Information handling system, method, and article of manufacture for efficient object security processing by grouping objects sharing common control access policies

• US 5,787,427 A
• Filed: 01/03/1996
• Issued: 07/28/1998
• Est. Priority Date: 01/03/1996
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Benantar, Messaoud, Blakley, III, George Robert, Nadalin, Anthony Joseph
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): HOMERE, JEAN RAYMOND
• Application Number:
  US08/582,270
• Time in Patent Office: 937 Days
• Field of Search: 395/609, 395/601, 395/610, 395/187.01, 395/200.55, 395/200.59, 707/9, 707/103, 707/10, 380/25
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system

Abstract

A system, method and article of manufacture, for improving object security in an object oriented system, includes one or more processors, a memory system, one or more I/O controllers, each controlling one or more I/O devices, a bus connecting the processors, the memory system and the I/O controllers, an operating system controlling operation of the processors, the memory system and the I/O controllers, and an object oriented control means which includes means for grouping objects which share common access control policies, where an access control list becomes associated with each object group and the policy applicable to the members of the group. An object may be part of multiple groups, and based upon an environment'"'"'s policy, granting access to the object may be based on a single default object group or on the access granted by the union of all of its object groups.

Claims

1. An information handling system, comprising:

one or more processors;

a memory system;

one or more I/O controllers, each controlling one or more I/O devices;

a bus connecting the processors, the memory system and the I/O controllers;

an operating system controlling operation of the processors, the memory system and the I/O controllers; and

an object oriented control means comprising;

means for creating one or more groups of objects, the objects in each object group sharing a common access control policy, wherein each group contains objects from one or more object classes;

means for associating each object group with one or more access matrixes wherein each access matrix is stored separately from each object; and

means for accessing objects from an object group based on an associated access matrix.

2. An information handling system, according to claim 1, further comprising:

means for creating a first object group of objects sharing common access control policies at a system initalization time, wherein the objects in the first group are from one or more object classes.

3. An information handling system, according to claim 1, further comprising:

means for creating additional object groups of objects as additional objects sharing common access control policies are created, wherein the objects in the additional groups are from one or more object classes.

4. An information handling system, according to claim 1, further comprising:

means for creating one or more access matrixes to control implementation of a system authorization policy.

5. A method for improving efficiency of an information handling system employing object oriented technology, comprising the steps of:

creating one or more groups of objects the objects in each object group sharing a common access control policy, wherein each group contains objects from one or more object classes;

associating each object group with one or more access matrixes wherein each access matrix is stored separately from each object; and

accessing objects from an object group based on an associated access matrix.

6. A method according to claim 5, further comprising the step of:

associating an object with a plurality of object groups.

7. A method according to claim 5, wherein said step of creating one or more groups of objects further comprises:

creating a first group of objects sharing common access control policies, wherein the first group contains objects from one or more object classes, and wherein the first group is created at system initialization time; and

creating one or more additional groups of objects sharing common access control policies, wherein each group contains objects from one or more object classes, and wherein the additional groups are created as additional objects sharing common access control policies are created.

8. A method according to claim 5, further comprising the step of:

creating one or more access matrixes to control implementation of a system authorization policy.

9. A computer readable medium, comprising:

means for creating one or more groups of objects, the objects in each object group sharing a common access control policy, wherein each group contains objects from one or more object classes;

means for associating each object group with one or more access matrixes wherein each access matrix is stored separately from each object; and

means for accessing objects from an object group based on an associated access matrix.

10. A computer readable medium, according to claim 9, further comprising:

means for associating an object with a plurality of object groups.

11. A computer readable medium according to claim 9, wherein said means for creating one or more groups of objects further comprises:

means for creating a first group of objects sharing common access control policies, wherein the first group contains objects from one or more object classes, and wherein the first group is created at system initialization time; and

means for creating one or more additional groups of objects sharing common access control policies, wherein each group contains objects from one or more object classes, and wherein the additional groups are created as additional objects sharing common access control policies are created.

12. A computer readable medium according to claim 9, further comprising:

means for creating one or more access matrixes to control implementation of a system authorization policy.