Method and system for advanced role-based access control in distributed and centralized computer systems

• US 5,911,143 A
• Filed: 08/14/1995
• Issued: 06/08/1999
• Est. Priority Date: 08/15/1994
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lingenfelder, Christoph, Lorenz, Sven, Gligor, Virgil, Deinhart, Klaus
• Primary Examiner(s): Kulik, Paul V.
• Assistant Examiner(s): Corrielus, Jean M.
• Application Number:
  US08/514,710
• Time in Patent Office: 1,394 Days
• Field of Search: 395/614, 395/650, 395/728, 395/800, 395/700, 707/103, 707/104, 707/9, 707/10
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

A method and system for registration, authorization, and control of access rights in a computer system. Access rights of subjects on objects in a computer system are controlled using parameterized role types that can be instantiated into role instances equivalent to roles or groups. The required parameters are provided by the subject of the computer system, e.g. by a person, a job position, or an organization unit. Furthermore, relative resource sets are instantiated into concrete resource sets and individual resources by using the same parameter values as for instantiating the role types. Authorization and control of access rights include capability lists providing the access rights of the subjects on the objects of a computer system on a per subject basis. Furthermore, access control lists are derived from capability lists, so that access rights of the subjects on the respective objects are provided.

Claims

1. A method for controlling access rights of at least one subject on at least one object in a computer system, wherein said subject is associated to at least one role, said method comprising the steps of:

controlling said access rights dependent on a membership of said subject to said role,

controlling said access rights dependent on a parameterized role type,

controlling said access rights dependent on at least one parameterized relative resource set,

representing said role by instantiating role instance by deriving said role instance from said role type,

said step of instantiating said role instance being based on providing a parameter value to said role type, said parameter value further characterizing said subject,

instantiating a concrete resource set by deriving said concrete resource set from said relative resource set,

said step of instantiating said concrete resource set being based on providing said parameter value to said relative resource set,

and providing said object as an element of said concrete resource sets.

2. The method according to claim 1, further comprising the step of:

providing said parameter value by said subject.

3. The method according to claim 2, wherein a job position within an organization unit of the organization of said subject is provided, said method further comprising the step of:

providing said parameter value by said job position or by said organization unit.

4. The method of claim 3, further comprising the step of:

combining said job position with at least one of said role types.

5. The method of claim 1, further comprising the step of:

associating at least one of said parameterized relative resource sets with said role types.

6. The method of claim 5, further comprising the step of:

performing a configuring step for deriving said role instances and for deriving said concrete resource sets and objects.

7. The method of claim 1, further comprising the steps of:

specifying capability list types associated with said role types; and

,

performing a configuring step for deriving a capability list associated with a corresponding role instance from said capability list types, said capability list providing said access rights of said role instance on said objects.

8. The method of claim 7, further comprising the step of:

modifying access control lists associated with said concrete resource sets and objects, said access control lists provide said access rights of said subjects on said object.

9. The method of claim 1, wherein

said role types are organized hierarchically.

10. A computer system for registration, authorization, and control of access rights of at least one subject on at least one object, said system comprising:

at least one parameterized relative resource set, and a concrete resource set, instantiated and derived from said relative resource set, and said object being an element of said concrete resource set, and

a parameterized role type for controlling said access rights, and

a role instance derived by instantiation from said role type and providing said subject a parameter, and

a capability list derived by instantiation from a capability list type, said capability list being associated with said role instance and with said subject and providing said access rights of said subject on said object, and

an access control list for said object providing said access rights of subjects on said object, and

means for deriving said access control lists of said objects from capability lists associated with subjects, and

means for deriving said access control lists during a configuring step of said system.

11. The system according to claim 10, further comprising means for deriving and generating necessary user accounts from locations of objects in said capability lists.