Controlling access to network resources

• US 4,961,224 A
• Filed: 03/06/1989
• Issued: 10/02/1990
• Est. Priority Date: 03/06/1989
• Status: Expired due to Fees

• Current Assignee: Darby Yung
• Original Assignee: Darby Yung
• Inventors: Yung, Darby
• Primary Examiner(s): Buczinski, Stephen C.
• Assistant Examiner(s): GREGORY, BERNARR E
• Application Number:
  US07/319,277
• Time in Patent Office: 575 Days
• Field of Search: 380/23-25, 380/49, 380/50, 380/3, 380/4, 340/825.31, 340/825.34, 364/200, 364/900
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores

Abstract

A network includes digital computers, resources such as disk drives, printers and modems or disk files, file records or tasks, and a communications channel permitting data transfer between each digital computer and the resources. The function of mediating conflicting demands for network resources is distributed among the digital computers. A file server or other storage device connected to the communications channel contains an access log. Each digital computer accesses a required resource by first recording an entry in the access log identifying the required resource and then scanning the access log to locate any conflicting entry identifying the same resource. The access procedure is terminated if the conflicting entry is located and the recorded entry is then deleted. The digital computer otherwise accesses the required resource and deletes the recorded entry once use of the resource has terminated. Access to resources is restricted according to priority levels assigned to the various computers and by a virtual use log within the access log. A system operator can create records in the virtual use log indicating a non-existent use of network resources. Depending upon its assigned priority, each computer may scan portions of the virtual use log and locate conflicting entries which effectively prohibit the computer from accessing the identified resource.

Claims

1. A network, comprising:

a plurality of computing devices;

a plurality of resources;

storage means containing data defining an access log;

a communications channel permitting each computing device to access each of the resources and the storage means for data transfer;

each computing device being adapted to access a required one of the resources according to a resource accessing procedure comprising;

a. recording an entry in the access log identifying the required resource prior to any accessing of the required resource;

b. scanning the access log prior to any accessing of the required resource to locate any conflicting entry identifying the required resource;

c. terminating the resource accessing procedure in response to any conflicting entry located during the scanning of the access log;

d. accessing the required resource in response to the absence of any conflicting entry in the access log;

e. deleting the recorded entry when any accessing of the required resource by the computing device is finished.

2. The network of claim 1 in which the said scanning of the access log is performed subsequent to the recording of the entry and in which the said terminating of the resource accessing procedure includes deleting the recorded entry.

3. The network of claim 2 in which the resource accessing procedure comprises a preliminary scanning of the access log prior to recording the entry in the access log to locate any conflicting entry and terminating the resource accessing procedure without accessing the required resource in response to any conflicting entry located during the preliminary scanning.

4. The network of claim 1 adapted to restrict access to any one of the resources according to priority levels assigned to each computing device, in which:

the access log includes a multiplicity of storage locations defining an actual use log and a multiplicity of storage locations defining a virtual use log;

each computing device is adapted to record any entry identifying a required resource only in the actual use log;

each computing device is adapted to recognize a priority level associated with the computing device;

each computing device is adapted to scan the actual use log and depending on the priority level assigned to the computing device to scan the virtual use log whenever scanning the access log to locate conflicting entries.

5. The network of claim 4 in which at least one of the computing devices is adapted to record entries in the virtual use log and to permit selective recording of a virtual use of the resources in the storage locations associated with the virtual use log.

6. The network of claim 1 in which:

the access log comprises a first multiplicity of storage locations, each computing device being uniquely associated with one of the first multiplicity of storage locations;

each computing device is adapted to calculate the location of the associated storage location according to a predetermined formula and to record an entry identifying a requirement for a single resource only at the calculated location.

7. The network of claim 6 adapted to permit each computing device to access multiple resources among the plurality of resources contemporaneously, in which:

the access log comprises a second multiplicity of storage locations defining a multiple entry log identified with a predetermined resource code;

the resource accessing procedure of each computing device includes a multiple resource accessing procedure initiated in response to a requirement for access to multiple resources, the multiple resource accessing procedure comprising;

a. recording a sign-on entry in the associated storage location identifying the multiple entry log with the predetermined resource code prior to recording any entries in the multiple entry log;

b. scanning the first multiplicity of storage locations for a conflicting sign-on entry identifying the multiple entry log;

c. desisting from recording entries in the multiple entry log and from accessing the multiple resources in response to any conflicting sign-on entry located during the scanning for a conflicting sign-on entry;

d. scanning the access log for conflicting resource entries identifying the multiple resources;

e. recording a plurality of resource entries in the multiple entry log identifying the multiple resources and then deleting the sign-on entry and accessing the multiple resources, in the event that no conflicting resource entries are located during the scanning for conflicting resource entries;

f. terminating the multiple resource accessing procedure in the event that a conflicting resource entry is located during the scanning for conflicting resource entries;

g. deleting the recorded plurality of resource entries when any accessing of the multiple resources by the computing device is finished.

8. The network of claim 7 in which the scanning for conflicting sign-on entries is performed subsequent to the recording of the sign-on entry and in which the recorded sign-on entry is deleted and the multiple resource accessing procedure is terminated in response to location of any conflicting sign-on entry.

9. The network of claim 7 in which the multiple resource accessing procedure comprises a preliminary scanning of the first multiplicity of storage locations prior to recording the sign-on entry to locate any conflicting sign-on entry and terminating the multiple resource accessing procedure in the event that a conflicting sign-on entry is located.

10. The network of claim 7 in which the scanning of the access log for conflicting resource entries is performed subsequent to the recording of the plurality of resource entries and the terminating of the multiple resource access procedure in the event that a conflicting resource entry is located comprises deleting the plurality of resource entries.

11. The network of claim 10 in which the multiple resource accessing procedure comprises the additional step of scanning the access log prior to recording the plurality of resource entries to locate any conflicting resource entry and thereupon terminating the multiple resource access procedure in the event that any conflicting resource entry is located.

12. The network of claim 1 in which:

the storage means comprises a plurality of storage units, each of the storage units being associated with and accessible for data transfer by a different one of the plurality of computing devices;

a plurality of duplicate copies of the access log is stored in each of the plurality of storage units, one of the plurality of duplicate copies of the access log being associated with each of the computing devices;

each computing device is adapted;

a. to scan, record entries in, and delete entries from the associated duplicate copy of the access log during the resource accessing procedure;

b. to transmit a modification message to each of the other computing devices along the communications channel indicating each entry recorded and deleted from the associated duplicate copy during the resource accessing procedure of the computing device;

c. to modify the associated duplicate copy of the access log in response to each modification message received from the other computing devices.

13. The network of claim 1 in which:

the storage means comprises a plurality of storage units, each of the storage units being associated with and accessible for data transfer by a different one of the plurality of computing devices;

a plurality of duplicate copies of the access log is stored in each of the plurality of storage units, one of the plurality of duplicate copies of the access log being associated with each of the computing devices;

each computing device is adapted;

a. to scan, record entries in, and delete entries from the associated duplicate copy of the access log during the resource accessing procedure;

b. to transmit a modification message to each of the other computing devices along the communications channel indicating each entry recorded and deleted from the associated duplicate copy during the resource accessing procedure of the computing device;

c. to modify the associated duplicate copy of the access log in response to each modification message received from each of the other computing devices.

14. A network, comprising:

a plurality of computing devices;

a plurality of resources;

storage means storing data defining an access log;

a communications channel permitting each computing device to access each of the resources and the storage means for data transfer;

each computing device being adapted to access a required one of the resources according to a resource accessing procedure comprising;

a. recording an entry in the access log identifying the required resource;

b. scanning the access log subsequent to recording the entry to locate any conflicting entry identifying the required resource;

c. terminating the resource accessing procedure without accessing the required resource in the event that a conflicting entry is located, the terminating including deleting the recorded entry;

d. accessing the required resource in the event that a conflicting entry is not located and deleting the recorded entry when the computing device discontinues the accessing of the required resource.

15. The network of claim 14 adapted to restrict access to any one of the resources according to priority levels assigned to each computing device, in which:

the access log includes a multiplicity of storage locations defining an actual use log and a multiplicity of storage locations defining a virtual use log;

each computing device is adapted to record any entry identifying a required resource only in the actual use log;

each computing device is adapted to recognize a priority level associated with the computing device;

each computing device is adapted to scan the actual use log and depending on the priority level assigned to the computing device to scan the virtual use log whenever scanning the access log to locate conflicting entries.

16. A network, comprising:

a plurality of computing devices;

a plurality of peripherals;

storage means containing data defining an access log;

a communications channel permitting each computing device to access each of the peripherals and the storage means for data transfer;

each computing device having an input device permitting a user to select a peripheral for data transfer between the computing device and the selected peripheral and being adapted to respond to selection of the selected peripheral according to a peripheral accessing procedure comprising;

a. recording an entry in the access log identifying the selected peripheral prior to any accessing of the selected peripheral;

b. scanning the access log prior to any accessing of the selected peripheral to locate any conflicting entry identifying the selected peripheral;

c. terminating the peripheral accessing procedure in response to any conflicting entry located during the scanning of the access log;

d. accessing the selected peripheral in response to the absence of any conflicting entry in the access log;

e. deleting the recorded entry when any accessing of the selected peripheral by the computing device is finished.

17. The network of claim 16 in which the said scanning of the access log is performed subsequent to the recording of the entry and in which the said terminating of the peripheral accessing procedure includes deleting the recorded entry.

18. The network of claim 17 in which the peripheral accessing procedure comprises a preliminary scanning of the access log prior to recording the entry in the access log to locate any conflicting entry and terminating the peripheral accessing procedure without accessing the selected peripheral in response to any conflicting entry located during the preliminary scanning.

19. The network of claim 16 adapted to restrict access to any one of the peripherals according to priority levels assigned to each computing device, in which:

the access log includes a multiplicity of storage locations defining an actual use log and a multiplicity of storage locations defining a virtual use log;

each computing device is adapted to record any entry identifying a selected peripheral only in the actual use log;

each computing device is adapted to recognize a priority level associated with the computing device;

each computing device is adapted to scan the actual use log and depending on the priority level assigned to the computing device to scan the virtual use log whenever scanning the access log to locate conflicting entries.

20. The network of claim 19 in which at least one of the computing devices is adapted to record entries in the virtual use log and to permit selective recording of a virtual use of the peripherals in the storage locations associated with the virtual use log.

21. The network of claim 16 in which:

the access log comprises a first multiplicity of storage locations, each computing device being uniquely associated with one of the first multiplicity of storage locations;

each computing device is adapted to calculate the location of the associated storage location according to a predetermined formula and to record an entry identifying a requirement for a single peripheral only at the calculated location.

22. The network of claim 21 adapted to permit each computing device to access multiple peripherals among the plurality of peripherals contemporaneously, in which:

the access log comprises a second multiplicity of storage locations defining a multiple entry log identified with a predetermined peripheral code;

the peripheral accessing procedure of each computing device includes a multiple peripheral accessing procedure initiated in response to a requirement for access to multiple peripherals, the multiple peripheral accessing procedure comprising;

a. recording a sign-on entry in the associated storage location identifying the multiple entry log with the predetermined peripheral code prior to recording any entries in the multiple entry log;

b. scanning the first multiplicity of storage locations for a conflicting sign-on entry identifying the multiple entry log;

c. desisting from recording entries in the multiple entry log and from accessing the multiple peripherals in response to any conflicting sign-on entry located during the scanning for a conflicting sign-on entry;

d. scanning the access log for conflicting peripheral entries identifying the multiple peripherals;

e. recording a plurality of peripheral entries in the multiple entry log identifying the multiple peripherals and then deleting the sign-on entry and accessing the multiple peripherals, in the event that no conflicting peripheral entries are located during the scanning for conflicting peripheral entries;

f. terminating the multiple peripheral accessing procedure in the event that a conflicting peripheral entry is located during the scanning for conflicting peripheral entries;

deleting the recorded plurality of peripheral entries when any accessing of the multiple peripherals by the computing device is finished.

23. The network of claim 22 in which the scanning for conflicting sign-on entries is performed subsequent to the recording of the sign-on entry and in which the recorded sign-on entry is deleted and the multiple peripheral accessing procedure is terminated in response to location of any conflicting sign-on entry.

24. The network of claim 23 in which the scanning of the access log for conflicting peripheral entries is performed subsequent to the recording of the plurality of peripheral entries and the terminating of the multiple peripheral access procedure in the event that a conflicting peripheral entry is located comprises deleting the plurality of peripheral entries.

25. The network of claim 24 in which the multiple peripheral accessing procedure comprises the additional step of scanning the access log prior to recording the plurality of peripheral entries to locate any conflicting peripheral entry and thereupon terminating the multiple peripheral access procedure in the event that any conflicting peripheral entry is located.

26. The network of claim 22 in which the multiple peripheral accessing procedure comprises a preliminary scanning of the first multiplicity of storage locations prior to recording the sign-on entry to locate any conflicting sign-on entry and terminating the multiple peripheral accessing procedure in the event that a conflicting sign-on entry is located.

27. The network of claim 16 in which:

the storage means comprises a plurality of storage units, each of the storage units being associated with and accessible for data transfer by a different one of the plurality of computing devices;

a plurality of duplicate copies of the access log is stored in each of the plurality of storage units, one of the plurality of duplicate copies of the access log being associated with each of the computing devices;

each computing device is adapted;

a. to scan, record entries in, and delete entries from the associated duplicate copy of the access log during the resource accessing procedure;

b. to transmit a modification message to each of the other computing devices along the communications channel indicating each entry recorded and deleted from the associated duplicate copy during the resource accessing procedure of the computing device;

c. to modify the associated duplicate copy of the access log in response to each modification message received from each of the other computing devices.

28. A network:

a plurality of computing devices, each computing device being operably coupled to a different one of a plurality of storage units, each storage unit containing data defining a copy of an access log which copy is associated with the computing device coupled to the storage unit;

a communications channel permitting each computing device to access each of the resources and each of the other computing devices for data transfer;

each computing device being adapted to access a required one of the resources according to a resource accessing procedure comprising;

a. scanning the associated copy of the access log prior to any accessing of the required resource to locate any conflicting entry identifying the required resource;

b. terminating the resource accessing procedure in response to any conflicting entry located during the scanning of the associated copy of the access log;

c. accessing the required resource in response to the absence of any conflicting entry in the associated copy of the access log;

d. recording an entry identifying the required resource in the associated copy of the access log prior to any accessing of the required resource and transmitting a message corresponding to the recorded entry along the communications channel to each of the other computing devices;

e. deleting the recorded entry from the associated copy of the access log when any accessing of the required resource by the computing device is finished and transmitting a message along the communications channel to each of the other computing devices indicating deletion of the recorded entry;

each of the computing devices being adapted to respond to each message received from each of the other computing devices by recording and deleting entries in the associated copy of the access log according to the message received such that the copies of the access log associated with the computing devices remain substantially identical.