Distributed data structures for authorization and access control for computing resources

• US 7,331,058 B1
• Filed: 12/16/1999
• Issued: 02/12/2008
• Est. Priority Date: 12/16/1999
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gladney, Henry M.
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US09/465,514
• Time in Patent Office: 2,980 Days
• Field of Search: 713200-202, 713154-155, 713160-161, 713165-170, 713/150, 713/153, 713/164, 713/182, 711100-105, 709314-315, 709/223, 709/225, 709200-201, 709/229, 709/232, 707 9- 10, 707/103.R, 707/1, 707/100, 707/100.X, 707/200, 705/57, 705/58, 705/18, 705/52, 705/56, 705/67, 705/78, 705/1, 705/44, 380201-202, 380/241, 726 2- 5, 726/8, 726/18, 726/27, 726/30, 455/463
• US Class Current: 726/2
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

The invention relates to using a universally unique identifier in a database to uniquely identify, both within and outside of the database system, a user. A storage system, according to the invention, includes a first storage area having an object stored therein; and a second storage area having stored therein an object identifier that identifies the object. The object identifier is unique within and outside of the storage system, and can be a Universal Unique Identifier (UUID). The invention also relates methods for storing and retrieving objects identified based on the unique identifier.

Claims

1. An information storage management system in a first administrative domain administered by a first organization, comprising:

a collection of stored objects in the first administrative domain administered by the first organization;

an access control unit in the first administrative domain administered by the first organization for determining if a requester is authorized to access a protected object stored in the collection in the first administrative domain administered by the first organization;

a resource manager connected to the access control unit and to a communications channel;

wherein the resource manager receives a user'"'"'s request for access to the protected object in the first administrative domain administered by the first organization, the request including a globally unique identifier for the user requesting the access, and in response to the user'"'"'s request, the resource manager sends over the communications channel to an external storage management system in a second administrative domain administered by a second organization that is different from the first organization, a resource manager request for information about the user, the resource manager request including the globally unique identifier; and

wherein the resource manager upon receiving a response to the resource manager request from the external storage management system passes the user information to the access control unit in the first administrative domain administered by the first organization; and

wherein responsive to the user information the access control unit determines whether to authorize the user for access to the protected object.

2. The information storage management system of claim 1, wherein the globally unique identifier is a Universal Unique Identifier (UUID).

3. The information storage management system of claim 1, wherein the user information is organization information indicating whether the user is a member of an organization.

4. An information storage management system in a first administrative domain administered by a first organization, comprising:

a collection of stored objects in the first administrative domain administered by the first organization;

an access control unit in the first administrative domain administered by the first organization for determining if a requestor is authorized to access a protected object stored in the collection in the first administrative domain administered by the first organization;

a resource manager connected to the access control unit and to a communications channel;

wherein the resource manager receives a user'"'"'s request for access to the protected object in the first administrative domain administered by the first organization, the request including a globally unique identifier for the user requesting the access, and in response to the user'"'"'s request the resource manager resolves the globally unique identifier to a user identifier recognized by an external storage management system in a second administrative domain administered by a second organization that is different from the first organization, the resource manager sending to the external storage management system a resource manager request for information about the user, the resource manager request including the resolved user identifier; and

wherein the resource manager upon receiving a response to the resource manager request from the external storage management system passes the user information to the access control unit in the first administrative domain administered by the first organization; and

wherein responsive to the user information the access control unit determines whether to authorize the user for access to the protected object.

5. The information storage management system of claim 4, wherein the globally unique identifier is a Universal Unique Identifier (UUID).

6. The information storage management system of claim 4, wherein the user information is organization information indicating whether the user is a member of an organization.

7. The information storage management system of claim 4, wherein the resource manager resolves the globally unique identifier by using a name server.