METHOD AND SYSTEM FOR ENABLING AND DISABLING EXECUTION OF COMPUTER INSTRUCTIONS

• US 20140123241A1
• Filed: 10/29/2013
• Published: 05/01/2014
• Est. Priority Date: 10/30/2012
• Status: Active Grant

• Current Assignee: RES Software Development BV
• Original Assignee: Real Enterprise Solutions Development B.V. (Ivanti Software, Inc.)
• Inventors: Janssen, Bob, Schepens, Patric Johannes, Smits, Dennis Anton Edwin
• Granted Patent: US 9,531,713 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

In a computer implemented method or system, users are enabled to associate usage rights with at least a first entity and a second entity. The first entity and second entity are selected from different ones of the module, a processing circuitry and the one or more files. Execution of the module is only enabled when the associated usage rights allow both use of the first entity by the second entity and use of the second entity by the first entity, i.e. mutual usage rights for at least two entities exist. Execution of the module is disabled when the associated usage rights prevent at least one of use of the first entity by the second entity and use of the second entity by the first entity.

Claims

1. A computer-implemented method for enabling and disabling execution of at least one module by a processing circuitry configured for executing the module, the module comprising one or more computer instructions configured to use one or more files and the processing circuitry being configured to access the one or more files when executing the module, the method comprising:

associating usage rights with at least a first entity and a second entity, the first entity and second entity being selected from different ones of the module, the processing circuitry and the one or more files;

enabling execution of the module when the associated usage rights allow both use of the first entity by the second entity and use of the second entity by the first entity;

disabling execution of the module when the associated usage rights prevent at least one of use of the first entity by the second entity and use of the second entity by the first entity.

2. The computer-implemented method according to claim 1, wherein access to the first entity is obtained by verifying a first access right assigned to a first user and access to the second entity is obtained by verifying a second access right assigned to a second user, wherein the first access right and the second access right are different access rights.

3. The computer-implemented method according to claim 2, further comprising:

accessing the first entity and defining the usage rights for the first entity after verification of the first access right of the first user;

accessing the second entity and defining the usage rights for the second entity after verification of the second access right of the second user.

4. The computer-implemented method according to claim 1, wherein at least one of the first entity and the second entity comprises a plurality of levels and the usage right associated with the entity applies to one or more of the levels.

5. The computer-implemented method according to claim 4, further comprising the step of determining enabling or disabling of execution of the module by:

configuring the one or more levels of the first entity;

assigning usage rights to the one or more configured levels by a first user.

6. The computer-implemented method according to claim 4, wherein the levels of the first entity comprise at least a parent level and a child level, and comprising:

verifying usage rights between the child level of the first entity and the one or more levels of the second entity to obtain a verification result;

only when the verification result indicates that the usage rights on the child level allow both use of the first entity by the second entity and use of the second entity by the first entity, verifying usage rights between the parent level of the first entity and the one or more levels of the second entity.

7. The computer-implemented method according to claim 6, wherein the number of levels of the first entity and the second entity is different, further comprising the step of starting the verification of usage rights from the entity with the lowest number of levels.

8. The computer-implemented method according to claim 1, wherein verification of the usage rights associated with the first entity and second entity is performed upon execution of the module.

9. A computer program product, implemented on computer-readable non-transitory storage medium, the computer program product configured for, when run on a computer system having a processing circuitry, executing a method comprising:

associating usage rights with at least a first entity and a second entity, the first entity and second entity being selected from different ones of the module, the processing circuitry and the one or more files;

enabling execution of the module when the associated usage rights allow both use of the first entity by the second entity and use of the second entity by the first entity;

execution of the module when the associated usage rights prevent at least one of use of the first entity by the second entity and use of the second entity by the first entity.

10. A computer system configured for enabling and disabling execution of at least one module by the processing circuitry configured for executing the module, the module comprising one or more computer instructions configure to use one or more files and the processing circuitry being configured to access the one or more files when executing the module, wherein the system comprises at least one processing unit having a processing circuitry and memory operably coupled to the processing circuitry, the at least one processing unit comprising:

an association component configured for associating usage rights with at least a first entity and a second entity, the first entity and second entity being selected from different ones of the module, the processing circuitry and the one or more files;

a usage right verification component configured for;

enabling execution of the module when the associated usage rights allow both use of the first entity by the second entity and use of the second entity by the first entity; and

disabling execution of the module when the associated usage rights prevent at least one of use of the first entity by the second entity and use of the second entity by the first entity.

11. The computer system according to claim 10, wherein the at least one processing unit further comprises at least one access right verification component configured verifying a first access right of a first user to the first entity and for verifying a second access right of a second user to the second user, wherein the first access right and the second access right are different access rights.

12. The computer system according to claim 11, wherein the at least one processing unit further comprising a first usage right definition component configured for defining usage rights for the first entity after verification of the first access right of the first user and a second usage right definition component configured for defining the usage rights for the second entity after verification of the second access right of the second user.

13. The computer system according to claim 10, wherein at least one of the first entity and the second entity comprises a plurality of levels and the usage right associated with the entity applies to one or more of the levels.

14. The computer system according to claim 13, wherein the at least one processing unit further comprises an entity level configuration component adapted for configuring the one or more levels of the first entity by a first user, wherein the association component is further configured for associating usage rights to the one or more user-configured levels.

15. The computer system according to claim 13, wherein the levels of the first entity comprise at least a parent level and a child level, and wherein the usage right verification component is further configured for:

verifying usage rights between the child level of the first entity and the child level of the second entity and obtain a verification result;

only when the verification result indicates that the usage rights on the child level allow both use of the first entity by the second entity and of the second entity by the first entity, verifying usage rights between the parent level of the first entity and the child level of the second entity.

16. The computer system according to claim 15, wherein the number of levels of the first entity and the second entity is different, wherein the usage right verification component is configured for starting the verification of usage rights from the entity with the lowest number of levels.

17. The computer system according to claim 10, wherein the usage right verification component is triggered to start verification of the usage rights associated with the first and second entity upon execution of the module.