Automated generation on file access control system commands in a data processing system with front end processing of a master list

• US 5,627,967 A
• Filed: 05/30/1995
• Issued: 05/06/1997
• Est. Priority Date: 09/24/1991
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kelley, Edward E., Dauerer, Norman J.
• Primary Examiner(s): Coleman, Eric
• Application Number:
  US08/456,002
• Time in Patent Office: 707 Days
• Field of Search: 395/800, 395/600, 395/186, 395/187.01, 395/188.01
• US Class Current: 726/2
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

A front end is provided for an access controller for controlling access to a shared resource in a data processing system to contain a processed master list, in text form, of users to which access will be granted. The list of users may be edited by a simple editor or word processor. commands to the access controller are generated based upon a comparison of the processed master list and the edited master list. By storing access commands in the front end for the access controller, transparency of the access controller is provided to both users and the system authorization administrator.

Claims

1. A file access controller front end for an access controller of data processing system, said data processing system having a file access controller including a master file, said master file of said data processing system having a plurality of user/access lists, said file access controller front end being connected to said data processing system and including

means for storing a processed master list of authorized users corresponding to data in said user/access lists of said master file of said data processing system, said processed master list being stored seperately from said master file in text form and identifying the authorized users to which said data processing system will grant access,

means for detecting invalid and duplicate user/access authorizations in said processed master list,

means for editing said text of said processed master list to form an edited master list with said invalid and duplicated user/access authorizations remove therefrom, and

means for accessing said file access controller only subsequent to said editing of said text updating said user/access list of said file access controller of said data processing system and said processed master list in response to said edited master list to provide new user/access lists and new processed master list which conform to said edited master list.

2. An access controller front end as recited in claim 1, further including

means for generating at least one new user/access list corresponding to said edited master list, and

means for automatically generating commands for said access controller based on a comparison of a previous user/access list and said new user/access list.

3. An access controller front end as recited in claim 1, further including

means for specifying and storing at least one alias file corresponding to an authorized user identification in at least one of said processed master list and said edited master list, and

means for granting access to at least one file in said master file corresponding to said alias file in response to said authorized user identification.

4. An access controller front end as recited in claim 3, further including

means for generating at least one new user/access list and at least one new alias file corresponding to at least one of said edited master list and said stored alias file, and

means for automatically generating commands for said access controller based on a comparison of at least one previous user/access list with said new user/access list and said new alias file with said stored alias file.

5. A file access control system for a data processing system, said data processing system having at least a portion of a memory arranged as a plurality of mini-disks, each said mini-disk including a list of authorized users, said access control system including

means for creating a master list of authorized users of said data processing system,

means for creating a plurality of lists of authorized users for said plurality of mini-disks, at least one list of said plurality of lists corresponding to each mini-disk, from said master list,

means for creating a processed master list from said plurality of lists of authorized users of said mini-disks,

means for validating and editing said processed master list to form an edited master list, and

means for accessing said file access controller only subsequent to said validating and editing of said text updating a list of authorized users of a mini-disk said data processing system and said processed master list in response to said edited master list to provide new lists of authorized users and a new processed master list which conform to said edited master list.

6. A system as recited in claim 5, wherein said master list comprises a matrix of authorized user identifications and mini-disk identifications.

7. A method of altering access authorization of a data processing system which includes a file access controller and at least a portion of memory arranged as a plurality of mini-disks, each said mini-disk including a list of authorized users, said method including the steps of

validating and editing a master list of authorized users to form an edited master list,

creating a processed master list of authorized users for at least one mini-disk from said edited master list,

storing said list of authorized users for at least one mini-disk, and

accessing said file access controller only subsequent to said validating and editing of said list of authorized users of a mini-disk of said data processing system and said creation of said processed master list in response to said edited master list to provide a new list of authorized users and a new processed master list which conform to said edited master list.

8. A method as recited in claim 7, wherein said step of storing said list of authorized users for at least one mini-disk is performed in response to a further step of

entering a predetermined identification code at any terminal of said data processing system.

9. A method as recited in claim 7, wherein said step of storing said list of authorized users for at least one mini-disk includes a further step of

comparing said list of authorized users for said at least one mini-disk with a previously stored list, and

generating access authorization commands for granting or revoking access authorization is response to said comparing step.

10. A method as recited in claim 7, including the further step of

generating a processed master list from said list of authorized users for at least one mini-disk.

11. A method of file access control for a data processing system including a file access controller and a master file, said master file of said data processing system having plurality of user/access lists, including the steps of

storing a processed master list of authorized users corresponding to data in said user/access lists of said data processing system, said processed master list being stored in said file access controller separately from said master file in text form and identifying the authorized users to which said data processing system will grant access,

detecting invalid and duplicate user/access authorizations in said processed master list,

editing said text of said processed master list to form an edited master list with said invalid and duplicate user/access authorizations removed therefrom, and

accessing said file access controller only subsequent to said editing step, updating said user/access lists of said file access controller of said data processing system and said processed master list in response to said edited master list to provide new user/access lists and a new processed master list which conform to said edited master list.

12. A method as recited in claim 11, including the further steps of

generating at least one new user/access list corresponding to said edited master list, and

automatically generating commands for said access controller based on a comparison of a previous user/access list and said new user/access list.

13. A method as recited in claim 11, including the further steps of

specifying and storing at least one alias file corresponding to an authorized user identification in at least one of said processed master list and said edited master list, and

granting access to at least one file in said master file corresponding to said alias file in response to said authorized user identification.

14. A method as recited in claim 13, including the further steps of

generating at least one new user/access list and at least one new alias file corresponding to at least one of said edited master list and said stored alias file, and

automatically generating commands for said access controller based on a comparison of at least one previous user/access list with said new user/access list and said new alias file with said stored alias file.

15. A method as recited in claim 11, wherein

said processed master list is stored at a primary system node, and

said edited master list is stored at a remote system node.

16. A method as recited in claim 15, wherein

said new user/access lists are compared with previous user/access lists at said remote system node.

17. A method of access control for a data processing system, said data processing system having at least a portion of a memory arranged as a plurality of mini-disks and including a file access controller, said method including the steps of

creating a master list of authorized users of said data processing system,

creating a plurality of lists of authorized users for said plurality of mini-disks, at least one list of sad plurality of lists corresponding to each mini-disk, from said master list,

creating a processed master list from said plurality of lists of authorized users of said mini-disks

validating and editing said processed master list to form an edited master list, and

accessing said file access controller only subsequent to said validating and editing of said list of authorized users of a mini-disk said data processing system and said creating of said processed master list in response to said edited master list to provide new lists of authorized users and a new processed master list which conform to said edited master list.

18. A system as recited in claim 17, wherein said master list comprises a matrix of authorized user identifications and mini-disk identifications.

19. An access control system for a data processing system having at least a portion of a memory arranged as a master file, said master file of said data processing system having a plurality of mini-disks and a plurality of user/access lists corresponding to respective ones of the mini-disks, said access control system including

means for storing a processed master list of authorized users corresponding to data in said user/access lists of said master file of said data processing system, said processed master list being stored separately from said master file in text form and identifying the authorized users to which said data processing system will grant access,

means for detecting invalid and duplicate user/access authorizations in said processed master list,

means for editing said text of said processed master list to form an edited master list with said invalid and duplicate user/access authorizations removed therefrom to form an edited master list, and

means for accessing said file access controller only subsequent to editing of said text of said processed master list, updating said user/access lists of said data processing system and said processed master list in response to said edited master list to provide new user/access lists and a new processed master list which conform to said edited master list.

20. An access control system as recited in claim 19, wherein

said processed master list is stored at a primary system node, and

said edited master list is stored at a remote system node.

21. An access control system as recited in claim 20, wherein

said new user/access lists are compared with previous user/access lists at said remote system node.

22. A method of access control for a data processing system including a file access controller and at least a portion of a memory arranged as a master file, said master file of said data processing system having a plurality of mini-disks and a plurality of user/access lists corresponding to the mini-disks, including the steps of

storing a processed master list of authorized users corresponding to data in said user/access lists of said master file of said data processing system, said processed master list being stored in said file access controller separately from said master file in text form and identifying the authorized users to which said data processing system will grant access,

detecting invalid and duplicate user/access authorizations in said processed master list,

editing said text of said processed master list to form an edited master list with said invalid and duplicate user/access authorizations removed therefrom, and

accessing said file access controller only subsequent to editing of said text, updating said user/access lists of said data processing system and said processed master list in response to said edited master list to provide new user/access lists and a new processed master list which conform to said edited master list.

23. A method as recited in claim 22, wherein

said processed master list is stored at a primary system node, and

said edited master list is stored at a remote system node.

24. A method as recited in claim 23, wherein

said new user/access lists are compared with previous user/access lists at said remote system node.