Dynamic binding of network identities to locally-meaningful identities in computer networks

• US 5,550,981 A
• Filed: 06/21/1994
• Issued: 08/27/1996
• Est. Priority Date: 06/21/1994
• Status: Expired due to Term

• Current Assignee: NCR Corporation (NCR Voyix Corporation)
• Original Assignee: AT&T Global Information Solutions Company (NCR Voyix Corporation)
• Inventors: Bauer, Eric, Schaffer, Russel W.
• Primary Examiner(s): Geckil, Mehmet B.
• Application Number:
  US08/263,092
• Time in Patent Office: 798 Days
• Field of Search: 395/800, 395/726-729, 395/188.01, 395/200.06, 395/600
• US Class Current: 709/220
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A method and apparatus for binding network identities to locally-meaningful identities in a computer network is disclosed. A client computer is connected to a server computer that performs various functions requested by an operator of the client computer. The server computer assigns a temporary locally-meaningful identity to the operator of the client computer, and receives and responds to requests to perform functions from the client computer. The server computer triggers an ownership fault in response to a particular request received from the client computer. The particular request that triggers the ownership fault may be a request to create a file, a request to create a directory, a request to take ownership of an existing file, a request to take ownership of an existing directory, or other function. In response to the ownership fault, the server computer assigns a permanent local identity to the network identity associated with the operator of the client computer in response to the ownership fault depending on its security policy. The permanent local identity may be retrieved from a pool of previously allocated locally-meaningful identities maintained by the server computer, or the permanent local identity may be created as needed. Once the assignment occurs, the server computer maps the permanent local identity to the network identity by updating its records.

Claims

1. An apparatus for binding network identities to locally-meaningful identities in a network comprised of a plurality of computers, the apparatus comprising:

(a) a first computer;

(b) a second computer coupled to the first computer for performing functions requested by an operator of the first computer, the second computer comprising;

(1) means for assigning a temporary local identity to a username and domain name pair associated with the operator of the first computer;

(2) means for receiving and responding to requests from the first computer to perform functions;

(3) means for triggering an ownership fault in response to a particular request received from the assigned temporary local identity associated with the operator of the first computer; and

(4) means for assigning a permanent local identity to the network identity associated with the operator of the first computer in response to the ownership fault.

2. The invention as set forth in claim 1 above, wherein the means for assigning (4) comprises means for retrieving the permanent local identity from a pool of previously allocated locally-meaningful identities.

3. The invention as set forth in claim 2 above, wherein the means for assigning (4) further comprises means for creating additional permanent locally-meaningful identities, so that the pool of previously allocated locally-meaningful identities is maintained at an adequate level.

4. The invention as set forth in claim 1 above, wherein the means for assigning (4) comprises means for creating the permanent local identity when the ownership fault occurs.

5. The invention as set forth in claim 4 above, wherein the permanent local identity is related to the username and domain name pair.

6. The invention as set forth in claim 1 above, wherein the second computer further comprises means for updating its records to reflect the assignment of the permanent local identity.

7. The invention as set forth in claim 6 above, wherein the means for updating comprises means for mapping the username and domain name pair to the permanent local identity.

8. The invention as set forth in claim 1 above, wherein the particular request is selected from a group comprising a request to create a file, a request to create a directory, a request to take ownership of an existing file, a request to take ownership of an existing directory, a request to print a file, a request to control a print job, and a request to examine a print job'"'"'s status.

9. The invention as set forth in claim 1 above, wherein the second computer further comprises means for determining whether to perform the particular request according to a characteristic associated with the username and domain name pair.

10. The invention as set forth in claim 9 above, wherein the means for determining comprises means for denying the particular request and means for responding to the particular request by transmitting an appropriate error message to the first computer.

11. A method of binding network identities to locally-meaningful identities in a server computer, the method comprising the steps of:

(a) assigning a temporary local identity to a username and domain name pair associated with an operator of a client computer connected to the server computer;

(b) receiving and responding to requests from the client computer to perform functions;

(c) triggering an ownership fault in response to a particular request received from the assigned temporary local identity associated with the operator of the client computer; and

(d) assigning a permanent local identity to the network identity associated with the operator of the client computer in response to the ownership fault.

12. The invention as set forth in claim 11 above, wherein the assigning step (d) comprises the step of retrieving the permanent local identity from a pool of previously allocated locally-meaningful identities.

13. The invention as set forth in claim 12 above, wherein the assigning step (d) further comprises the step of creating additional permanent locally-meaningful identities, so that the pool of previously allocated locally-meaningful identities is maintained at an adequate level.

14. The invention as set forth in claim 11 above, wherein the assigning step (d) comprises the step of creating the permanent local identity when the ownership fault occurs.

15. The invention as set forth in claim 14 above, wherein the permanent local identity is related to the username and domain name pair.

16. The invention as set forth in claim 11 above, further comprising the step of updating records in the server computer to reflect the assignment of the permanent local identity.

17. The invention as set forth in claim 16 above, wherein the step of updating comprises the step of mapping the username and domain name pair to the permanent local identity.

18. The invention as set forth in claim 11 above, wherein the particular request is selected from a group comprising a request to create a file, a request to create a directory, a request to take ownership of an existing file, a request to take ownership of an existing directory, a request to print a file, a request to control a print job, and a request to examine a print job'"'"'s status.

19. The invention as set forth in claim 11 above, further comprising the step of determining whether to perform the particular request according to a characteristic associated with the username and domain name pair.

20. The invention as set forth in claim 19 above, wherein the step of determining comprises the steps of denying the particular request and responding to the particular request by transmitting an appropriate error message to the client computer.

21. A server computer, comprising:

(a) means for connecting to and communicating with a client computer;

(b) means for assigning a temporary local identity to a username and domain name pair associated with an operator of the client computer;

(c) means for receiving and responding to requests from the client computer to perform functions;

(d) means for triggering an ownership fault in response to a particular request received from the assigned temporary local identity associated with the operator of the client computer; and

(e) means for assigning a permanent local identity to the network identity associated with the operator of the client computer in response to the ownership fault.

22. The invention as set forth in claim 21 above, wherein the means for assigning (e) comprises means for retrieving the permanent local identity from a pool of previously allocated locally-meaningful identities.

23. The invention as set forth in claim 22 above, wherein the means for assigning (e) further comprises means for creating additional permanent locally-meaningful identities, so that the pool of previously allocated locally-meaningful identities is maintained at an adequate level.

24. The invention as set forth in claim 21 above, wherein the means for assigning (e) comprises means for creating the permanent local identity when the ownership fault occurs.

25. The invention as set forth in claim 24 above, wherein the permanent local identity is related to the username and domain name pair.

26. The invention as set forth in claim 21 above, wherein the server computer further comprises means for updating its records to reflect the assignment of the permanent local identity.

27. The invention as set forth in claim 26 above, wherein the means for updating comprises means for mapping the username and domain name pair to the permanent local identity.

28. The invention as set forth in claim 21 above, wherein the particular request is selected from a group comprising a request to create a file, a request to create a directory, a request to take ownership of an existing file, a request to take ownership of an existing directory, a request to print a file, a request to control a print job, and a request to examine a print job'"'"'s status.

29. The invention as set forth in claim 21 above, wherein the server computer further comprises means for determining whether to perform the particular request according to a characteristic associated with the username and domain name pair.

30. The invention as set forth in claim 29 above, wherein the means for determining comprises means for denying the particular request and means for responding to the particular request by transmitting an appropriate error message to the client computer.