Determining roles for automated tasks in a role-based access control environment

• US 7,996,893 B2
• Filed: 06/11/2007
• Issued: 08/09/2011
• Est. Priority Date: 06/11/2007
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Persaud-Deolall, Shiva, Wang, Xinya
• Primary Examiner(s): Pyzocha; Michael
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US11/760,903
• Publication Number:
  US 20080307505A1
• Time in Patent Office: 1,520 Days
• Field of Search: 705/51, 713/181, 713/183, 726/13, 726/21, 726/27
• US Class Current: 726/21
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A computer implemented method, apparatus, and computer program product for performing an automated task in a role-based access control environment. A set of roles is assigned to a user to form assigned roles, wherein the role-based access control environment allows the user to assume a subset of the assigned roles at a given time. Responsive to receiving a request to execute an automated task, an identity of the user creating the automated task is identified. Responsive to determining that the user creating the automated task is not logged in, a set of session roles are identified based on the identity of the user. A session is created for the automated task. The automated task is performed in the session using the set of session roles.

Claims

1. A computer implemented method for performing an automated task in a role-based access control environment, the computer implemented method comprising:

assigning by one or more processors a set of roles to a user to form assigned roles, wherein the role-based access control environment allows the user to assume a subset of the assigned roles at a given time;

responsive to receiving a request to execute an automated task, identifying by the one or more processors an identity of the user creating the automated task, wherein the step of identifying the set of session roles based on the identity of the user further comprises;

determining a set of most frequently assumed roles for the user by ranking roles the user has historically assumed based on how frequently the user assumed each role; and

setting the set of most frequently assumed roles as the set of session roles;

responsive to a determination that the user creating the automated task is not logged in, identifying by the one or more processors a set of session roles based on the identity of the user;

creating by the one or more processors a session for the automated task; and

performing by the one or more processors the automated task in the session using the set of session roles.

2. The computer implemented method of claim 1, wherein the step of responsive to receiving a request to execute an automated task, identifying an identity of the user creating the automated task further comprises:

specifying by the one or more processors an event to form a specified event;

responsive to determining that the specified event has occurred, receiving by the one or more processors a request to execute an automated task; and

responsive to receiving the request to execute the automated task, identifying by the one or more processors an identity of the user creating the automated task.

3. The computer implemented method of claim 1, wherein the step of identifying the set of session roles based on the identity of the user further comprises:

retrieving by the one or more processors a set of default roles, wherein the set of default roles are previously created; and

setting by the one or more processors the set of default roles as the set of session roles.

4. The computer implemented method of claim 1, wherein the step of identifying the set of session roles based on the identity of the user further comprises:

identifying by the one or more processors a set of parent roles for the set of roles, wherein the parent roles are hierarchically higher than the roles; and

setting the set of parent roles as the set of session roles.

5. The computer implemented method of claim 1, wherein the step of identifying the set of session roles based on the identity of the user further comprises:

performing by the one or more processors at least two of retrieving a set of default roles, determining a set of most frequently assumed roles of the user, and determining a set of parent roles for the set of roles; and

setting one of the set of default roles, set of parent roles, and set of most frequently assumed roles as the set of session roles.

6. The computer implemented method of claim 1, wherein the automated task is one of an application, a command, and a script file containing one or more commands, and wherein the event is one of a user login, and a date and time.

7. A computer program product comprising a computer usable hardware medium including computer usable program code for performing an automated task in a computer having a role-based access control environment, the computer program product comprising:

computer usable code for assigning a set of roles to a user to form assigned roles, wherein the role-based access control environment allows the user to assume a subset of the assigned roles at a given time;

computer usable code for, responsive to receiving a request to execute an automated task, identifying an identity of the user creating the automated task;

responsive to a determination that the user creating the automated task is not logged in, computer usable code for identifying a set of session roles based on the identity of the user, wherein the computer usable code for identifying the set of session roles based on the identity of the user further comprises;

computer usable code for determining a set of most frequently assumed roles for the user by ranking roles the user has historically assumed based on how frequently the user assumed each role; and

computer usable code for setting the set of most frequently assumed roles as the set of session roles;

computer usable code for creating a session for the automated task; and

computer usable code for performing the automated task in the session using the set of session roles.

8. The computer program product of claim 7, wherein the computer usable code for, responsive to receiving a request to execute an automated task, identifying an identity of the user creating the automated task further comprises:

computer usable code for specifying an event to form a specified event;

computer usable code for, responsive to determining that the specified event has occurred, receiving a request to execute an automated task; and

responsive to receiving the request to execute the automated task, computer usable code for identifying an identity of the user creating the automated task.

9. The computer program product of claim 7, wherein the step of determining the set of session roles based on the identity of the user further comprises:

computer usable code for retrieving a set of default roles, wherein the default roles are previously created; and

computer usable code for setting the set of default roles as the set of session roles.

10. The computer program product of claim 7, wherein the computer usable code for determining the set of session roles based on the identity of the user further comprises:

computer usable code for determining a set of parent roles for the set of roles, wherein the parent roles are hierarchically higher than the roles; and

computer usable code for setting the set of parent roles as the set of session roles.

11. The computer program product of claim 7, wherein the computer usable code for determining the set of session roles based on the identity of the user further comprises:

computer usable code for performing at least two of retrieving a set of default roles, determining a set of most frequently assumed roles of the user, and determining a set of parent roles for the set of roles; and

computer usable code for setting one of the set of default roles, set of parent roles, and set of most frequently assumed roles as the set of session roles.

12. The computer program product of claim 7, wherein the automated task is one of an application, a command, and a script file containing one or more commands, and wherein the event is one of a user login, and a date and time.

13. A data processing system for performing an automated task in a computer having a role-based access control environment, the data processing system comprising:

a bus;

a storage device connected to the bus, wherein the storage device contains computer usable code;

a communications unit connected to the bus; and

a processing unit connected to the bus for executing the computer usable code, wherein the processing unit executes the computer usable code to assign a set of roles to a user to form assigned roles in response to input from an administrator, wherein the role-based access control environment allows the user to assume a subset of the assigned roles at a given time;

create the automated task, in response to input from the user, wherein the input specifies the automated task;

responsive to receiving a request to execute the automated task, identify an identity of the user who created the automated task;

responsive to a determination that the user creating the automated task is not logged in, identify a set of session roles based on the identity of the user, wherein in executing the computer usable program code to identify the set of session roles based on the identity of the user, the processing unit further executes the computer usable program code to identify the set of session roles based on the identity of the user by further executing the computer usable code to determine a set of most frequently assumed roles for the user by ranking roles the user has historically assumed based on how frequently the user assumed each role, and set the set of most frequently assumed roles as the set of session roles;

create a session for the automated task; and

perform the automated task in the session using the set of session roles.

14. The data processing system of claim 13, wherein the processing unit, responsive to receiving a request to execute the automated task, identify an identity of the user who created the automated task, further executes the computer usable code to specify an event to form a specified event;

responsive to determining that the specified event has occurred, receive a request to execute the automated task; and

responsive to receiving the request to execute the automated task, identify an identity of the user creating the automated task.

15. The data processing system of claim 13, wherein in executing the computer usable program code to identify the set of session roles based on the identity of the user, the processing unit further executes the executes the computer usable program code to determine the set of session roles based on the identity of the user by further executing the computer usable code to retrieve a set of default roles, wherein the set of default roles are previously created, and sets the set of default roles as the set of session roles.

16. The data processing system of claim 13, wherein in executing the computer usable program code to determine the set of session roles based on the identity of the user, the processing unit further executes the computer usable program code to identify the set of session roles based on the identity of the user by further executing the computer usable code to determine a set of parent roles for the set of roles, wherein the parent roles are hierarchically higher than the roles, and set the set of parent roles as the set of session roles.

17. The data processing system of claim 13, wherein in executing the computer usable program code to identify the set of session roles based on the identity of the user, the processing unit further executes the computer usable program code to identify the set of session roles based on the identity of the user by further executing the computer usable code to perform at least two of retrieves a set of default roles, determines a set of most frequently assumed roles of the user, and determines a set of parent roles for the set of roles, and sets one of the set of default roles, set of parent roles, and set of most frequently assumed roles as the set of session roles.