Method for performing group exclusion in hierarchical group structures

• US 5,220,604 A
• Filed: 09/28/1990
• Issued: 06/15/1993
• Est. Priority Date: 09/28/1990
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Digital Equipment Corporation (HP Inc.)
• Inventors: Gasser, Morrie, Kaufman, Charles W., Goldstein, Andrew C.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US07/589,924
• Time in Patent Office: 991 Days
• Field of Search: 380/3, 380/4, 380/23, 380/25, 380/30, 380/49, 364/222.5, 364/246.9, 364/955.3, 364/240.8, 364/246.6, 364/286.5, 340/825.3, 340/825.31, 340/825.34, 340/825.52
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: H04L 9/3249 using RSA or related signature schemes, e.g. Rabin scheme
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A method for denying a first group access to a system resource wherein a second group is selected such that the first group is a subgroup of the second group. Access is granted only to those members of the second group who do not derive their membership in the second group through their membership in the first group.

Claims

1. In a distributed computing system having a system resource,

(A) in which a plurality of principals are divided into a plurality of groups including a first group which is one subgroup of a second group which includes other subgroups;

and

(B) in which principals derive their membership in the second group through membership in at least one of the subgroups;

a method for denying principal'"'"'s solely in the first group access to the resource comprising the steps of;

(a) receiving a request from a principal for access to the system resource;

(b) determining whether the requesting principal is a member of one of the subgroups not the first group; and

(c) denying the requesting principal access to the resource if the principal is not a member of one of the other subgroups, whereby principal solely in the first group are denied access to the resource.

2. In a distributed computing system having a system resource,

(A) in which a plurality of principals are divided into a plurality of groups including a first group which is one subgroup of a second group which includes other subgroups;

and

(B) in which principals derive their membership in the second group through membership in at least one of the subgroups;

a method for denying principals solely in the first group access to the resource comprising the steps of;

(a) receiving a request from a principal for access to the system resource;

(b) determining whether the requesting principal derives its membership in the second group solely through its membership in the first group; and

(c) granting the requesting principal access to the resource if the principal does not derive its membership in the second group solely through membership in the first group.

3. The method of claim 2 including the step (d) of denying the principal access to the resource if it does derive its membership in the second group solely through its membership in the first group.