Apparatus, system, and method for sharing a cached security profile in a database environment

• US 20050114604A1
• Filed: 11/20/2003
• Published: 05/26/2005
• Est. Priority Date: 11/20/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stewart, Kevin R., Ueno, Yoshinobu, Yuan, Jack C., Artobello, Michael R.
• Granted Patent: US 7,296,151 B2
• Time in Patent Office: Days
• US Class Current: 711/130
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2151 Time stamp

Abstract

An apparatus, system, and method are provided for sharing a cached security profile in a database environment. The apparatus, system, and method include a cache module for caching a security profile accessible to primary tasks and secondary tasks. An identification module is provided that distinguishes between primary tasks authorized to refresh the security profile and secondary tasks. A refresh module cooperates with the cache module and identification module to selectively refresh the security profile in response to a refresh request and expiration of the security profile such that an old version of the security profile is retained for use by secondary tasks until an execution window closes.

Claims

1. An apparatus for sharing a cached security profile in a database environment, comprising:

a cache module configured to cache a security profile accessible to primary tasks and secondary tasks;

an identification module configured to distinguish between primary tasks authorized to refresh the security profile and secondary tasks; and

a refresh module configured to selectively refresh the security profile in response to a refresh request and expiration of the security profile such that an old version of the security profile is retained for use by secondary tasks until an execution window closes.

2. The apparatus of claim 1, further comprising a deletion module configured to defer deletion of the old version of the security profile until the execution window closes and a subsequent primary task requests access to the cached security profile.

3. The apparatus of claim 1, further comprising a loader configured to load a new version of the security profile.

4. The apparatus of claim 1, further comprising a command module U configured to associate an indicator of the refresh request with the cached security profile.

5. The apparatus of claim 1, wherein the execution window comprises a period of time between when the cached security profile is created and a predefined threshold.

6. The apparatus of claim 1, wherein the security profile comprises an aging value and wherein expiration of the security profile comprises an age of the cached security profile meeting or exceeding the aging value.

7. The apparatus of claim 6, wherein the age of the cached security profile comprises the difference between a creation timestamp associated with the cached security profile and a current timestamp.

8. The apparatus of claim 1, wherein the refresh request comprises a passive notification to the refresh module to refresh the cached security profile.

9. The apparatus of claim 1, further comprising a controller configured to direct primary tasks requesting a security profile subsequent to refreshing the security profile to a new version of the security profile and currently executing secondary tasks to use the old version of the security profile until the predefined execution window closes.

10. The apparatus of claim 9, wherein the controller is configured to require a primary task and a secondary task to use a non-cached security profile in response to a refresh request.

11. A system for sharing a cached security profile, comprising:

a client module configured to communicate a transaction request to a server over a network, the requested transaction configured to perform an authorization check to authenticate a user;

an initial module configured to receive and execute the transaction request and authenticate the user using a cached security profile; and

a cache manager configured to provide the security profile associated with the user to the interface module and selectively refresh the security profile in response to a refresh request and expiration of the security profile such that deletion of an old version of the security profile is deferred until an execution window closes.

12. The system of claim 11, wherein the transaction initiates a secondary module configured to perform an authorization check to authenticate the user by reading the cached security profile.

13. The system of claim 12, wherein the secondary module uses the old version of the security profile in response to the cache manager refreshing an expired security profile within the execution window.

14. The system of claim 11, further comprising a command module configured to communicate a refresh request to the cache manager.

15. The system of claim 11, wherein the execution window comprises a period of time between when the cached security profile is created and a predefined threshold.

16. The system of claim 11, wherein the security profile comprises an aging value and wherein expiration of the security profile comprises an age of the cached security profile meeting or exceeding the aging value.

17. The system of claim 16, wherein the age of the cached security profile comprises the difference between a creation timestamp associated with the cached security profile and a current timestamp.

18. The system of claim 11, wherein the refresh request comprises a passive notification to the cache manager to refresh the cached security profile.

19. The system of claim 11, wherein the cache manager is configured to provide a non-cached security profile to the initial module in response to a refresh request.

20. The system of claim 11, wherein the server comprises an Information Management System (IMS) database environment.

21. An article of manufacture comprising a program storage medium readable by a processor and embodying one or more instructions executable by a processor to perform a method for sharing a cached security profile in a database environment, the method comprising:

caching a security profile accessible by predefined primary tasks and predefined secondary tasks;

authorizing primary tasks to refresh the security profile; and

selectively refreshing the security profile in response to a refresh request and expiration of the security profile such that an old version of the security profile is retained for use by secondary tasks until an execution window closes.

22. The article of manufacture of claim 21, wherein refreshing the security profile further comprises deferring deletion of the old version of the security profile until the execution window closes and a subsequent primary task requests access to the cached security profile.

23. The article of manufacture of claim 21, wherein refreshing the security profile further comprises loading a new version of the security profile.

24. The article of manufacture of claim 21, wherein the execution window comprises a period of time between when the cached security profile is created and a predefined threshold.

25. The article of manufacture of claim 21, wherein the security profile comprises an aging value and wherein expiration of the security profile comprises an age of the cached security profile meeting or exceeding the aging value.

26. The article of manufacture of claim 25, wherein the age of the cached security profile comprises the difference between a creation timestamp associated with the cached security profile and a current timestamp.

27. The article of manufacture of claim 21, further comprising preventing secondary tasks from refreshing the security profile.

28. The article of manufacture of claim 21, wherein the refresh request comprises a command issued by a database administrator.

29. The article of manufacture of claim 21, wherein the refresh request comprises a passive notification to primary tasks and secondary tasks to stop using the cached security profile.

30. The article of manufacture of claim 21, further comprising directing subsequent primary tasks to use a new version of the security profile and currently executing secondary tasks to use the old version of the security profile until the predefined execution window closes.