Method for controlling access to a computer resource based on a timing policy

• US 5,564,016 A
• Filed: 09/29/1995
• Issued: 10/08/1996
• Est. Priority Date: 12/17/1993
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Korenshtein, Roni
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Palys, Joseph E.
• Application Number:
  US08/536,603
• Time in Patent Office: 375 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 395/490, 395/479, 380/23
• US Class Current: 726/3
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method for controlling access to a resource running on a host computer by one or more users which uses a timing policy to control when a current authorized user can be replaced by a new authorized user. The method comprises the steps of scanning a first list to verify that the new user is on the first list, scanning a second list to determine if a current user can be replaced without violating the timing policy, and granting the new user access to the resource if the timing policy is not violated. The method can be used to control access to an application program running on a file server in a local area network.

Claims

1. A method for controlling access to a computer resource running on a host computer comprising the steps of:

a) in response to a request from a new user having a new user identification code X to access a computer resource associated with a host computer, calling a log table having N entry slots from a memory location associated with a host computer, with each of the N entry slots being filled with an entry comprised of the form (u,t), where u is a user identification entry for a user u, and t corresponds to a time at which the user u accessed the computer resource;

b) using a clock associated with the host computer to generate a current time CT;

c) calling a policy enforcement module from the memory location associated with the host computer, the policy enforcement module specifying a time condition T between the time t and the current time CT that must be satisfied before access to the computer resource will be granted to the new user not having an entry in the log table;

d) comparing the current time CT to at least one of the N entries in the log table referred to as (y,t1) to determine a time period between the current time CT and a time t1, where y is a user identification entry for a user y, and t1 corresponds to a time at which the user y accessed the computer resource; and

e) denying the new user access to the computer resource if the time period does not satisfy the time condition T.

2. The method of claim 1 further comprising the step of:

f) replacing the entry (y,t1) with an entry (X,CT) if the time condition T is satisfied.

3. The method of claim 1 wherein the host computer is a file server in a local area network.