Method and apparatus for access control list (ACL) binding in a data processing system

• US 20070100830A1
• Filed: 10/20/2005
• Published: 05/03/2007
• Est. Priority Date: 10/20/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Vaideeswaran, Ganesh, Dwivedula, Ramakrishna, Beedubail, Ganesha
• Application Number:
  US11/254,399
• Publication Number:
  US 20070100830A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

Methods, computer programs, and systems for updating an access control list (ACL) associated with one or more resources in a data processing system are provided. The method includes providing a table including a list of one or more first ACLs that map to a corresponding one or more previously computed second ACLs; and updating a current ACL associated with a first resource of the one or more resources in the data processing system including determining whether one of the one or more first ACLs in the table matches the current ACL associated with the first resource. If one of the one or more first ACLs in the table matches the current ACL associated with the first resource then updating the current ACL associated with the first resource by associating the corresponding second ACL with the first resource.

Claims

1. A method for updating an access control list (ACL) associated with one or more resources in a data processing system, the method comprising:

providing a table including a list of one or more first access control lists (ACLs) that map to a corresponding one or more second access control lists (ACLs), the one or more second access control lists (ACLs) having been previously computed; and

updating a current access control list (ACL) associated with a first resource of the one or more resources in the data processing system including,

determining whether one of the one or more first access control lists (ACLs) in the table corresponds to the current access control list (ACL) associated with the first resource,

if one of the one or more first access control lists (ACLs) in the table corresponds to the current access control list (ACL) associated with the first resource then updating the current access control list (ACL) associated with the first resource by associating the corresponding second access control list (ACL) with the first resource.

2. The method of claim 1, further comprising:

if one of the one or more first access control lists (ACLs) in the table does not match the current access control list (ACL) associated with the first resource then,

computing a new access control list (ACL) for the first resource; and

adding an entry to the table that maps the current access control list (ACL) with the newly computed access control list (ACL).

3. The method of claim 2, wherein an access control list (ACL) identifies which users may access a given resource within the data processing system and identifies a type of access that the users have for the given resource.

4. The method of claim 1, wherein the one or more resources in the data processing system are organized in a hierarchical tree structure.

5. The method of claim 1, wherein the data processing system comprises one or more of a workstation, a desktop computer, a laptop computer, a personal digital assistant (PDA), or a cell phone.

6. The method of claim 1, wherein each first access control list (ACL) and second access control list (ACL) comprises a unique ACL identifier (ACLid).

7. The method of claim 1, wherein updating a current access control list (ACL) associated with a first resource in the data processing system includes receiving a new access control entry (ACE) for the first resource, the access control entry (ACE) specifying a user or a group of users and an allowed access type for the user or the group of users.

8. The method of claim 1, wherein the one or more resources in the data processing system comprises data, a file, or an object.

9. A computer program product, tangibly stored on a computer-readable medium, for updating an access control list (ACL) associated with one or more resources in a data processing system, the product comprising instructions to cause a programmable processor to:

provide a table including a list of one or more first access control lists (ACLs) that map to a corresponding one or more second access control lists (ACLs), the one or more second access control lists (ACLs) having been previously computed; and

update a current access control list (ACL) associated with a first resource of the one or more resources in the data processing system including,

determine whether one of the one or more first access control lists (ACLs) in the table corresponds to the current access control list (ACL) associated with the first resource,

if one of the one or more first access control lists (ACLs) in the table corresponds to the current access control list (ACL) associated with the first resource then update the current access control list (ACL) associated with the first resource by associating the corresponding second access control list (ACL) with the first resource.

10. The product of claim 9, further comprising instructions to cause a programmable processor to:

if one of the one or more first access control lists (ACLs) in the table does not match the current access control list (ACL) associated with the first resource then,

compute a new access control list (ACL) for the first resource; and

add an entry to the table that maps the current access control list (ACL) with the newly computed access control list (ACL).

11. The product of claim 10, wherein an access control list (ACL) identifies which users may access a given resource within the data processing system and identifies a type of access that the users have for the given resource.

12. The product of claim 9, wherein the one or more resources in the data processing system are organized in a hierarchical tree structure.

13. The product of claim 9, wherein the data processing system comprises one or more of a workstation, a desktop computer, a laptop computer, a personal digital assistant (PDA), a cell phone.

14. The product of claim 9, wherein each first access control list (ACL) and second access control list (ACL) comprises a unique ACL identifier (ACLid).

15. The product of claim 9, wherein the instructions to update a current access control list (ACL) associated with a first resource in the data processing system include instructions to receive a new access control entry (ACE) for the first resource, the access control entry (ACE) specifying a user or a group of users and an allowed access type for the user or the group of users.

16. The product of claim 9, wherein the one or more resources in the data processing system comprises data, a file, or an object.

17. A data processing system comprising:

a table including a list of one or more first access control lists (ACLs) that map to a corresponding one or more second access control lists (ACLs), the one or more second access control lists (ACLs) having been previously computed; and

a file system operable to update a current access control list (ACL) associated with a first resource of the one or more resources in the data processing system including determining whether one of the one or more first access control lists (ACLs) in the table corresponds to the current access control list (ACL) associated with the first resource,

if one of the one or more first access control lists (ACLs) in the table corresponds to the current access control list (ACL) associated with the first resource then the file system is operable to update the current access control list (ACL) associated with the first resource by associating the corresponding second access control list (ACL) with the first resource.

18. The data processing system of claim 17, wherein if one of the one or more first access control lists (ACLs) in the table does not match the current access control list (ACL) associated with the first resource then the file system is operable to compute a new access control list (ACL) for the first resource, and add an entry to the table that maps the current access control list (ACL) with the newly computed access control list (ACL).

19. The data processing system of claim 17, wherein the one or more resources in the data processing system comprises data, a file, or an object.

20. The data processing system of claim 17, wherein each first access control list (ACL) and second access control list (ACL) comprises a unique ACL identifier (ACLid).