Method and system for generating user group identifiers

• US 20060090208A1
• Filed: 10/21/2004
• Published: 04/27/2006
• Est. Priority Date: 10/21/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Smith, Michael R.
• Granted Patent: US 7,669,244 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A method and apparatus for generating user group identifiers using a permissions matrix is disclosed. The permissions matrix includes an entry that is associated with a row and a column of the permissions matrix. The row of the permissions matrix is indexed with a first role and the column of the permissions matrix is indexed with a second role. A data structure implementing such a method can include, for example, a user group identifier matrix. Alternatively, a method is disclosed in which the expiration of a user group identifier is detected. In such a case, the user group identifier is updated by accessing a user group identifier matrix.

Claims

1. A method comprising:

generating a permissions matrix, wherein

the permissions matrix comprises an entry,

the entry is associated with a row and a column of the permissions matrix,

the row of the permissions matrix is indexed using a first role, and

the column of the permissions matrix is indexed using a second role.

2. The method of claim 1, further comprising:

indexing the row of the permissions matrix with the first role, and

indexing the column of the permissions matrix with the second role.

3. The method of claim 2, further comprising:

creating a permissions list, wherein

the permissions list is accessible through an entry in the permissions matrix, and

the permissions list designates an access control relationship between the first role and the second role.

4. The method of claim 3, wherein

the permissions list is an access control list.

5. The method of claim 4, wherein

the access control relationship comprises at least one of:

an intra-role relationship; and

an inter-role relationship.

6. The method of claim 5, wherein

the entry in the permissions matrix comprises at least one of:

a reference to the permissions list; and

the permissions list.

7. The method of claim 6, wherein

the first role and the second role are the same.

8. The method of claim 3, wherein

the access control relationship consists of a relationship between the first role and the second role.

9. The method of claim 8, further comprising:

defining a role set, wherein

the role set comprises the first role and the second role.

10. The method of claim 3, wherein the creating the permissions list further comprises:

assigning a first user group identifier to a first role subset;

assigning a second user group identifier to a second role subset; and

creating the permissions list such that the permissions list sets forth the access control relationship between the first user group identifier and the second user group identifier.

11. The method of claim 10, further comprising:

creating the first role subset, wherein the first role subset comprises the first role; and

creating the second role subset, wherein the second role subset comprises the second role.

12. The method of claim 10, wherein the forming the permissions list further comprises:

taking a Cartesian product of the first user group identifier and the second user group identifier.

13. The method of claim 12, wherein the taking the Cartesian product of the first user group identifier and the second user group identifier further comprises:

replacing the first user group identifier with the first role subset;

replacing the second user group identifier with the second role subset; and

taking the Cartesian product of the first role subset and the second role subset to obtain a set of ordered pairs.

14. The method of claim 13, further comprising:

obtaining a first role permissions list by using a first ordered pair from the set of ordered pairs to reference the first role permissions list;

obtaining a second role permissions list by using a second ordered pair from the set of ordered pairs to reference the second role permissions list; and

merging the first role permissions list and the second role permissions list to form a user group permissions list.

15. The method of claim 14, wherein

the merging the first role permissions list and the second role permissions list is performed in a least restrictive manner.

16. The method of claim 13, further comprising:

minimizing the set of ordered pairs.

17. The method of claim 10, wherein

the row of the permissions matrix is indexed with the first user group identifier, and

the column of the permissions matrix is indexed with the second user group identifier.

18. The method of claim 2, further comprising:

downloading a set of permissions matrix entries associated with a user group identifier of a source.

19. The method of claim 18, further comprising:

updating the set of permissions matrix entries, wherein

the updating is performed responsive to at least one of;

a time stamp; and

a generation number.

20. A computer program product comprising:

a first set of instructions, executable on a computer system, configured to create a permissions matrix, wherein;

the permissions matrix comprises an entry,

the entry is associated with a row and a column of the permissions matrix,

the row of the permissions matrix is indexed using a first role, and

the column of the permissions matrix is indexed using a second role; and

computer readable media, wherein the computer program product is encoded in the computer readable media.

21. The computer program product of claim 20, further comprising:

a second set of instructions, executable on the computer system, configured to

index the row of the permissions matrix with the first role, and

index the column of the permissions matrix with the second role.

22. The computer program product of claim 21, further comprising:

a third set of instructions, executable on the computer system, configured to create a permissions list, wherein

the permissions list is accessible through the entry in the permissions matrix, and

the permissions list designates an access control relationship between the first role and the second role.

23. The computer program product of claim 22, wherein

the permissions list is an access control list.

24. The computer program product of claim 23, wherein

the access control relationship comprises at least one of:

an intra-role relationship; and

an inter-role relationship.

25. The computer program product of claim 24, wherein

the entry in the permissions matrix comprises at least one of:

a reference to the permissions list; and

the permissions list.

26. The computer program product of claim 25, wherein

the first role and the second role are the same.

27. The computer program product of claim 22, wherein

the access control relationship consists of a relationship between the first role and the second role.

28. The computer program product of claim 27, further comprising:

a fourth set of instructions, executable on the computer system, configured to define a role set, wherein

the role set comprises the first role and the second role.

29. The computer program product of claim 22, wherein the third set of instructions comprises:

a first subset of instructions, executable on the computer system, configured to

assign a first user group identifier to a first role subset,

assign a second user group identifier to a second role subset, and

create the permissions list such that the permissions list sets forth the access control relationship between the first user group identifier and the second user group identifier.

30. The computer program product of claim 29, further comprising:

a fifth set of instructions, executable on the computer system, configured to

create the first role subset, wherein

the first role subset comprises the first role, and

create the second role subset, wherein

the second role subset comprises the second role.

31. The computer program product of claim 29, wherein the third set of instructions further comprises:

a second subset of instructions, executable on the computer system, configured to

take a Cartesian product of the first user group identifier and the second user group identifier.

32. The computer program product of claim 31, wherein the second subset of instructions comprises:

a third subset of instructions, executable on the computer system, configured to

replace the first user group identifier with the first role subset,

replace the second user group identifier with the second role subset, and

take the Cartesian product of the first role subset and the second role subset to obtain a set of ordered pairs.

33. The computer program product of claim 32, further comprising:

a fifth set of instructions, executable on the computer system, configured to

obtain a first role permissions list by using a first ordered pair from the set of ordered pairs to reference the first role permissions list,

obtain a second role permissions list by using a second ordered pair from the set of ordered pairs to reference the second role permissions list, and

merge the first role permissions list and the second role permissions list to form a user group permissions list.

34. The computer program product of claim 33, wherein the fifth set of instructions comprises:

a fourth subset of instructions, executable on the computer system, configured to merge the first role permissions list and the second role permissions list in a least restrictive manner.

35. The computer program product of claim 32, further comprising:

a sixth set of instructions, executable on the computer system, configured to minimize the set of ordered pairs.

36. The computer program product of claim 29, wherein

the row of the permission matrix is indexed with the first user group identifier, and

the column of the permissions matrix is indexed with the second user group identifier.

37. The computer program product of claim 21, further comprising:

a third set of instructions, executable on the computer system, configured to download a set of permissions matrix entries associated with a user group identifier of a source.

38. The computer program product of claim 37, further comprising:

a fourth set of instructions, executable on the computer system, configured to update the set of permissions matrix entries, wherein

the updating is performed responsive to at least one of;

a time stamp; and

a generation number.

39. An apparatus comprising:

means for generating an entry of a permissions matrix; and

means for generating the permissions matrix, wherein

the permissions matrix comprises the entry,

the entry is associated with a row and a column of the permissions matrix,

the row of the permissions matrix is indexed using a first role, and

the column of the permissions matrix is indexed using a second role.

40. The apparatus of claim 39, further comprising:

means for indexing the row of the permissions matrix with the first role, and

means for indexing the column of the permissions matrix with the second role.

41. The apparatus of claim 40, further comprising:

means for creating a permissions list, wherein

the permissions list is accessible through the entry in the permissions matrix, and

the permissions list designates an access control relationship between the first role and the second role.

42. The apparatus of claim 41, wherein

the permissions list is an access control list.

43. The apparatus of claim 42, wherein

the access control relationship comprises at least one of:

an intra-role relationship; and

an inter-role relationship.

44. The apparatus of claim 43, wherein

the entry in the permissions matrix comprises at least one of:

a reference to the permissions list; and

the permissions list.

45. The apparatus of claim 44, wherein

the first role and the second role are the same.

46. The apparatus of claim 41, wherein

the access control relationship consists of a relationship between the first role and the second role.

47. The apparatus of claim 46, further comprising:

means for defining a role set, wherein

the role set comprises the first role and the second role.

48. The apparatus of claim 41, wherein the means for creating the permissions list further comprises:

means for assigning a first user group identifier to a first role subset;

means for assigning a second user group identifier to a second role subset; and

means for creating the permissions list such that the permissions list sets forth an access control relationship between the first user group identifier and the second user group identifier.

49. The apparatus of claim 48, further comprising:

means for creating the first role subset, wherein the first role subset comprises the first role; and

means for creating the second role subset, wherein the second role subset comprises the second role.

50. The apparatus of claim 48, wherein the means for creating the permissions list further comprises:

means for taking a Cartesian product of the first user group identifier and the second user group identifier.

51. The apparatus of claim 50, wherein the taking the Cartesian product of the first user group identifier and the second user group identifier further comprises:

replacing the first user group identifier with the first role subset;

replacing the second user group identifier with the second role subset; and

taking the Cartesian product of the first role subset and the second role subset to obtain a set of ordered pairs.

52. The apparatus of claim 51, further comprising:

means for obtaining a first role permissions list by using a first ordered pair from the set of ordered pairs to reference the first role permissions list;

means for obtaining a second role permissions list by using a second ordered pair from the set of ordered pairs to reference the second role permissions list; and

means for merging the first role permissions list and the second role permissions list to form a user group permissions list.

53. The apparatus of claim 52, wherein

the merging the first role permissions list and the second role permissions list is performed in a least restrictive manner.

54. The apparatus of claim 51, further comprising:

means for minimizing the set of ordered pairs.

55. The apparatus of claim 48, wherein

the row of the permission matrix is indexed with the first user group identifier, and

the column of the permissions matrix is indexed with the second user group identifier.

56. The apparatus of claim 40, further comprising:

means for downloading a set of permissions matrix entries associated with a user group identifier of a source.

57. The apparatus of claim 56, further comprising:

means for updating the set of permissions matrix entries, wherein

the updating is performed responsive to at least one of;

a time stamp; and

a generation number.

58. A method comprising:

forming a role permissions matrix, wherein

a role permissions list is configured to be accessed through a role entry in the role permissions matrix,

the role permissions list describes a role access control relationship between a first role and a second role,

a row of the role permissions matrix is indexed using the first role, and

a column of the role permissions matrix is indexed using the second role.

59. The method of claim 58, further comprising:

forming the role permissions list.

60. The method of claim 58, further comprising:

assigning a first role subset to a first user, wherein the first role subset comprises the first role; and

assigning a second role subset to a second user, wherein the second role subset comprises the second role.

61. The method of claim 60, further comprising:

assigning a first user group identifier to the first role subset;

assigning a second user group identifier to the second role subset; and

defining a user group permissions list such that the user group permissions list sets forth a user group access control relationship between the first user group identifier and the second user group identifier.

62. The method of claim 61, further comprising:

forming a user group identifier matrix, wherein the user group permissions list is accessible through a user group entry in the user group identifier matrix.

63. The method of claim 61, wherein

the first user group identifier is a security group tag.

64. The method of claim 60, wherein

the first role subset comprises a different subset of roles than the second role subset.

65. A method comprising:

detecting an expiration of a user group identifier; and

updating the user group identifier by accessing a user group identifier matrix.

66. The method of claim 65, wherein

the updating the user group identifier is performed responsive to at least one of:

a time stamp; and

a generation number.

67. The method of claim 65, wherein

the updating the user group identifier further comprises downloading a column of the user group identifier matrix.

68. The method of claim 67, wherein

the downloading a column of the user group identifier matrix further comprises

downloading a time stamp associated with the user group identifier and

downloading a generation number associated with the user group identifier.

69. The method of claim 65, wherein

the detecting an expiration of the user group identifier is performed during an authentication of a host.

70. A data structure, in a computer readable medium, comprising:

a user group identifier permissions matrix, wherein

the user group identifier permissions matrix comprises an entry,

the entry is associated with a row and a column of the user group identifier permissions matrix,

the row of the user group identifier permissions matrix is indexed using a first user group identifier, and

the column of the user group identifier permissions matrix is indexed using a second user group identifier.

71. The data structure of claim 70, further comprising:

a permissions list, wherein

the permissions list is accessible through the entry in the user group identifier permissions matrix, and

the permissions list designates an access control relationship between the first user group identifier and the second user group identifier.

72. The data structure of claim 71, wherein

the permissions list is an access control list.

73. The data structure of claim 72, wherein

the access control relationship comprises at least one of:

an intra-role relationship; and

an inter-role relationship.

74. The data structure of claim 73, wherein

the entry in the user group identifier permissions matrix comprises at least one of:

a reference to the permissions list; and

the permissions list.

75. An apparatus comprising:

a user group identifier permissions matrix, wherein

the user group identifier permissions matrix comprises an entry,

the entry is associated with a row and a column of the user group identifier permissions matrix,

the row of the user group identifier permissions matrix is indexed using a first user group identifier, and

the column of the user group identifier permissions matrix is indexed using a second user group identifier.

76. The apparatus of claim 75, further comprising:

a permissions list, wherein

the permissions list is accessible through the entry in the user group identifier permissions matrix, and

the permissions list designates an access control relationship between the first user group identifier and the second user group identifier.

77. The apparatus of claim 76, wherein

the permissions list is an access control list.

78. The apparatus of claim 77, wherein

the access control relationship comprises at least one of:

an intra-role relationship; and

an inter-role relationship.

79. The apparatus of claim 78, wherein

the entry in the user group identifier permissions matrix comprises at least one of:

a reference to the permissions list; and

the permissions list.