Attribute-based allocation of resources to security domains

• US 20060259955A1
• Filed: 05/05/2006
• Published: 11/16/2006
• Est. Priority Date: 05/11/2005
• Status: Abandoned Application

• Current Assignee: Nokia Siemens Networks GmbH & Company KG (Nokia Corporation)
• Original Assignee: Siemens AG
• Inventors: Gunther, Wolfgang, Luft, Erik
• Application Number:
  US11/429,173
• Publication Number:
  US 20060259955A1
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

The invention relates to a method for the optimized assignment of access rights to IT resources managed by means of a security management system and to a correspondingly adapted security management system. According to the invention a security domain is defined on the basis of at least one attribute of IT resources and a plurality of authorization profiles is provided for the security domain. User groups are assigned to the domain and linked to profiles provided for the domain. IT resources for which the security management is responsible are allocated to the domain in accordance with the attribute defining the security domain, as a result of which user groups assigned to the domain receive access rights to the IT resources allocated to the domain in accordance with the profiles linked to them. The invention permits the user groups to be issued with authorizations that are tailored to the requirements of the individual groups.

Claims

1-5. -5. (canceled)

6. A method for allocating access rights to resources managed via a security management system, comprising:

providing an attribute of a resource;

defining a security domain defined by an attribute;

providing a plurality of authorization profiles for the security domain;

assigning a plurality of user groups to the domain;

linking the user groups assigned to the domain to the profiles provided for the domain;

assigning resources to the security domain in accordance with the resource attribute; and

receiving access rights by user groups assigned to the domain receive.

7. The method as claimed in claim 6,

providing a plurality of resources,

wherein a network management system comprises the security management system, and

wherein at least one of the resources is a network element.

8. The method as claimed in claim 7, wherein an allocation rule is incorporated in a software program.

9. The method as claimed in claim 7, wherein an allocation rule is stored in a file that is read and interpreted.

10. The method as claimed in claim 6,

wherein a network management system comprises the security management system, and

wherein the resource is a network element.

11. The method as claimed in claim 10, wherein an allocation rule is incorporated in a software program.

12. The method as claimed in claim 11, wherein the method is used within a security management system.

13. The method as claimed in claim 10, wherein an allocation rule is stored in a file that is read and interpreted.

14. The method as claimed in claim 13, wherein an allocation rule is stored in a file that is read and interpreted.

15. The method as claimed in claim 14, wherein method is in a security management system.