Caching permissions information

• US 20070294236A1
• Filed: 08/21/2007
• Published: 12/20/2007
• Est. Priority Date: 06/25/2004
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: O'Rourke, David, Vaughan, Greg
• Granted Patent: US 8,001,148 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/90339 by using parallel associative memories or content-addressable memories
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A method for determining group membership in a computer system, the method comprising: obtaining an identifier that describes a member of a group, the member of a group having a member hash table that contains group membership information describing to what groups a member belongs; performing a primary search of a plurality of groups to determine if each group contains the member'"'"'s identifier, each group in the plurality having a group hash table that describes to what other groups the group belongs, caching the results of the primary search in the member hash table, for each group to which the member belongs, performing a secondary search of a plurality of groups to determine what groups contain the group to which the member belongs, and caching the results of the secondary search into the group hash table and merging the results into the member hash table, and reading the member hash table to determine group membership.

Claims

1-5. -5. (canceled)

6. A computerized method comprising:

searching a plurality of groups to determine which groups of the plurality comprise an identifier;

recording in a data structure a first set of groups comprising the identifier; and

for each group in the first set of groups;

recursively determining a set of parent groups of said group; and

recording in the data structure said set of parent groups.

7. The method of claim 6, wherein the data structure is adapted to be stored in cache memory.

8. The method of claim 6, wherein the data structure comprises a hash table.

9. The method of claim 8, wherein said method is adapted for use in a computer system, said identifier uniquely corresponding to a user of the computer system.

10. The method of claim 9, wherein the computer system comprises an access control list, said access control list comprising a set of access rights for each group in said plurality of groups.

11. The method of claim 10, wherein each set of access rights comprises rules for directory access and for service access.

12. The method of claim 10 further comprising:

retrieving a second set of groups from the hash table; and

for each group in the second set of groups, retrieving the set of access rights corresponding to that group from the access control list.

13. The method of claim 12, wherein the second set of groups comprises immediate parents of the identifier.

14. The method of claim 12, wherein the second set of groups comprises all parents of the identifier.

15. The method of claim 9, wherein the identifier is stored as a hash value in a second hash table.

16. A computerized apparatus comprising:

logic adapted to search a plurality of groups and determine which groups of the plurality comprise an identifier;

logic adapted to record in a data structure a first set of groups comprising the identifier;

logic adapted to recursively determine a set of parent groups for each group in the first set of groups; and

logic adapted to record each set of parent groups in the data structure.

17. The apparatus of claim 16, wherein the data structure is adapted to be stored in cache memory.

18. The apparatus of claim 16, wherein the data structure comprises a hash table.

19. The apparatus of claim 18, wherein the identifier uniquely corresponds to a user of a computer system.

20. The apparatus of claim 19, wherein the computer system comprises an access control list, said access control list comprising access rights for each group in said plurality of groups.

21. The apparatus of claim 20, wherein the access rights comprise rules for directory access and for service access.

22. The apparatus of claim 20 further comprising:

logic adapted to retrieve a second set of groups from the hash table; and

logic adapted to retrieve from the access control list the access rights corresponding to each group in said second set of groups.

23. The method of claim 22, wherein the second set of groups comprises immediate parents of the identifier.

24. The method of claim 22, wherein the second set of groups comprises all parents of the identifier.

25. A computerized system adapted to be accessed by a user, the system comprising:

means for searching a plurality of groups to determine which groups of the plurality comprise an identifier, said identifier uniquely corresponding to the user;

means for recording in a data structure a first set of groups comprising the identifier;

means for recursively determining a set of parent groups for each group in the first set of groups;

means for recording each set of parent groups in the data structure;

means for retrieving a second set of groups from the hash table; and

means for determining the user'"'"'s access rights based at least in part on said second set of groups.

26. For use in a computer system, a method or managing access control data, comprising:

determining within a plurality of groups which of said groups of the plurality comprise an identifier;

recording in a data structure a listing or representation of a first set of groups comprising the identifier; and

for each group in the first set of groups;

recursively determining a set of parent groups of said group; and

recording in the data structure a listing or representation of said set of parent groups.

27. The method of claim 26, wherein the recording in a data structure comprises storing in cache memory.

28. The method of claim 26, wherein the recording in a data structure comprises recording in a correlation table.

29. The method of claim 28, wherein said identifier uniquely corresponds to a user of the computer system.

30. The method of claim 29, wherein the computer system comprises an access control list, said access control list comprising a set of access rights for each group in said plurality of groups.

31. The method of claim 29, wherein each set of access rights comprises rules for directory access and for service access.

32. The method of claim 30 further comprising:

retrieving a second set of groups from the correlation table; and

for each group in the second set of groups, retrieving the set of access rights corresponding to that group from the access control list.

33. The method of claim 32, wherein the second set of groups comprises parents that are only immediate parents of the identifier.

34. The method of claim 32, wherein the second set of groups comprises all parents of the identifier.

35. The method of claim 29, wherein the identifier is stored as a hash value in a second correlation table.

36. A method of operating a computerized system, the method being used at least in part to control access and comprising:

searching a plurality of groups to determine at least one group of the plurality comprising an identifier;

recording in a data structure said at least one group comprising the identifier;

determining at least one parent group of said at least one group;

recording in the data structure said at least one parent group;

thereafter accessing the data structure; and

utilizing at least one of;

(i) said at least one group comprising the identifier, and (ii) said at least one parent group, to control access to at least a portion of said computerized system.

37. The method of claim 36, wherein the data structure is adapted to be stored in cache memory.

38. The method of claim 36, wherein the data structure comprises a hash table.

39. The method of claim 36, wherein said identifier uniquely corresponds to a particular user of the computerized system.

40. The method of claim 39, wherein the computer system comprises an access control list, said access control list comprising a set of access rights for each group in said plurality of groups.

41. The method of claim 40, wherein each set of access rights comprises rules for directory access and for service access.

42. A method of operating a computer system, comprising:

searching a plurality of groups of users of said computer system to determine at least one group of the plurality comprising a identifier;

recording in a data structure said at least one group comprising the identifier;

determining at least one parent group of said at least one group comprising the identifier; and

recording in the data structure said at least one parent group.

43. The method of claim 42, wherein said method is performed without the use of a database of pointers.

44. The method of claim 43, wherein said method is performed so as to determine access privileges for a user uniquely associated with said identifier.

45. The method of claim 44, wherein said method is performed substantially by an operating system computer program of said computer system.

46. The method of claim 44, wherein said operating system comprises a UNIX-based operating system.