Information handling system, method, and article of manufacture including object system authorization and registration

• US 5,765,153 A
• Filed: 01/03/1996
• Issued: 06/09/1998
• Est. Priority Date: 01/03/1996
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nadalin, Anthony Joseph, Benantar, Messaoud, Blakley, George Robert III
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): Jung, David Yiuk
• Application Number:
  US08/582,271
• Time in Patent Office: 888 Days
• Field of Search: 395/601-615, 395/616-617, 395/621, 707/1-10, 707/200-206, 707/100-104, 370/254-463
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A system, method and article of manufacture, for improving object security in distributed object systems, in an information handling system employing object oriented technology, includes one or more processors, a storage system, a system bus, a display sub-system controlling a display device, a cursor control device, an I/O controller for controlling I/O devices, all connected by system bus an operating system such as the OS/2* operating system program (OS/2 is a registered trademark of International Business Machines Corporation), one or more application programs for executing user tasks and an object oriented control program, such as, DSOM Objects program, which is a commercially available product of International Business Machines Corporation, the object oriented control program including a system authorization policy (SAP) object, a system authorization oracle (SAO) object, and a system registration object (SRO). The SAP object encapsulates management of a resource authorization policy. It may also be used to retrieve security attributes of objects in order to perform access checking. An object'"'"'s security attribute includes the access control list (ACL) governing access to the object. The SAP object is also used to retrieve and manipulate user capabilities in an environment that is capability based for access authorization. A user capability enlists the object that the user has access to, along with the corresponding access types or permissions. A capability is the transpose of an access control list (ACL) in the global access matrix modeling user access to protected objects.

Claims

1. A method for improving system authorization and registration in an information handling system employing object oriented technology, comprising the steps of:

first building a system authorization policy object which encapsulates management of a resource authorization policy to an object oriented control program;

second building a system authorization oracle object which encapsulates the process of the decision making at access checking time; and

third building a system registration object which encapsulates management of a subject registry.

2. A method according to claim 1, wherein said first building step further comprises the step of:

retrieving security attributes of objects in order to perform access checking.

3. A method according to claim 1, wherein the second building step further comprises the step of:

isolating the system authorization oracle object from the system authorization policy object to make it independent from underlying policy registry implementation mechanisms and enforce system integrity.

4. A method according to claim 1, wherein the third building step further comprises the step of:

managing subject capability for environments that are capability based for authorization.

5. A computer readable medium comprising:

means for first building a system authorization policy object which encapsulates management of a resource authorization policy to an object oriented control program;

means for second building a system authorization oracle object which encapsulates the process of the decision making at access checking time; and

means for third building a system registration object which encapsulates management of a subject registry.

6. A computer readable medium, according to claim 5, wherein said searching means further comprises:

means for retrieving security attributes of objects in order to perform access checking.

7. A computer readable medium, according to claim 5, further comprising:

means for isolating the system authorization oracle object from the system authorization policy object to make it independent from underlying policy registry implementation mechanisms and enforce system integrity.

8. A computer readable medium, according to claim 5, further comprising:

means for managing subject capability for environments that are capability based for authorization.

9. A system, for improving object security, in an information handling system employing object oriented technology, comprising:

one or more processors;

a storage system;

one or more I/O controllers for controlling I/O devices;

a system bus interconnecting the processors, the storage system, and the I/O controllers;

a system control program controlling operation of the system;

one or more application programs for executing user tasks; and

an object oriented control program, the object oriented control program comprising

a system authorization policy object which encapsulates management of a resource authorization policy to the object oriented control program;

a system authorization oracle object which encapsulates a process of decision making at access checking time; and

a system registration object which encapsulates management of a subject registry.

10. A system, according to claim 9, further comprising:

means for first building the system authorization policy object;

means for second building the system authorization oracle object; and

means for third building the system registration object.

11. A system, according to claim 9, further comprising:

means for retrieving security attributes of objects in order to perform access checking.

12. A system, according to claim 9, further comprising:

means for isolating the system authorization oracle object from the system authorization policy object to make it independent from underlying policy registry implementation mechanisms and enforce system integrity.

13. A system, according to claim 9, further comprising:

means for managing subject capability for environments that are capability based for authorization.

14. A system, according to claim 9, further comprising:

a cursor control device connected to an I/O controller.

15. A system, according to claim 9, further comprising:

a display subsystem, connected to the system bus, for displaying visual representations of objects and other information.

16. A system, according to claim 9, further comprising:

a display subsystem, connected to an I/O controller, for displaying visual representations of objects and other information.