System for automatically transferring access authorization of third node to first node even through first node is not previously authorized to access function of second node in computer network

• US 5,778,176 A
• Filed: 10/08/1996
• Issued: 07/07/1998
• Est. Priority Date: 06/21/1991
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Heite, Reinhard, Eberle, Herbert, Geihs, Kurt, Hollberg, Ulf
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US08/727,208
• Time in Patent Office: 637 Days
• Field of Search: 395/200.2, 395/200.6, 395/200.9, 395/200.11, 395/200.12
• US Class Current: 709/227
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A computer network, having at least three nodes for implementing predetermined functions, comprises an OBJECT PASSING AGENT (OPA) storing the access authorizations of the individual nodes relative to each other. By means of calls (passing, returned), the stored access authorizations may be modified. With the aid of a further call (inquire), access authorizations may be verified. The desired access authorizations are defined by the user in the interface descriptions of the individual nodes. These descriptions are used by a compiler to generate the previously mentioned calls for modifying or verifying access authorizations. To permit a node to access the function of another node, an access authorization to that effect (passing) is stored in OPA. Prior to implementation, each access is verified (inquire). Upon completion of the access, the access authorization in OPA is erased (returned). These calls are handled automatically, ensuring that node access operations are readily implemented.

Claims

1. Computer network comprising:

at least a first, a second, and third computer nodes interconnected for communication

computer means for performing at least one function in the second node,

means for the third node to access the function of the second node

computer means for performing at lest one function in the third node which requires accessing the second node,

means for the first node to access the function of the second node, and

agent means for automatically storing an access authorization of the first node to access the second node and for automatically storing a transfer from the first node to the third node of access authorization to provide access for the second node to access the function of the third node to respond to the access of the first node to the function of the second node.

2. The computer network of claim 1, further comprising:

means for a call signal to transfer the access authorization.

3. The computer network of claim 1, further comprising:

means for a return call signal to terminate the transferred access authorization.

4. The computer network of claim 1, further comprising:

means for verifying access authorization in response to a call signal.

5. The computer network of claim 1, in which,

the agent means are accommodated in a fourth node, and

further comprising means for transmitting call signals between different nodes.

6. The computer network of claim 1, further comprising:

means for a call signal to transfer access authorization on a limited scale.

7. The computer network of claim 1, further comprising:

means for simultaneously transferring the access authorization to several nodes.

8. The computer network of claim 1, further comprising:

means for transferring the access authorization in several steps.

9. A method of operating a computer network with at least a first, a second, and a third computer nodes and means for performing functions comprising the steps:

automatically storing authorization for the first node to access functions on the second node,

accessing a function from the first node, on the third node that requires the third node to automatically access a function on the second node,

automatically modifying the access authorization of the third node, for the third node to access the function of the second node, in response to the access of the first node to the function of the third node and depending on the access authorization of the first node,

automatically accessing, from the third node, the function of the second node, and

automatically verifying the access authorization of the third node to access the second node.

10. The method of claim 9, in which

functions of one node are accessed by another node by call signals which are automatically transmitted over the network.

11. The method as claimed in claim 9, in which,

the access is modified and access is verified by call signals transmitted between different nodes.