value to said security aging value;

copying a system clock value to said profile refresh time stamp; and

copying a record from a security file to said user security record.

8. The method of claim 7 wherein said allocating comprises locating an available pre-allocated user security profile in memory.

9. The method of claim 5 wherein refreshing said cached user security profile comprises:

deleting existing information within said cached user security profile;

copying a master dynamic aging value to said sub-dynamic aging value;

copying a system clock value to said profile refresh time stamp; and

copying a record from a security file to said user security record.

10. The method of claim 1 wherein said database management system is IMS.

11. A method for performing a multi-level refresh of a cached user security profile associated with a client in a database management system comprising:

generating a transaction message wherein said transaction message comprises a transaction aging value and an indication that said transaction aging value is present; and

sending said transaction message to said database management system wherein said database management system comprises a multi-level security profile refresh routine and whereby said multi-level security profile refresh routine refreshes said cached user security profile if a refresh event occurs.

12. The method of claim 11 wherein said refresh event occurs if a calculated decay time for said cached user security profile exceeds a security aging value associated with said cached user security profile.

13. The method of claim 11 wherein said refresh event occurs if a global command refresh encompasses said cached user security profile.

14. A computer system for performing a multi-level refresh of a cached user security profile associated with a client in a database management system comprising:

a computer;

means for receiving a user request from a user associated with said client;

means for copying a transaction aging value to a security aging value associated with said cached user security profile if said transaction aging value is specified with said user request;

means for calculating a decay time utilizing a profile refresh time stamp associated with said cached user security profile and a system clock; and

means for refreshing said cached user security profile if a refresh event occurs.

15. The computer system of claim 14 wherein said refresh event occurs if said decay time exceeds said security aging value.

16. The computer system of claim 14 wherein said refresh event occurs if said security aging value prior to said copying step is larger than said transaction aging value.

17. The computer system of claim 14 wherein said refresh event occurs if said transaction value is specified with said user request.

18. The computer system of claim 14 further comprising:

means for receiving a client request from said client;

means for initializing a default aging value for said client;

means for creating said cached user security profile for said user wherein said cached user security profile comprises said security aging value, said profile refresh time stamp, a sub-dynamic aging value and a user security record; and

means for copying said default aging value to said security aging value.

19. The computer system of claim 18 wherein said refresh event occurs if a global command refresh encompasses said cached user security profile.

20. The computer system of claim 18 wherein said means for creating said cached user security profile comprises:

means for allocating memory to contain said cached user security profile;

means for copying a master dynamic aging value to said sub-dynamic aging value;

means for copying said default aging value to said security aging value;

means for copying a system clock value to said profile refresh time stamp; and

means for copying a record from a security file to said user security record.

21. The computer system of claim 20 wherein said means for allocating comprises locating an available pre-allocated user security profile in memory.

22. The computer system of claim 18 wherein means for refreshing said cached user security profile comprises:

means for deleting existing information within said cached user security profile;

means for copying a master dynamic aging value to said sub-dynamic aging value;

means for copying a system clock value to said profile refresh time stamp; and

means for copying a record from a security file to said user security record.

23. The computer system of claim 14 wherein said database management system is IMS.

24. An article of manufacture for use in a computer system tangibly embodying computer instructions executable by said computer system to perform process steps for performing a multi-level refresh of a cached user security profile associated with a client in a database management system, said process steps comprising:

receiving a user request from a user associated with said client;

copying a transaction aging value to a security aging value associated with said cached user security profile if said transaction aging value is specified with said user request;

calculating a decay time utilizing a profile refresh time stamp associated with said cached user security profile and a system clock; and

refreshing said cached user security profile if a refresh event occurs.

25. The article of manufacture of claim 24 wherein said refresh event occurs if said decay time exceeds said security aging value.

26. The article of manufacture of claim 24 wherein said refresh event occurs if said security aging value prior to said copying step is larger than said transaction aging value.

27. The article of manufacture of claim 24 wherein said refresh event occurs if said transaction value is specified with said user request.

28. The article of manufacture of claim 24 further comprising the steps of:

receiving a client request from said client;

initializing a default aging value for said client;

creating said cached user security profile for said user wherein said cached user security profile comprises said security aging value, said profile refresh time stamp, a sub-dynamic aging value and a user security record; and

copying said default aging value to said security aging value.

29. The article of manufacture of claim 28 wherein said refresh event occurs if a global command refresh encompasses said cached user security profile.

30. The article of manufacture of claim 28 wherein creating said cached user security profile comprises:

allocating memory to contain said cached user security profile;

copying a master dynamic aging value to said sub-dynamic aging value;

copying said default aging value to said security aging value;

copying a system clock value to said profile refresh time stamp; and

copying a record from a security file to said user security record.

31. The article of manufacture of claim 30 wherein said allocating comprises locating an available pre-allocated user security profile in memory.

32. The article of manufacture of claim 28 wherein refreshing said cached user security profile comprises:

deleting existing information within said cached user security profile;

copying a master dynamic aging value to said sub-dynamic aging value;

copying a system clock value to said profile refresh time stamp; and

copying a record from a security file to said user security record.

33. The article of manufacture of claim 24 wherein said database management system is IMS.