Access control in a hybrid environment

• US 9,032,484 B2
• Filed: 10/31/2011
• Issued: 05/12/2015
• Est. Priority Date: 10/31/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chambliss, David D., Knight, Joshua W., Kreuzenstein, Ronald K., Lee, John J., Ruddy, James A., Thompson, John G., Yudenfriend, Harry M.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US13/285,757
• Publication Number:
  US 20130111557A1
• Time in Patent Office: 1,289 Days
• Field of Search: 726/4, 709/202
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/54 Interprogram communication

Abstract

A heterogeneous computing system includes a first server module having a first operating system, a second server module communicatively coupled to the first server module, the second server module having a second operating system dissimilar to the first operating system, a data set accessible by the first server module and the second server module; and a process residing on the first server module, the process configured to grant access to the second server module, from the first server module, to the data set.

Claims

1. A computer program product including a non-transitory computer readable medium storing instructions for causing a computer to implement a heterogeneous operating system data access method, the method comprising:

receiving, in a first computing system having a first operating system, a request from a second computing system to access a data set, wherein the second computing system has a second operating system dissimilar to the first operating system;

preparing, by the first computing system, the data set for access by the second computing system;

determining, by the first computing system, characteristics of the data set;

passing the characteristics of the data set from the first computing system to the second computing system;

setting, by the first computing system, permissions for the second computing system to access the data set;

confirming, in the second computing system, that the second computing system has been granted access to the data set;

coordinating, in the second computing system, access to the data set;

granting the second computing system, by the first computing system, access to the data set, the access including a type of access and an extent of the type of access to which the second computing system can access the data set; and

notifying, from the second computing system to the first computing system, that the second computing system accessed the data set.

2. The computer program product as claimed in claim 1 wherein the second computing system is not authorized to access the data set prior to issuing the request to the first computing system to access the data set.

3. The computer program product as claimed in claim 2 wherein the first computing system is authorized to access the data set, and to permit the second computing system to access the data set.

4. The computer program product as claimed in claim 3 wherein the second computing system issues internal commands to identify and access the data set for applications residing on the second computing system.

5. The computer program product as claimed in claim 4 wherein the method further comprises removing, by the first computing system, permissions granted to the second computing system.

6. A heterogeneous computing system, comprising:

a first server module having a first operating system;

a second server module communicatively coupled to the first server module, the second server module having a second operating system dissimilar to the first operating system;

a data set accessible by the first server module and the second server module, wherein the data set is disposed on the first server module;

a first process residing on the first server module, the first process configured to grant permissions and access to the second server module, from the first server module, to the data set, the access including a type of access and an extent of the type of access to which the second server module can access the data set, and

a second process residing on the second server module, the second process configured to confirm that access to the data set has been granted to the second server module and to coordinate access to the data set;

wherein the first process is configured to receive a request from a second computing system to access a data set, prepare, the data set for access by the second computing system, determine characteristics of the data set, pass the characteristics of the data set from the first computing system to the second computing system, set permissions for the second computing system to access the data set, grant the second computing system access to the data set, and

wherein the second process is configured to notify the first computing system that the second computing system accessed the data set.

7. The system as claimed in claim 6 wherein the second computing system issues internal commands to identify and access the data set for applications residing on the second computing system.

8. The system as claimed in claim 6 wherein the first process is further configured to receive a notification that the data set has been accessed.

9. The system as claimed in claim 6 wherein the first process is further configured to remove granted permissions.

10. A heterogeneous operating system data access method, comprising:

receiving, in a first computing system having a first operating system, a request from a second computing system to access a data set, wherein the second computing system has a second operating system dissimilar to the first operating system;

preparing, by the first computing system, the data set for access by the second computing system;

determining, by the first computing system, characteristics of the data set;

passing the characteristics of the data set from the first computing system to the second computing system;

setting, by the first computing system, permissions for the second computing system to access the data set;

confirming, in the second computing system, that the second computing system has been granted access to the data set;

coordinating, in the second computing system, access to the data set;

granting the second computing system, by the first computing system, access to the data set, the access including a type of access and an extent of the type of access to which the second computing system can access the data set; and

notifying, from the second computing system to the first computing system, that the second computing system accessed the data set.

11. The method as claimed in claim 10 wherein the second computing system is not authorized to access the data set prior to issuing the request to the first computing system to access the data set.

12. The method as claimed in claim 11 wherein the first computing system is authorized to access the data set, and to permit the second computing system to access the data set.

13. The method as claimed in claim 12 wherein the second computing system issues internal commands to identify and access the data set for applications residing on the second computing system.

14. The method as claimed in claim 13 further comprising removing, by the first computing system, permissions granted to the second computing system.