Providing secure access for multiple processes having separate directories

• US 5,867,646 A
• Filed: 07/12/1996
• Issued: 02/02/1999
• Est. Priority Date: 07/12/1996
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Shakib, Darren A., Benson, Max L.
• Primary Examiner(s): DeCady, Albert
• Assistant Examiner(s): Elmore, Stephen C.
• Application Number:
  US08/679,007
• Time in Patent Office: 935 Days
• Field of Search: 395/186, 395/188.01, 395/609, 395/726, 395/729, 364/222.5, 364/286.4, 364/286.5, 380/4, 380/23
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A variety of processes, e.g., electronic mail, word processing, database applications, etc., reside on a system, e.g., an operating system. Independent levels of security are maintained for the different processes without requiring the user to pass a security test to gain access to each process. The system includes a directory of system identifiers assigned to users. Each process includes a directory of process-specific identifiers for users of that process. The system identifiers and process identifiers are associated in a predetermined manner. Therefore, a user may gain access to a process only when the user'"'"'s system identifier is associated with the desired process-specific identifier.

Claims

1. In a computer system having an operating system where users are assigned specific user IDs and where access to the computer system is controlled by a security system of the operating system that checks the validity of a password entered for a specific user ID, a method of providing secure access to subsequent processes or resources on the computer system without further challenging the user ID through the use of other password, comprising the steps of:

validating the identity of a user through the security system of the operating system by a security check requiring a user to enter a user ID and password, such that when the security check is complete the operating system allows said user entry onto the system and associates said user ID with said user;

requesting access, by said user, to a subsequent resource or process on the computer using a second user identifier having a format specific to said subsequent resource or process; and

performing a security check with out recourse to other passwords by determining if said user has privilege to access said subsequent resource or process by,

obtaining said User ID and determining whether said user ID can act as said second user identifier,

and if said user ID can act as said second user identifier, then granting access to subsequent resource or process,

and if not then denying access to said subsequent resource or process.

2. The method of claim 1, wherein determining whether said user ID can act as said second user identifier comprises checking a cross-reference table in which user IDs are associated with second user identifiers.

3. The method of claim 1, wherein the system comprises a client/server network.

4. The method of claim 1, wherein the subsequent resource or process comprises an electronic mail messaging system.

5. The method of claim 1, further comprising validating a second security test before granting access to the subsequent resource or process.

6. The method of claim 1, wherein the user ID and second user identifier are different.

7. The method of claim 1, further comprising associating an access level with a the second user identifier to identify the privileges that said user has with respect to the subsequent resource or process.

8. In a computer system having an operating system where users are assigned specific user IDs and where access to the computer system is controlled by a security system of the operating system that checks the validity of a password entered for a specific user ID, as an article of manufacture, a computer program system without further challenging the user ID through processes or resources on the computer system without further challenging the user ID through the use of other passwords comprising:

computer readable medium having computer executable instructions embodied thereon comprising;

means for validating the identity of a user through the security system of the operating system by a security check requiring a user to enter a user ID and password, such that when the security check is complete, the operating system allows said user entry onto the system and associates said user ID with said user;

means for requesting access, by said user to a subsequent resource or process on the computer using a second user identifier having a format specific to said subsequent resource or process; and

means for performing a security check without recourse to other passwords by determining if said user has privilege to access said subsequent resource or process by,

obtaining said user ID and determining whether said user ID can act as said second user identifier,

and if said user ID) can act as said second user identifier, then granting access to said subsequent resource or process,

and if not, then denying access to said subsequent resource or process.

9. The computer program product of claim 8, wherein means for determining whether said user ID can act as second user identifier comprises means for using a cross-reference table in which user IDs are associated with second user identifiers.

10. The computer program product of claim 8, wherein the system comprises client/server network.

11. The computer program product of claim 8, wherein the subsequent resource or process comprises an electronic mail messaging system.

12. The computer program product of claim 8, further comprising means for validating a second security test before granting access to the subsequent resource or process.

13. The computer program product of claim 8, wherein the user ID and second user identifier are different.

14. The computer program product of claim 8, further comprising means for associating an access level with the second user identifier to identify the privileges that said user has with respect to the subsequent resource or process.