Managing user access of distributed resources on application servers

• US 7,249,176 B1
• Filed: 04/30/2001
• Issued: 07/24/2007
• Est. Priority Date: 04/30/2001
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Radhakrishnan, Sanjeev, Salas, Jonathan C.
• Primary Examiner(s): Flynn; Nathan J.
• Assistant Examiner(s): SIDDIQI, MOHAMMAD A
• Application Number:
  US09/845,457
• Time in Patent Office: 2,276 Days
• Field of Search: 709/229, 709/223, 709/224, 709/203, 709/225, 709/227, 709/201, 713/200, 713/201, 713/150, 713/155, 705/52, 707/1, 707/9, 707/10, 717/178, 725/25, 725/29, 726/1, 726/3, 726/4, 726/10
• US Class Current: 709/225
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method and system to manage user access to resources and computing tasks on servers located on a network. The preferred embodiments of this system would enable a resource provider to manager user access to resources based on user specific criteria and resource specific criteria. The invention creates user associated access session(s) and generates tokens corresponding to such access session(s) to allow user access. The system is able to manage any type or any combination of licensing criteria, to manage different licensing criteria associated with the same user, to manage different licensing criteria associated with the same resource, and to manage different licensing relationship among users and resources. The system is scalable as additional sets of license managers can be added to manage additional users and resources. Optionally, secondary access sessions are provided to users to allow for completion of a current task when initial access session(s) are depleted.

Claims

1. An apparatus, comprising:

a client coupled, via a network, to a plurality of resources, wherein said plurality of resources is located on an application server; and

a system configured to control access to said plurality of resources, the system including;

a database configured to store a first license policy type, a second license policy type, a first policy instance, and a second policy instance, wherein the first policy instance is generated using the first license policy type and a first user specific parameter and the second policy instance is generated using the second policy type and a second user specific parameter, wherein the first user specific parameter and the second user specific parameter are associated with a same user;

a license manager configured to generate a token using the following steps;

creating a first sub-token using the first policy instance;

creating a second sub-token using the second policy instance; and

combining the first sub-token and the second sub-token to generate the token,

wherein the token enables the user to access one of said plurality of resources; and

a token monitor configured to initiate and terminate access to said one of said plurality of resources according to said token, wherein the token monitor is located on said application server.

2. The apparatus of claim 1, wherein the token monitor comprises a criteria evaluator, wherein the criteria evaluator is configured to notify the token monitor when the first sub-token expires.

3. The apparatus of claim 2, wherein the criteria evaluator is configured to use a calendar to determine whether the first sub-token has expired.

4. The apparatus of claim 2, wherein the criteria evaluator is configured to use a counter to determine whether the first sub-token has expired.

5. The apparatus of claim 2, wherein the criteria evaluator is configured to use a timer to determine whether the first sub-token has expired.

6. The apparatus of claim 1, further comprising:

a secondary access database configured to generate a third sub-token using a third policy instance, wherein the third sub-token is created after the first sub-token has expired and the third sub-token enables the same user to access said one of said plurality of resources.

7. The apparatus of claim 1, wherein a notification to create a new policy instance is sent to the client after the first sub-token has expired.

8. The apparatus of claim 1, wherein the first policy type is one selected from the group consisting of by user, by usage, by client, by time, by date, and by resource.

9. The apparatus of claim 1, wherein the token monitor is further configured to attempt to renew the first sub-token after the first sub-token expires.

10. A method for managing access to a resource on a network comprising:

creating a first policy instance and a second policy instance, wherein the first policy instance is created using a first license policy type and a first user specific parameter and the second policy instance is created using a second policy type and a second user specific parameter, wherein the first user specific parameter and the second user specific parameter are associated with a same user;

verifying the first policy instance and the second policy instance by a licensing manager; and

generating a token by said license manager;

wherein the token enables the same user to access said resource, and

wherein the token is generated by;

creating a first sub-token using the first policy instance,

creating a second sub-token using the second policy instance, and

combining the first sub-token and the second sub-token to generate the token.

11. The method of claim 10, further comprising:

creating a third sub-token using a third policy instance, wherein the third sub-token is created after the first sub-token has expired and the third sub-token enables the same user to access the resource.

12. The method of claim 10, wherein the license manager allows access to the resource for a period of time and the token only allows access to the resource for a portion of the period of time.

13. The method of claim 12, further comprising:

generating a new token when the portion of the period of time expires and additional time from in the period of time remains.

14. The method of claim 10, further comprising:

notifying the user when the first sub-token expires; and

renewing, by the user, the first sub-token.

15. The method of claim 10, further comprising:

monitoring the first sub-token by a token monitor associated with the resource; and

terminating access to the resource when at least one selected from the group consisting of the first sub-token and the second sub-token expires.

16. The method of claim 10, wherein the first policy type is one selected from the group consisting of by user, by usage, by client, by time, by date, and by resource.