System and method for securing network resources

• US 20060173999A1
• Filed: 08/07/2003
• Published: 08/03/2006
• Est. Priority Date: 08/07/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: Intelliden, Inc. (International Business Machines Corporation)
• Inventors: Ferrin, Daniel, Post, Ted, Rider, Kenneth D.
• Granted Patent: US 7,461,158 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for securing access to network resources are described. One embodiment includes an exemplary method for securing access to a network element and can include associating a network element with a set of data, and configuring a portion of the data to be responsive to a first subset of access rights. In accordance with other embodiments, an exemplary method and system provide for selection of an appropriate security to govern access by a user to network resources.

Claims

1. A method of securing access to an element of a network comprising:

associating the element with a set of data; and

configuring a portion of the data to be responsive to a first subset of access rights.

2. The method of claim 1 further comprising permitting a first type of access to the portion of the data if a first access right of the first subset of access rights is granted.

3. The method of claim 1 further comprising prohibiting a second type of access to the portion of the data if a second type of the first subset of access rights is denied.

4. The method of claim 2 wherein the first access right is one of a view access right, an add access right, a modify access right and a delete access right.

5. The method of claim 1 further comprising:

generating a request by a user to acquire a first type of access; and

determining whether to permit the first type of access.

6. The method of claim 5 further comprising associating at least the portion of the data with a first node of a hierarchical data structure.

7. The method of claim 6 further comprising:

defining a first security set as including the first subset of access rights associated with the user; and

associating the first security set with a second node of the hierarchical data structure,

wherein the second node is at a higher level of the hierarchical data structure than is the first node.

8. The method of claim 7 further comprising propagating the first subset of access rights through inheritance from the second node to the first node.

9. The method of claim 8 further comprising overriding the first subset of access rights inherited from the second node.

10. The method of claim 9 wherein overriding the first subset further comprises:

defining a second security set as including a second subset of access rights associated with the user;

associating the second security set with an intervening node of the hierarchical data structure; and

propagating the second subset of access rights to the first node,

wherein the intervening node is located at an intervening level between the second node and the first node.

11. The method of claim 7 further comprising generating a dynamic security set to apply to the access related to the first node.

12. The method of claim 11 further comprising:

defining a third security set as including a third subset of access rights associated with the user;

associating the third security set with a third node of the hierarchical data structure; and

forming the dynamic security set from the first and the third subsets of access rights.

13. The method of claim 12 wherein the user belongs to both a first group associated with the first security set and a second group associated with the second security set.

14. The method of claim 12 wherein the dynamic security set is formed by the taking the union of the first and the third subsets of access rights.

15. The method of claim 7 further comprising rejecting the request by the user.

16. The method of claim 15 wherein rejecting the request further comprises:

defining a fourth security set as including a fourth subset of access rights associated with the user;

associating the fourth security set with a fourth node of the hierarchical data structure; and

determining a first access right of at least one of the first and fourth subsets of access rights is denied.

17. The method of claim 16 wherein the first node resides in a first realm and the fourth node resides in a second realm.

18. The method of claim 1 wherein the set of data constitutes a document and the subset of the data is a portion of the document.

19. The method of claim 18 wherein the document is a configuration record.

20. The method of claim 1 wherein the subset of data includes one or more executable instructions.

21. The method of claim 1 wherein the element is a router.

26. The method of claim 21 wherein resolving the conflict further comprises:

determining that the at least two security sets are associated with two or more groups; and

generating a dynamic security set for selection as the appropriate security set.

27. The method of claim 26 wherein generating the dynamic security set comprises taking the union of each of the security sets associated with the at least two security sets, wherein the dynamic security set has increased access rights.

28. The method of claim 21 wherein resolving the conflict further comprises:

determining that the at least two security sets are associated with only one group and that the least two security sets are associated with higher-level nodes;

identifying one of the at least two security sets as having a more explicit path; and

selecting the identified security set as the appropriate security set.

29. The method of claim 21 wherein the specific access right can be any one of a view access right, an add access right, a modify access right and a delete access right.

30. The method of claim 21 wherein the access to the network element is requested by a user.

31. The method of claim 21 wherein the network element is a document.

32. The method of claim 21 wherein the network element is a portion of a document.

33. The method of claim 21 wherein the network element is a configuration record.

22. A method of selecting an appropriate security set of securing an access to a network element comprising:

discovering one or more security sets, each security set including a specific access right relevant to the access to the network element;

identifying at least two of the one or more security sets where the specific access right is in conflict;

determining whether each of the at least two security sets are associated with two or more groups; and

resolving the conflict between the at least two security sets.

23. The method of claim 22 wherein discovering the one or more security sets further comprises:

traversing a hierarchical data structure; and

determining for each security set an association with a node on the hierarchical data structure.

24. The method of claim 23 wherein resolving the conflict further comprises:

determining that the at least two security sets are associated with two or more realms;

analyzing each of the security sets associated with the nodes of each of the two or more realms to determine whether the specific access right exists; and

rejecting access if none of the security sets associated with at least one of the two or more realms includes the specific access right.

25. The method of claim 24 wherein resolving the conflict further comprises selecting a higher-level node from which to propagate the specific access right if all of the two or more realms includes the specific access right.

34. A system for securing an access to a network element comprising:

a security set repository configured to store one or more security sets, where a security set subset of the one or more security sets relate to a specific access right relevant to the access requested by a user, and further configured to maintain a hierarchical data structure having at least one node associated with at least one of the security set subset;

a directory configured to store one or more configuration records, where at least one configuration record is associated with the at least one node; and

a security manager configured to select an appropriate security set to govern a request of the user to access the at least one configuration record.

35. The system of claim 34 wherein the security manager further comprises:

a discovery module configured to locate the security set subset where the specific access right is in conflict; and

a resolution module configured to resolve the conflict between at least two security sets of the security set subset.

36. The system of claim 34 wherein the security manager further comprises a multiple-realm module configured to determine whether multiple realms are affected by the request of the user and further configured to reject the access if any of the security set subset relate to at least two or more realms that do not include the specific access right.

37. The system of claim 34 wherein the security manager further comprises a dynamic security set module configured to generate a dynamic security set by taking the union of at least two security sets from the security set subset.

38. The system of claim 34 wherein the security manager further comprises a explicit path module configured to generate the appropriate security set by determining that one of the security set subset has a more explicit path.