Method and apparatus to support privileges at multiple levels of authentication using a constraining ACL
First Claim
1. A method for using ACLs (access control lists) to determine user privileges in a database, the method comprising:
- authenticating, by a computer, a user using an authentication method selected from a plurality of authentication methods corresponding to a plurality of authentication levels;
determining an authentication level of the selected authentication method, wherein the authentication level indicates a security strength of the selected authentication method, and wherein the authentication level corresponds to a user role associated with the user;
identifying an entry in a constraining ACL based on the determined authentication level, wherein the entry in the constraining ACL specifies a global security policy that is specific to the determined authentication level and applies to all applications interacting with the database;
receiving a request from the user to perform an operation on data;
identifying a child ACL, which specifies the user'"'"'s privileges;
establishing a constraining inheritance relationship between the child ACL and the constraining ACL, which involves requiring a check of the constraining ACL whenever the child ACL is checked; and
performing, by the computer, the operation on the data in response to determining that the operation is permitted based on the user role, the child ACL and the constraining ACL.
1 Assignment
0 Petitions
Accused Products
Abstract
Embodiments of the present invention provide systems and techniques for creating, updating, and using an ACL (access control list). A database system may include a constraining ACL which represents a global security policy that is to be applied to all applications that interact with the database. By ensuring that all ACLs inherit from the constraining ACL, the database system can ensure that the global security policy is applied to all applications that interact with the database. During operation, the system may receive a request to create or update an ACL. Before creating or updating the ACL, the system may modify the ACL to ensure that it inherits from the constraining ACL. In an embodiment, the system grants a privilege to a user only if both the ACL and the constraining ACL grant the privilege.
-
Citations
18 Claims
-
1. A method for using ACLs (access control lists) to determine user privileges in a database, the method comprising:
-
authenticating, by a computer, a user using an authentication method selected from a plurality of authentication methods corresponding to a plurality of authentication levels; determining an authentication level of the selected authentication method, wherein the authentication level indicates a security strength of the selected authentication method, and wherein the authentication level corresponds to a user role associated with the user; identifying an entry in a constraining ACL based on the determined authentication level, wherein the entry in the constraining ACL specifies a global security policy that is specific to the determined authentication level and applies to all applications interacting with the database; receiving a request from the user to perform an operation on data; identifying a child ACL, which specifies the user'"'"'s privileges; establishing a constraining inheritance relationship between the child ACL and the constraining ACL, which involves requiring a check of the constraining ACL whenever the child ACL is checked; and performing, by the computer, the operation on the data in response to determining that the operation is permitted based on the user role, the child ACL and the constraining ACL. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for using ACLs (access control lists) to determine user privileges in a database, the method comprising:
-
authenticating a user using an authentication method selected from a plurality of authentication methods corresponding to a plurality of authentication levels; determining an authentication level of the selected authentication method, wherein the authentication level indicates a security strength of the selected authentication method, and wherein the authentication level corresponds to a user role associated with the user; identifying an entry in a constraining ACL based on the determined authentication level, wherein the entry in the constraining ACL specifies a global security policy that is specific to the determined authentication level and applies to all applications interacting with the database; receiving a request from the user to perform an operation on data; identifying a child ACL, which specifies the user'"'"'s privileges; establishing a constraining inheritance relationship between the child ACL and the constraining ACL, which involves requiring a check of the constraining ACL whenever the child ACL is checked; and performing, by the computer, the operation on the data in response to determining that operation is permitted based on the user role, the child ACL and the constraining ACL. - View Dependent Claims (9, 10, 11, 12, 13)
-
-
14. A computer system that uses ACLs (access control lists) to determine user privileges in a database, the system comprising:
-
a processor; an authentication mechanism configured to authenticate a user using an authentication method selected from a plurality of authentication methods corresponding to a plurality of authentication levels; a determination mechanism configured to determine an authentication level of the selected authentication method, wherein the authentication level indicates a security strength of the selected authentication method, and wherein the authentication level corresponds to a user role associated with the user; a first ACL-identifying mechanism configured to identify an entry in a constraining ACL based on the determined authentication level, wherein the entry in the constraining ACL specifies a global security policy that is specific to the determined authentication level and applies to all applications interacting with the database; a receiving mechanism configured to receive a request from the user to perform an operation on data; a second ACL-identifying mechanism configured to identify a child ACL, which specifies the user'"'"'s privileges; an inheritance mechanism configured to establish a constraining inheritance relationship between the child ACL and the constraining ACL, which involves requiring a check of the constraining ACL whenever the child ACL is checked; and an operation mechanism configured to perform the operation on the data in response to determining that operation is permitted based on the user role, the child ACL and the constraining ACL. - View Dependent Claims (15, 16, 17, 18)
-
Specification