TIME-BASED CONTROL OF USER ACCESS IN A DATA PROCESSING SYSTEM INCORPORATING A ROLE-BASED ACCESS CONTROL MODEL

• US 20080289036A1
• Filed: 05/19/2007
• Published: 11/20/2008
• Est. Priority Date: 05/19/2007
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Shankar, Ravi A., Ranganathan, Vidya, KANDASAMY, MADHUSUDANAN
• Application Number:
  US11/751,010
• Publication Number:
  US 20080289036A1
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data

Abstract

Computer implemented method, system and computer usable program code for providing time-based control of user access in a data processing system utilizing a Role-Based Access Control model. A computer implemented method for providing time-based control of user access in a data processing system utilizing a Role-Based Access Control model includes providing at least one timing attribute for a role, wherein each at least one timing attribute specifies a timing condition by which a user is enabled to use the role. The user is enabled to use the role pursuant to satisfying the at least one timing attribute.

Claims

1. A computer implemented method for providing time-based control of user access in a data processing system utilizing a Role-Based Access Control model, the computer implemented method comprising:

providing at least one timing attribute for a role, wherein each at least one timing attribute specifies a timing condition by which a user is enabled to use the role; and

enabling the user to use the role pursuant to satisfying the at least one timing attribute.

2. The computer implemented method according to claim 1, wherein the at least one timing attribute comprises at least one of a timeframe attribute that specifies a period of time during which the user is enabled to use the role, a timeout attribute that specifies a maximum length of time that the user is enabled to use the role, a times attribute that specifies a number of times the user is enabled to use the role for a particular job, and a days attribute that specifies days of the week the user is enabled to use the role.

3. The computer implemented method according to claim 1, wherein the at least one timing attribute is included with other attributes defining the role.

4. The computer implemented method according to claim 1, wherein the at least one timing attribute is in an object separate from the role.

5. The computer implemented method according to claim 1, and further comprising:

disabling use of the role by the user if any one of the at least one timing attribute is not satisfied.

6. The computer implemented method according to claim 5, and further comprising:

warning the user prior to disabling use of the role.

7. The computer implemented method according to claim 1, wherein at least one of the at least one timing attribute comprises a default condition specifying a timing condition that includes no timing restriction with respect to the at least one of the at least one timing attribute.

8. The computer implemented method according to claim 1, wherein the data processing system comprises one of a UNIX®

and a Windows®

operating system.

9. A computer program product, comprising:

a computer usable medium having computer usable program code configured for providing time-based control of user access in a data processing system utilizing a Role-Based Access Control model, the computer program product comprising;

computer usable program code configured for providing at least one timing attribute for a role, wherein each at least one timing attribute specifies a timing condition by which a user is enabled to use the role; and

computer usable program code configured for enabling the user to use the role pursuant to satisfying the at least one timing attribute.

10. The computer program product according to claim 9, wherein the at least one timing attribute comprises at least one of a timeframe attribute that specifies a period of time during which the user is enabled to use the role, a timeout attribute that specifies a maximum length of time that the user is enabled to use the role, a times attribute that specifies a number of times the user is enabled to use the role for a particular job, and a days attribute that specifies days of the week the user is enabled to use the role.

11. The computer program product according to claim 9, and further comprising:

computer usable program code configured for disabling use of the role by the user if any one of the at least one timing attribute is not satisfied.

12. The computer program product according to claim 11, and further comprising:

computer usable program code configured for warning the user prior to disabling use of the role.

13. The computer program product according to claim 9, wherein at least one of the at least one timing attribute comprises a default condition specifying a timing condition that includes no timing restriction with respect to the at least one of the at least one timing attribute.

14. A system for providing time-based control of user access in a data processing system utilizing a Role-Based Access Control model, comprising:

a role having role attributes specifying privileges granted to a user;

means for providing at least one timing attribute for the role, wherein each at least one timing attribute specifies a timing condition by which a user is enabled to use the role; and

means for enabling the user to use the role pursuant to satisfying the at least one timing attribute.

15. The system according to claim 14, wherein the at least one timing attribute comprises at least one of a timeframe attribute that specifies a period of time during which the user is enabled to use the role, a timeout attribute that specifies a maximum length of time that the user is enabled to use the role, a times attribute that specifies a number of times the user is enabled to use the role for a particular job, and a days attribute that specifies days of the week the user is enabled to use the role.

16. The system according to claim 14, wherein the at least one timing attribute is included with role attributes defining the role.

17. The system according to claim 14, wherein the at least one timing attribute is in an object separate from the role.

18. The system according to claim 14, and further comprising:

means for disabling use of the role by the user if any one of the at least one timing attribute is not satisfied.

19. The system according to claim 14, wherein at least one of the at least one timing attribute comprises a default condition specifying a timing condition that includes no timing restriction with respect to the at least one of the at least one timing attribute.

20. The system according to claim 14, wherein the data processing system comprises one of a UNIX®

or a Windows®

operating system.