METHOD AND SYSTEM FOR GENERATING USER GROUP IDENTIFIERS

• US 20110004923A1
• Filed: 02/22/2010
• Published: 01/06/2011
• Est. Priority Date: 10/21/2004
• Status: Active Grant

• Current Assignee: Michael D. Smith
• Original Assignee: Michael D. Smith
• Inventors: Smith, Michael R.
• Granted Patent: US 8,302,157 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A method and apparatus for generating user group identifiers using a permissions matrix is disclosed. The permissions matrix includes an entry that is associated with a row and a column of the permissions matrix. The row of the permissions matrix is indexed with a first role and the column of the permissions matrix is indexed with a second role. A data structure implementing such a method can include, for example, a user group identifier matrix. Alternatively, a method is disclosed in which the expiration of a user group identifier is detected. In such a case, the user group identifier is updated by accessing a user group identifier matrix.

Claims

1. (canceled)

3. The method of claim 1, further comprising:

forming a role permissions list using the plurality of user-role relationships, wherein

the role permissions list defines an access control relationship for the each role subset of the role subsets.

4. The method of claim 1, further comprising:

assigning a user group identifier to the each role subset of the role subsets.

5. The method of claim 1, further comprising:

updating the plurality of role subsets, wherein

the plurality of role subsets is updated by eliminating redundant role subsets.

2. A method comprising:

generating a plurality of user-role relationships, wherein

the plurality of user-role relationships are generated for a set of entities,

each entity of the set of entities represents one of a plurality of users,

the each entity is assigned a role subset from a plurality of role subsets,

each role subset of the role subsets comprises one or more roles from a set of roles,

the plurality of user-role relationships define network access permitted to the each entity, and

the network access permitted to the each entity is based on the role subset assigned to the each entity.

6. A method comprising:

generating a user group identifier matrix, wherein

the user group identifier matrix comprises an entry,

the entry is associated with a row and a column of the user group identifier matrix,

the row of the user group identifier matrix is configured to be indexed according to a source user group identifier, and

the column of the permissions matrix is configured to be indexed according to a destination user group identifier; and

accessing a user group permissions list, wherein

the user group permissions list is accessed using the entry in the user group identifier matrix.

7. The method of claim 6, wherein

the user group permissions list is generated by taking a Cartesian product of the source and destination user group identifiers.

8. The method of claim 7, wherein

the Cartesian product of the source and destination user group identifiers is generated by

replacing the source and destination user group identifiers with a source and destination role subset, respectively, and

taking the Cartesian product of the source and destination role subsets to obtain a set of ordered pairs, wherein

each ordered pair in the set of ordered pairs corresponds to an entry in a role permissions matrix.

9. The method of claim 8, further comprising:

obtaining a role permissions list for the each ordered pair in the set of ordered pairs; and

merging the role permissions list for the each ordered pair to form the user group permissions list.

10. The method of claim 8, further comprising:

minimizing the set of ordered pairs.

11. The method of claim 6, further comprising:

optimizing the user group identifier matrix, wherein

the user group identifier matrix is optimized by

detecting the expiration of at least one user group identifier, and

updating the at least one expired user group identifier within the user group identifier matrix.

12. The method of claim 6, further comprising:

obtaining a user group identifier of a user upon authentication, wherein

the user group identifier is a security group tag.

13. The method of claim 6, further comprising:

determining security information for a packet, wherein

the security information for the packet is determined using the entry in the user group identifier matrix and the corresponding user group permissions list; and

distributing the security information for the packet throughout a network.

14. A computer program product comprising:

a first set of instructions, executable on a computer system, configured to generate a user group identifier matrix, wherein

the user group identifier matrix comprises an entry,

the entry is associated with a row and a column of the user group identifier matrix,

the row of the user group identifier matrix is configured to be indexed according to a source user group identifier, and

the column of the permissions matrix is configured to be indexed according to a destination user group identifier;

a second set of instructions, executable on the computer system, configured to access a user group permissions list, wherein

the user group permissions list is accessed using the entry in the user group identifier matrix; and

a persistent computer readable media, wherein the computer program product is encoded in the persistent computer readable media.

15. The computer program product of claim 14, further comprising

a third set of instructions, executable on the computer system, configured to take a Cartesian product of the source and destination user group identifiers to generate the user group permissions list, wherein the third set of instructions comprises:

a first subset of instructions, executable on the computer system, configured to

replace the source and destination user group identifiers with a source and destination role subset, respectively, and

take the Cartesian product of the source and destination role subsets to obtain a set of ordered pairs, wherein

each ordered pair in the set of ordered pairs corresponds to an entry in a role permissions matrix.

16. The computer program product of claim 15, further comprising

a fourth set of instructions, executable on the computer system, configured to obtain a role permissions list for the each ordered pair in the set of ordered pairs;

and

a fifth set of instructions, executable on the computer system, configured to merge the role permissions list for the each ordered pair to form the user group permissions list.

17. The computer program product of claim 14, further comprising

a third set of instructions, executable on the computer system, configured to optimize the user group identifier matrix, wherein the third set of instructions comprises:

a first subset of instructions, executable on the computer system, configured to detect the expiration of at least one user group identifier, and

a second subset of instructions, executable on the computer system, configured to update the at least one expired user group identifier within the user group identifier matrix.

18. The computer program product of claim 14, further comprising

a third set of instructions, executable on the computer system, configured to obtain a user group identifier of a user upon authentication, wherein

the user group identifier is a security group tag.

19. The computer program product of claim 14, further comprising

a third set of instructions, executable on the computer system, configured to

determine security information for a packet, wherein

the security information for the packet is determined using the entry in the user group identifier matrix and the corresponding user group permissions list;

and

a fourth set of instructions, executable on the computer system, configured to distribute the security information for the packet throughout the network.

20. An apparatus comprising:

means for generating a user group identifier matrix, wherein

the user group identifier matrix comprises an entry,

the entry is associated with a row and a column of the user group identifier matrix,

the row of the user group identifier matrix is configured to be indexed according to a source user group identifier, and

the column of the permissions matrix is configured to be indexed according to a destination user group identifier; and

means for accessing a user group permissions list, wherein

the user group permissions list is accessed using the entry in the user group identifier matrix.

21. The apparatus of claim 20, further comprising

means for taking a Cartesian product of the source and destination user group

identifiers to generate the user group permissions list, wherein the means for taking the Cartesian product of the source and destination user group identifiers comprises:

means for replacing the source and destination user group identifiers with a source and destination role subset, respectively, and

means for taking the Cartesian product of the source and destination role subsets to obtain a set of ordered pairs, wherein

each ordered pair in the set of ordered pairs corresponds to an entry in a role permissions matrix.

22. The apparatus of claim 21, further comprising:

means for obtaining a role permissions list for the each ordered pair in the set of ordered pairs; and

means for merging the role permissions list for the each ordered pair to form the user group permissions list.

23. The apparatus of claim 20, further comprising:

means optimizing the user group identifier matrix, wherein the means for optimizing

the user group identifier matrix comprises

means for detecting the expiration of at least one user group identifier, and

means for updating the at least one expired user group identifier within the user group identifier matrix.

24. The apparatus of claim 20, further comprising:

means for obtaining a user group identifier of a user upon authentication, wherein the user group identifier is a security group tag.

25. The apparatus of claim 20, further comprising:

means for determining security information for a packet, wherein

the security information for the packet is determined using the entry in the user group identifier matrix and the corresponding user group permissions list; and

means for distributing the security information for the packet throughout a network.