Method and apparatus to secure digital directory object changes

• US 5,677,851 A
• Filed: 12/15/1994
• Issued: 10/14/1997
• Est. Priority Date: 12/15/1994
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Kingdon, Kevin, Olds, Dale R., Higley, DeeAnne, Childers, Randal Earl
• Primary Examiner(s): Voeltz, Emanuel T.
• Assistant Examiner(s): ASSOUAD, PATRICK J
• Application Number:
  US08/357,467
• Time in Patent Office: 1,034 Days
• Field of Search: 364/514 C, 395/200.01, 395/200.03, 395/200.09, 395/600, 395/712, 395/200.06, 395/200.02, 395/200.13, 395/683
• US Class Current: 709/229
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy

Abstract

A method of providing authoritative access control to computer networks that employs a distributed network directory using a static means of resolving object attributes is disclosed. The method employs the existing directories and an authentication procedure for each server. A first object that is under the physical control of the administrator of one partition of the distributed network directory requests access to a second object that is under the physical control of the administrator of another partition of the distributed network directory. The directory verifies that the access control list of the first object includes the second object. The access control list of the second object is then checked to verify that it includes a reference to the first object as an object that is permitted access to the second object. As a result, access is only granted in response to requests from objects that appear in the access control list of the second object. A method of synchronizing the access control lists based upon an authoritative access control list is also disclosed.

Claims

1. A method of resolving object attributes in a computer system, wherein a first distributed directory object and a second distributed directory object each have at least one associated attribute, comprising the steps of:

a) determining an associated attribute of the first object;

b) checking that the second object is included in the associated attribute of the first object;

c) determining an associated attribute of the second object; and

d) checking that the first object is included in the associated attribute of the second object.

2. A method as recited in claim 1, further comprising the step of notifying that the attributes of the first and second objects are not synchronized if at least one of the following events occurs:

a) the second object is not included in the associated attribute of the first object;

or

b) the first object is not included in the associated attribute of the second object.

3. A method as recited in claim 1, further comprising the step of allowing the first object to access the second object if:

a) the second object is included in the associated attribute of the first object; and

b) the first object is included in the associated attribute of the second object.

4. A method as recited in claim 1, wherein the first and second objects employ static resolution.

5. A method as recited in claim 1, wherein the associated attribute of the first object is a Security Equals attribute, and the associated attribute of the second object is an Equivalent To Me attribute.

6. A method as recited in claim 1, wherein the first and second objects are contained within different partitions in a distributed directory.

7. A method as recited in claim 6, wherein the different partitions are maintained by different servers.

8. A method of synchronizing an associated attribute of a first distributed directory object and an associated attribute of a second distributed directory object in a computer system, comprising the steps of:

a) receiving a request to modify the associated attribute of the second object;

b) verifying that the associated attribute of the second object may be modified;

c) modifying the associated attribute of the second object; and

d) synchronizing the associated attribute of the first object and the associated attribute of the second object by modifying the associated attribute of the first object to correspond to the modified associated attribute of the second object.

9. A method as recited in claim 8, further comprising after Step (c) and before Step (d) the step of verifying that the associated attribute of the second object has been modified.

10. A method as recited in claim 8, wherein the act of modifying an associated attribute includes one or more of the following steps:

a) adding a value to such an attribute;

b) deleting a value to such an attribute;

or

c) changing a value to such an attribute.

11. A method as recited in claim 8, wherein the step of modifying the associated attribute of the first object to correspond to the modified associated attribute of the second object is achieved by adding the second object to the attribute of the first object if the first attribute was added to the attribute of the second object.

12. A method as recited in claim 8, wherein the step of modifying the associated attribute of the first object to correspond to the modified associated attribute of the second object is achieved by deleting the second object from the attribute of the first object if the first object was deleted from the attribute of the second object.

13. A method as recited in claim 8, wherein the first and second objects are contained within different partitions in a distributed directory.

14. A method as recited in claim 13, wherein the different partitions are maintained by different servers.

15. A method of verifying in a computer system that a first distributed directory object has authorization to access a second distributed directory object wherein the first object and the second object each have at least one associated attribute, the method comprising the steps of:

a) receiving a request for the first object to access the second object;

b) determining the associated attribute of the first object and the associated attribute of the second object;

c) checking that the second object is included in the associated attribute of the first object and that the first object is included in the associated attribute of the second object; and

d) verifying that the first object has authorization to access the second object if;

i. the second object is included in the associated attribute of the first object; and

ii. the first object is included in the associated attribute of the second object.

16. A method as recited in claim 15, further comprising the step of:

notifying that an unauthorized access to the second object was attempted if one of the following events occurs;

a) the second object is not included in the associated attribute of the first object;

or

b) the first object is not included in the associated attribute of the second object.

17. A method as recited in claim 15, wherein the first and second objects employ a static resolution to resolve object attributes.

18. A method as recited in claim 15, wherein the associated attribute of the first object is a Security Equals attribute, and the associated attribute of the second object is an Equivalent to Me attribute.

19. A method as recited in claim 15, wherein the first and second objects are contained within different partitions in a distributed directory.

20. A method as recited in claim 19, wherein the different partitions are maintained by different servers.

21. A method as recited in claim 15, wherein the computer system is a client/server network.

22. A method as recited in claim 21, wherein a first name server maintains the first object and a second name server maintains the second object.

23. A computer system comprising a first computer and a second computer which are capable of transmitting and receiving information from one another, which first and second computers access a distributed directory having a plurality of objects, wherein the first computer maintains a first distributed directory object in the distributed directory and the second computer maintains a second distributed directory object in the distributed directory, and wherein the first object has a first associated attribute which references at least the second object and the second object has a second associated attribute which references at least the first object.

24. A computer readable medium comprising a program for resolving object attributes in a distributed directory having a first distributed directory object and a second distributed directory object, wherein each of said objects includes at least one associated attributed, the program being capable of resolving object attributes by performing the steps of:

a) receiving a request for the first object to access the second object;

b) determining the associated attribute of the first object and the associated attribute of the second object;

c) checking that the second object is included in the associated attribute of the first object and that the first object is included in the associated attribute of the second object; and

d) verifying that the first object has authorization to access the second object if;

i. the second object is included in the associated attribute of the first object; and

ii. the first object is included in the associated attribute of the second object.

25. A computer system accessing a distributed directory that includes a plurality of objects having associated attributes, the computer system comprising:

a) means for receiving a request for a first distributed directory object in the distributed directory to access a second distributed directory object in the distributed directory;

b) means for determining an associated attribute of the first object and an associated attribute of the second object;

c) means for checking that the second object is included in the associated attribute of the first object and that the first object is included in the associated attribute of the second object; and

d) means for verifying that the first object has authorization to access the second object if;

i. the second object is included in the associated attribute of the first object; and

ii. the first object is included in the associated attribute of the second object.