Organizational role-based controlled access management system

• US 20060218394A1
• Filed: 03/28/2005
• Published: 09/28/2006
• Est. Priority Date: 03/28/2005
• Status: Abandoned Application

• Current Assignee: Galaxy Software Services Corp.
• Original Assignee: Galaxy Software Services Corp.
• Inventors: Yang, Dung Cheng
• Application Number:
  US11/091,041
• Publication Number:
  US 20060218394A1
• Time in Patent Office: Days
• US Class Current: 713/167
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G16H 40/20 for the management or administration of healthcare resources or facilities, e.g. managing hospital staff or surgery rooms

Abstract

An Organizational Role-based Access Controlled Management System capable of controlling role-based access within an organization allows system analysts or managers to build and control access roles for the various application systems within an organization. This system can also allow an end-user to choose the functions of the application systems and logon rights associated with the role. The system includes one or more personal computers and a server based on an event-driven mechanism. System analysts and end-users access synchronized data to manage the end-users'"'"' access roles. This system allows a system analyst to build and limit “set and set” relationships, as well as “member and set” relationships to pass information and manage organizational networks, roles, functions, privileges, etc. Different roles under various application systems can have different access rights and functions assigned. This system breaks away from the limitation of the conventional RBAC (Role Based Access Control) and allows system analysts to manage and adapt access roles according to the practical needs of different users and their complicated relationships to the organization and one another.

Claims

1. An organizational role-based controlled access management method, comprising:

a. creating a logon dialog field for end-users to input logon names and passwords in order to enter the system;

b. determining whether the end-user'"'"'s department and appropriate end-user'"'"'s access role and privileges (functions permission) have been established;

c. determining whether the end-user is a department manager or designated system analyst who may select to set up departments and/or roles, and if so;

(a) opening a manager'"'"'s dialog field to display department(s) under the user'"'"'s current management, and to display department(s) and associated rights tree(s);

(b) entering a role set up dialog field to display the roles and privileges available for the manager to distribute, and allow the manager to set up end-users'"'"' roles, and delimit the roles and rights the end-user can manage;

(c) entering a role assignment field to assign departments, roles, and privileges (functions permission) to end-users; and

(d) entering a systems set up dialog field to assign application systems to access roles;

d. determining whether the end-user is a department manager, and, if so, allowing the department manager to select to add or modify roles, privileges or functions to a new system or a new end-user, and, if a selection is made, then;

(a) entering a modify department dialog field, entering department name and code, and upper department it belongs to, and continue on modification;

(b) entering a modify role dialog field, which allows entering access role description and code, and continue on modification;

(c) entering a modify system dialog field, which allows entering system name, and continue on modification;

(d) entering a modify rights dialog field, which allows entering right description, and continue on modification;

(e) entering a modify function dialog field, which allows entering function description and code, and continue on modification;

e. determining whether the user is a normal end-user, and, if so, then;

(a) entering an entry dialog field which allows entering end-user'"'"'s logon and password; and

activating system functions and privileges associated with the user;

(b) entering an end-user'"'"'s dialog field which allows selecting a desired application systems;

(c) entering the selected application systems, whereby the end-user can use the system with granted role and privileges, and predetermined functions.

2. An organizational role-based controlled access management method according to claim 1, further allowing addition of more than one end-user for any one tree node, additionally including:

f. entering a modify end-user dialog field, and adding or modifying a new end-user; and

g. setting up the new end-user'"'"'s access role and system login privileges.

3. An organizational role-based controlled access management method according to claim 1, wherein the access role set up also includes:

h. entering the system set up field, and adding systems to the manager'"'"'s control; and

i. assigning systems login privileges to the roles.

4. An organizational role-based controlled access management method according to claim 1, wherein the role assignment also includes:

j. entering the role maintenance dialog field, and assigning organizational department; and

k. displaying all end-users and access role managers within the department.

5. An organizational role-based controlled access management method according to claim 1, wherein modifying department also includes:

l. entering the set up department manager dialog field, to set up department; and

m. displaying all end-users and managers within the department.

6. An organizational role-based controlled access management method according to claim 1, wherein the access role modification also includes:

n. entering the privilege designation dialog field, and setting up login name, and

o. displaying associated system management and role assignment rights, as well as other approved privileges.

7. An organizational role-based controlled access management method according to claim 1, wherein the system modification also includes:

p. entering the system management set up dialog field, and selecting access role types and management roles and privileges.

8. An organizational role-based controlled access management method according to claim 1, wherein the modify privileges dialog field also includes:

q. a function set up dialog field, display of functions tree, and set up of functions.

9. An organizational role-based controlled access management method according to claim 1, wherein the function modification also includes:

r. entering the function-associated privileges dialog field, and setting up role function code and name.

10. An organizational role-based controlled access computer management system, utilizing a public digital network, and including

one or more personal computers and a server connected by a public digital network;

wherein each personal computer includes at least a memory, a display, and a data entry device that can communicate with application systems;

wherein the server includes at least one processor to connect to a public digital network, computer programs, and a database; and

wherein each personal computer also includes an event processing application to add, edit, delete, or modify access roles and privileges; and

when an event occurs, the personal computer synchronizes with the server to update a user'"'"'s access role and privileges;

the system comprising;

s. a dialog field for logon and password;

t. means for processing and recognition of an end-user'"'"'s department, role, and privileges;

u. means for access by manager(s) or system analyst(s) to set up organizational departments, role, privileges and limitations, including;

(a) a user function management field, display of the organizational department(s) and end-users subject to the current user'"'"'s management, production and display of an organizational structure tree and the functions the manager can distribute to each end-user;

(b) an access role set up dialog field, display of available roles available to the manager to set up end-users'"'"' role and privileges;

(c) a role assignment dialog field, for input of organizational positions, end-users, and allowable role assignment(s);

(d) a system selection dialog field, to designate application system(s) for controlled access management by a manager(s);

v. means for department managers to add or modify the department personnel list, and manage the role and privileges assigned to end-users within the department, including;

(a) a department modification dialog field, to input and modify department names for subordinate departments;

(b) a role modification dialog field, to input and modify access role codes, and names;

(c) a system modification dialog field, to input and modify system name(s);

(d) a privilege modification dialog field, to input and modify privilege description(s);

(e) a function modification dialog field, to input and modify function codes and description;

w. means for identification of normal end-users, and processing requests for application systems and functions, including;

(a) a logon and password dialog field;

(b) an end-user dialog field for selecting a system from those which are available to the end-user;

(c) after logon, access to all of the privileges and functions available to the end-user.

11. An organizational role-based controlled access computer management system according to claim 10, wherein, if the system includes more than one end-user in the system, the system additionally includes:

x. means to modify end-user dialog field to add new end-user or modify end-user; and

y. means to set up end-user roles and system login privileges.

12. An organizational role-based controlled access computer management system according to claim 10, wherein role assignment also includes:

a system login privilege set up dialog field to allow systems managers to assign systems login privileges to end-users.

13. An organizational role-based controlled access computer management system according to claim 10, wherein role set up also includes:

z. a maintenance dialog field to enter department; and

aa. means to display all end-users and their roles of the department.

14. An organizational role-based controlled access computer management system according to claim 10, wherein modify department also includes:

bb. a set up department manager dialog field to allow set up of departments; and

cc. means to display all end-users and their managers of the department.

15. An organizational role-based controlled access computer management system according to claim 10, wherein modify access role also includes:

dd. a role set up dialog field, including a process for set up of role names; and

ee. means for designation of system management and end user role assignment privileges.

16. An organizational role-based controlled access computer management system according to claim 10, wherein system modification also includes:

a system management set up dialog field with processes to select management roles and set up associated management privileges.

17. An organizational role-based controlled access computer management system according to claim 10, wherein right (privilege) modification also includes:

ff. a function set up dialog field to display of a function tree structure; and

gg. means to set up and assign available functions.

18. An organizational role-based controlled access computer management system according to claim 10, wherein function modification also includes:

a function-related privileges dialog field to allow set up of privilege code numbers and descriptions.

19. An access control management method, comprising:

hh. creation of different domains;

ii. creation of different kinds of sets within the domains;

jj. creation of different kinds of members within the domains;

kk. designation of the relations between sets within the domains, setup of the “

set and set”

relations and associated transmission attributes;

ll. creation of “

member and set”

relations and associated attributes within the domains;

mm. recalculation of attributes, transmission, and indirect relations according to changes to the direct relations among “

set and set”

or “

member and set”

relations (e.g. new, delete, update); and

nn. retrieving relations data through the result of direct and indirect relations after transmission by a method selected from the group consisting of retrieving the relations data between one set and the other sets connected to it via direct or indirect “

set and set”

relations;

retrieving the relations data between one set and members connected to it via direct or indirect “

set and set”

relations and “

member and set”

relations; and

retrieving the relations data between one member and other members connected to it via direct or indirect “

set and set”

relation and “

member and set”

relations.

20. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes establishing the relation between sets can be also used to establish a variety of applications for building organizational charts from the relations between departments within the organization.

21. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the relations between members and sets to designate the different managers within the organization for different applications and through the methods of query between the sets, a variety of different mechanisms for management of the organization can also be queried.

22. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the relations between the members and sets to establish special mechanisms for special functions;

special mechanisms being established for the special purposes of the existing organization and extra criteria.

23. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the relation between sets to establish the matrix of organization.

24. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the relation between “

member and set”

to determine whether a user belongs to some department directly or indirectly.

25. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the ‘

belong to’

relation between “

member and set”

to query the users belong directly or indirectly to departments of the organization.

26. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the ‘

manages’

relation between “

member and set”

to determine whether a user manages some department directly or indirectly.

27. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of“

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the relation between “

set and set”

(department relation) and “

member and set”

(user ‘

belongs to’

or ‘

manages’

a department ) to determine whether a user is under another user'"'"'s management.

28. An access control management method according to claim 19, wherein if:

The kind of set is organization

The kind of member is end-user

The kind of “

set and set”

relation is “

organizational tree structure,”

“

matrix organization,”

or “

functional organization,”

etc.

The kind of “

member and set”

relation is “

belongs to the organization,”

or “

manages the organization”

etc.

the method additionally includes using the relation between “

set and set”

(department relation) and “

member and set”

(user ‘

belongs to’

or ‘

manages’

a department) to determine whether a user is under another user'"'"'s management; and

using the relations between “

set and set” and

“

member and set”

to determine if users are managed by a given manager, and vice-versa.

29. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role.”

The kind of “

member”

is “

function,”

or “

privilege,”

etc.,

The kind of “

set and set”

relation is “

role association,”

“

role networking,”

“

role hierarchy,”

“

function set,”

or “

privilege set,”

etc.

The kind of “

member and set”

relation is “

functions or privileges under a role,”

“

group of functions,”

or “

group of privileges,”

etc.,

the method additionally includes using the methods of establishing the relations between sets to establish a variety of role associations from the relations between the roles.

30. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role.”

The kind of “

member”

is “

function,”

or “

privilege,”

etc.,

The kind of “

set and set”

relation is “

role association,”

“

role networking,”

“

role hierarchy,”

“

function set,”

or “

privilege set,”

etc.

The kind of “

member and set”

relation is “

functions or privileges under a role,”

“

group of functions,”

or “

group of privileges,”

etc.,

the method additionally includes using the methods of establishing the relations between sets to establish a variety of role inheritance associations from the relations between the roles.

31. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role.”

The kind of“

member”

is “

function,”

or “

privilege,”

etc.,

The kind of “

set and set”

relation is “

role association,”

“

role networking,”

“

role hierarchy,”

“

function set,”

or “

privilege set,”

etc.

The kind of “

member and set”

relation is “

functions or privileges under a role,”

“

group of functions,”

or “

group of privileges,”

etc.,

the method additionally includes using the methods of establishing the relations between sets to transmit roles, functions, and privileges between the different roles with or without additional criteria to be combined with a given role'"'"'s existing functions and privileges.

32. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role.”

The kind of“

member”

is “

function,”

or “

privilege,”

etc.,

The kind of “

set and set”

relation is “

role association,”

“

role networking,”

“

role hierarchy,”

“

function set,”

or “

privilege set,”

etc.

The kind of “

member and set”

relation is “

functions or privileges under a role,”

“

group of functions,”

or “

group of privileges,”

etc.,

the method additionally includes using the methods of establishing the relations between “

set and set”

to define “

NOT”

relations in order to achieve mutual exclusion.

33. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role.”

The kind of“

member”

is “

function,”

or “

privilege,”

etc.,

The kind of “

set and set”

relation is “

role association,”

“

role networking,”

“

role hierarchy,”

“

function set,”

or “

privilege set,”

etc.

The kind of “

member and set”

relation is “

functions or privileges under a role,”

“

group of functions,”

or “

group of privileges,”

etc.,

the method additionally includes using the methods for transmission of the relations between “

member and set”

to determine if certain functions or privileges are directly or indirectly associated with a given role after transmission.

34. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role,”

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

role association,”

“

role network,”

or “

role hierarchy,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s role,”

or “

role'"'"'s administrator,”

etc.,

the method additionally includes using the methods of establishing “

member and set”

relations to set up an end-user'"'"'s role.

35. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role,”

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

role association,”

“

role network,”

or “

role hierarchy,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s role,”

or “

role'"'"'s administrator,”

etc.,

the method additionally includes using the methods of establishing “

member and set”

relations to designate roles managed by an end-user.

36. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role,”

The kind of“

member”

is “

end-user,”

The kind of “

set and set”

relation is “

role association,”

“

role network,”

or “

role hierarchy,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s role,”

or “

role'"'"'s administrator,”

etc.,

the method additionally includes using the methods of establishing “

set and set”

relations to set up the transmissions and the relations between roles.

37. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role,”

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

role association,”

“

role network,”

or “

role hierarchy,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s role,”

or “

role'"'"'s administrator,”

etc.,

the method additionally includes using the methods used to query the relations between ‘

member and set’

after transmission, to check if a role includes a user directly or indirectly via transmission.

38. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

role,”

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

role association,”

“

role network,”

or “

role hierarchy,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s role,”

or “

role'"'"'s administrator,”

etc.,

the method additionally includes using the methods used to query the relations between ‘

member and set’

after transmission, can be used to check if an end-user manages a role via transmission.

39. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

job title,”

or “

job duty,”

etc.,

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

hierarchy of job tiles”

, or “

hierarchy of job duties,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s job title,”

“

end-user'"'"'s job duty,”

“

job title administrator,”

“

job duty administrator,”

etc.

the method used to set up “

member and set”

relations can be used to set up administrators of job titles and job duties.

40. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

job title,”

or “

job duty,”

etc.,

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

hierarchy of job tiles”

, or “

hierarchy of job duties,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s job title,”

“

end-user'"'"'s job duty,”

“

job title administrator,”

“

job duty administrator,”

etc.\

the method used to set up “

member and set”

relations can be used to set up a variety job titles and job duties for end-users, etc.

41. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

job title,”

or “

job duty,”

etc.,

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

hierarchy of job tiles”

, or “

hierarchy of job duties,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s job title,”

“

end-user'"'"'s job duty,”

“

job title administrator,”

“

job duty administrator,”

etc.

the method used to set up “

set and set”

relations can be used to create a special purpose set with different job titles and job duties.

42. An access control management method according to claim 19, wherein if:

The kind of “

set”

is “

job title,”

or “

job duty,”

etc.,

The kind of “

member”

is “

end-user,”

The kind of “

set and set”

relation is “

hierarchy of job tiles”

, or “

hierarchy of job duties,”

etc.,

The kind of “

member and set”

relation is “

end-user'"'"'s job title,”

“

end-user'"'"'s job duty,”

“

job title administrator,”

“

job duty administrator,”

etc.

the method used to set up “

set and set”

relations can be used to set up the relations between job sets and role sets to manage an end-user'"'"'s authorized functions by job titles or job duties.

43. An access control management method according to claim 19, wherein the sets, members, “

set and set”

relations or “

member and set”

relations can be created in different domains; and

the method used to set up “

set and set”

relations among different domains can be used to create different flow sequences for workflow control.

44. An access control management method according to claim 19, wherein the sets, members, “

set and set”

relations or “

member and set”

relations can be created in different domains; and

the method used to set up different workflow and domain relations can be used to set up different workflow using different organizational structures.

45. An access control management method according to claim 19, wherein the sets, members, “

set and set”

relations or “

member and set”

relations can be created in different domains; and

the method used to set up different “

member and set”

relations can be used to set up approval relations and different end-users'"'"' relations among different workflow.