Distributed method of and system for maintaining application program security

• US 6,122,741 A
• Filed: 09/19/1997
• Issued: 09/19/2000
• Est. Priority Date: 09/19/1997
• Status: Expired due to Term

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Communications Corporation (Verizon Communications Inc.)
• Inventors: Patterson, David M., Williams, Eugene E.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Baderman, Scott T.
• Application Number:
  US08/934,092
• Time in Patent Office: 1,096 Days
• Field of Search: 713/200, 713/201, 713/202, 707/9, 709/229, 380/23, 380/25
• US Class Current: 726/17
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A method of and system for managing access by a plurality of users to a plurality of application programs by maintaining a security database accessible by each of said application programs. In response to an attempted access to one of the application programs by one of the users, the application queries the security database for access information for the user. In response to the query, the security database returns access information to said the application program. The application program limits use of the application program-by the user according to the access information returned from the security database.

Claims

1. A method of managing access by a plurality of users to a plurality of application programs, which comprises the computer implemented steps of:

maintaining a security database accessible by each of said application programs, comprising the step of displaying to a security administrator a list of users in response to a logon by the security administrator;

in response to a logon to one of said application programs by one of said users, querying said security database for access information for said one user;

in response to selection of a displayed user, displaying a list of application programs available to the selected user;

in response to selection of a displayed application program, displaying a list of rights assigned to said selected user for the selected application;

in response to a query, returning access information to said one application program;

limiting use of said one application program by said one user according to access information returned from said security database; and

in response to selection of a displayed application program, displaying a list of rights available for said selected application program and unassigned to said selected user.

2. The method as claimed in claim 1, wherein said step of limiting use of said one application program by said one user includes the computer implemented step of limiting functionality of said one application program according to access information returned from said security database.

3. The method as claimed in claim 2, wherein said step of limiting functionality of said one application program includes the computer implemented step of disabling user interface features according to access information returned from said security database.

4. The method as claimed in claim 1, wherein said security database maintains for each application program a list of rights.

5. The method as claimed in claim 4, wherein said step of maintaining access information includes the computer implemented step of maintaining for each user a list of assigned rights selected from the list of rights for each application program.

6. The method as claimed in claim 5, wherein said step of returning access information includes the computer implemented step of returning the list of assigned rights for said one user for said one application program.

7. The method as claimed in claim 1, including the computer implemented steps of:

in response to selection of a right from said list of rights assigned to said selected user for the selected application;

deleting said selected right from said list of rights assigned to said selected user for the selected application; and

,

displaying said selected right in said list of rights available for said the selected application program and unassigned to said selected user.

8. The method as claimed in claim 1, including the computer implemented steps of:

in response to selection of a right from said list of rights available for said selected application program and unassigned to said selected user;

deleting said selected right from said list of rights available for said the selected application program and unassigned to said selected user; and

,

displaying said selected right in said list of rights assigned to said selected user for the selected application.

9. The method as claimed in claim 1, wherein said step of maintaining said security database includes the computer implemented step of:

defining for each application program a set of rights.

10. The method as claimed in claim 9, wherein said step of maintaining said security database includes the computer implemented step of:

assigning rights from said sets of rights to users.

11. The method as claimed in claim 9, wherein said step of maintaining said security database includes the computer implemented step of:

defining templates for selected application programs, each template comprising a subset of rights for a selected application program.

12. The method as claimed in claim 11, including the step of:

assigning a template to a user.

13. The method as claimed in claim 11, including the step of:

assigning a template to a predefined group of users.

14. A system, which comprises:

a security database;

a plurality of application program clients, each of said application program clients including means for accessing said security database, and each of said application program clients including means for limiting program use by a user according to information returned from said security database; and

,

at least one security administration client, said security administration client including means for maintaining said security database comprising means for displaying to said security administrator a list of users;

means for displaying a list of applications programs available to a selected user;

means for displaying a list of rights assigned to said selected user for a selected application; and

means for displaying a list of rights available for said selected application program and unassigned to said selected user.

15. The system as claimed in claim 14, wherein said means limiting use by a user includes means for limiting functionality of said application program client according to said information returned from said security database.

16. The system as claimed in claim 15, wherein said means for limiting functionality of said application program client includes means for disabling user interface features according to said information returned from said security database.

17. The system as claimed in claim 14, including:

means, responsive to selection of a right from said list of rights assigned to said selected user for the selected application, for;

deleting said selected right from said list of rights assigned to said selected user for the selected application; and

,

displaying said selected right in said list of rights available for said the selected application program and unassigned to said selected user.

18. The system as claimed in claim 14, including:

means, responsive to selection of a right from said list of rights available for said selected application program and unassigned to said selected user, for;

deleting said selected right from said list of rights available for said the selected application program and unassigned to said selected user; and

,

displaying said selected right in said list of rights assigned to said selected user for the selected application.