METHOD AND DEVICES FOR HANDLING ACCESS PRIVILEGES

• US 20090183238A1
• Filed: 01/13/2009
• Published: 07/16/2009
• Est. Priority Date: 01/15/2008
• Status: Active Grant

• Current Assignee: Axis AB (Canon Inc.)
• Original Assignee: Axis AB (Canon Inc.)
• Inventors: Rehn, John, Kindborg, Mattias, Rasmusson, Martin, Hultqvist, Sebastian
• Granted Patent: US 8,713,643 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and apparatus are disclosed for configuring access privileges in a system of networked devices. A plurality of access identities is selected and information of access privileges of each of the selected access identities to accessible functions of networked devices is retrieved. The access privileges of the selected access identities for each one of said accessible function of each one of said networked devices is accumulated. The accumulated access privileges are presented for each one of said accessible function of each one of said networked devices in an interface allowing editing of the accumulated access privileges. Change in accumulated access privileges to a specific function in a specific networked device is indicated, and the specific function of the specific networked device is configured for allowing access by the selected users in accordance with the indicated change of accumulated access privileges.

Claims

1. A method for configuring access privileges in a system of networked devices, said method comprising:

selecting a plurality of access identities;

retrieving information of access privileges of each of the selected access identities to accessible functions of networked devices;

accumulating the access privileges of the selected access identities for each one of said accessible function of each one of said networked devices, wherein said accumulating the access privileges includes counting the number of selected access identities having access privileges to each one of said functions of each one of said networked devices;

presenting said accumulated access privileges for each one of said accessible function of each one of said networked devices in an interface allowing editing of the accumulated access privileges;

indicating a change in accumulated access privileges to a specific function in a specific networked device; and

configuring the specific function of the specific networked device for allowing access by the selected access identities in accordance with the indicated change of accumulated access privileges.

2. The method according to claim 1, wherein said accumulating the access privileges further includes:

setting the accumulated access privilege for a specific function of a networked device to a value indicating that all selected access identities are allowed access to the specific function if said counting indicates that all selected access identities are allowed access to the specific function;

setting the accumulated access privilege for a specific function of a networked device to a value indicating that none of the selected access identities are allowed access to the specific function if said counting indicates that none of the selected access identities are allowed access to the specific function; and

setting the accumulated access privilege for a specific function of a networked device to a value indicating that some of the selected access identities are allowed access to the function if said counting indicates that some of the selected access identities are allowed access to the function.

3. The method according to claim 1, further comprising sending, via a computer network information representing said accessible functions of said networked devices, information representing the accumulated access privilege associated with each one of said functions, and information enabling identification of the selected access identities, to a client computer performing said presenting.

4. The method according to claim 3, wherein the information enabling identification of the selected access identities is a list including identifiers of the selected access identities.

5. The method according to claim 3, wherein the information enabling identification of the selected access identities is an identifier identifying the location of a list including identifiers of the selected access identities.

6. The method according to claim 3, further comprising returning, via the computer network information representing each one of said accessible functions of each one of said networked devices, an accumulated access privilege associated with each of these functions, and information enabling identification of the selected access identities, wherein the accumulated access privilege associated with at least one function of a networked device has been changed in relation to the corresponding information previously sent via the computer network.

7. The method according to claim 6, wherein the at least one function of a networked device for which the accumulated access privilege has been changed is tagged in order to indicate that the accumulated access privilege to this particular function has been changed in relation to the corresponding information previously sent via the computer network.

8. The method according to claim 1, wherein said indicating a change in accumulated access privileges to a specific function in a specific network device only enables changing an access privilege of a specific function of a specific network device to either allowing all users identified by the selected access identities to access the specific function or allowing none of the selected users to access the specific function.

9. The method according to claim 1, wherein the selecting of a plurality of access identities includes selecting a plurality of access identities from access identities registered for using the system.

10. The method according to claim 1, wherein the selecting of access identities includes selecting individual users.

11. The method according to claim 1, wherein the selecting of access identities includes selecting user groups.

12. A server for handling access privileges in a system of networked devices, the server comprising:

a component for managing selecting of access identities arranged to receive an indication of selected access identities from a client;

an access privileges manager arranged to retrieve information of access privileges of individually selected access identities to accessible functions associated with networked devices, and arranged to generate a message including accumulated access privileges in view of the selected access identities for said functions of the networked devices;

an access privileges accumulator arranged to accumulate the access privileges of the selected access identities for said accessible functions of the networked devices from said retrieved information by counting the number of selected access identities having access privileges to each one of said accessible functions of the networked devices; and

an access privileges configurator arranged to configure the access privileges of accessible functions of networked devices for the selected access identities in accordance with a received message including an indicator indicating that the access privileges of said function of the 25 networked device is to be changed.

13. The server according to claim 12, wherein said access privileges accumulator is further arranged to:

set the accumulated access privilege for a specific function of a networked device to a value indicating that all selected access identities are allowed access to the specific function if said counting indicates that all selected users are allowed access to the specific function;

set the accumulated access privilege for a specific function of a networked device to a value indicating that none of the selected access identities are allowed access to the specific function if said counting indicates that none of the selected access identities are allowed access to the specific function; and

set the accumulated access privilege for a specific function of a networked device to a value indicating that some of the selected access identities are allowed access to the function if said counting indicates that some of the selected access identities are allowed access to the function.

14. The server according to claim 12, wherein the access privileges manager is arranged to include, in said generated message, information representing accessible functions of the networked devices, the accumulated access privilege associated with each included function, and information enabling identification of the selected access identities.

15. The server according to claim 12, wherein the system is a monitoring system.

16. The server according to claim 12, wherein the access identities include a user identity.

17. The server according to claim 12, wherein the access identities include a user group identity.

18. A client for changing access privileges to functions of networked devices of a system, said client comprising:

a display;

an input;

a component for selecting access identities, arranged for accessing an access server and for requesting the access server to provide information of the access identities of the system or the users of the network, and said component arranged to present access identities on the display and to allow a user of the client to select access identities by components of the input; and

a component for changing access privileges for selected access identities to accessible functions of networked devices, said component for changing access privileges being arranged to present accumulated access privileges relating to said accessible functions of the networked devices on the display, to allow a user of the client to select and change the accumulated access privileges for presented functions, and to generate a message including information of changed accumulated access privileges, wherein said accumulating the access privileges includes counting the number of selected access identities having access privileges to each one of said functions of each one of said networked devices.

19. The client according to claim 18, wherein the component for changing access privileges is arranged to receive a message via a network interface, said message including information representing accessible functions of networked devices, information representing the accumulated access privileges associated with each of these functions, and information enabling identification of the selected access identities.

20. The client according to claim 18, wherein said generated message includes information representing accessible functions of networked devices, information representing the accumulated access privileges associated with each of these functions, an indicator indicating each accumulated access privileges that has been changed, and information enabling identification of the selected access identities.

21. The client according to claim 19, wherein the information enabling identification of the selected access identities is a list including identifiers of the selected access identities.

22. The client according to claim 19, wherein the information enabling identification of the selected access identities is an identifier identifying the location of a list including identifiers of the selected users.