Role-based access control utilizing token profiles

• US 8,387,136 B2
• Filed: 01/05/2010
• Issued: 02/26/2013
• Est. Priority Date: 01/05/2010
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Lee, Ade, Fu, Christina
• Primary Examiner(s): ZECHER, CORDELIA P K
• Application Number:
  US12/652,675
• Publication Number:
  US 20110167256A1
• Time in Patent Office: 1,148 Days
• Field of Search: 713/156, 726/28
• US Class Current: 726/20
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method A method and system for managing role-based access control of token data using token profiles is described. In one method, a token processing system (TPS) receives a request from a TPS client over a network to perform an operation on entries of a token database. The TPS identifies a subset of the multiple groups that corresponds to the entries indicated in the request of the TPS client, determines to which of the identified groups the TPS client belongs using token profiles. For each group the TPS client belongs, the TPS determines a corresponding role for the TPS client from the token profiles. For each group the TPS belongs, the TPS allows the TPS client access to the entries of the respective group to perform the operation when the TPS client has the appropriate role assigned within the respective group.

Claims

1. A method comprising:

receiving, by a token processing system (TPS) executing on a computing system, a request from a TPS client over a network to perform an operation on entries of a token database, wherein each of the entries of the token database is associated with a token assigned to one of a plurality of groups, wherein the TPS is configured to communicate with the token database and configured to communicate over the network with one or more additional clients having the tokens to the plurality of groups;

identifying a subset of the plurality of groups that corresponds to the entries indicated in the request of the TPS client;

determining to which of the identified groups the TPS client belongs using token profiles stored in a profile data structure, each of the token profiles specifying one or more of the plurality of groups and one or more corresponding roles for access privileges to the entries corresponding to the respective one or more of the plurality of groups;

for each group the TPS client belongs, determining a corresponding role for the TPS client from the token profiles, wherein the corresponding role defines the TPS client'"'"'s access privileges to the entries corresponding to the tokens in the respective group; and

for each group the TPS client belongs, allowing the TPS client access to the entries of the respective group to perform the operation when the TPS client user has the appropriate role assigned within the respective group.

2. The method of claim 1, further comprising assigning a plurality of tokens to the plurality of groups based on identification numbers, and wherein said assigning the plurality of tokens to the plurality of groups comprises assigning each of the plurality of groups a set of identification numbers, wherein each of the identification numbers of each set corresponds to a unique one of the tokens of the respective group.

3. The method of claim 1, further comprising assigning a plurality of tokens to the plurality of groups based on ranges of card unique identifiers (CUIDs), each range corresponding to one of the plurality of groups and each CUID corresponding to one of the plurality of tokens of the plurality of groups.

4. The method of claim 1, further comprising assigning a plurality of tokens to the plurality of groups based on Answer-to-Reset (ATR) manufacturing identifiers, each ATR manufacturing identifier corresponding to one of the plurality of groups.

5. The method of claim 1, further comprising assigning a plurality of tokens to the plurality of groups by, for each of the plurality of groups, adding a group identifier (ID) attribute, corresponding to the particular group, to each of the entries corresponding to the plurality of tokens of the particular group.

6. The method of claim 1, further comprising assigning a plurality of tokens to the plurality of groups by, for each of the plurality of groups, adding a token profile identifier(ID) attribute, corresponding to the particular token profile, to each token-related entry corresponding to the plurality of tokens of the particular group, and wherein assigning the TPS client the token profile comprises adding an auxiliary class with a multi-value attribute that can be attached to a user-related entry in the token database to identify that the TPS client belongs to the particular group.

7. The method of claim 6, further comprising, when requested by the TPS client, listing the token-related entries of the token database for each of the plurality of groups for which the token profile ID of the TPS client matches a set of token profile IDs permitted by each of the plurality of groups.

8. The method of claim 1, further comprising:

assigning the TPS client a first role for a first group of the plurality of groups, wherein the first group comprises a first set of identification numbers, wherein each of the first set of identification numbers corresponds to a unique one of a plurality of tokens in the first group; and

assigning the TPS client a second role for a second group of the plurality of groups, wherein the second group comprises a second set of identification numbers, wherein each of the second set of identification numbers corresponds to a unique one of a plurality of tokens in the second group, and wherein the first and second roles define access privileges for the TPS client in each of the first and second groups, respectively.

9. The method of claim 8, wherein the first role has different access privileges than the second role.

10. The method of claim 1, further comprising:

assigning the TPS client to the plurality of groups; and

for each group the TPS client belongs, assigning the TPS client one of a plurality of roles, wherein each of the plurality of roles defines different access privileges to the entries for the respective group.

11. The method of claim 10, wherein the plurality of roles comprise:

a first role that grants read-only permissions to view and search token-related entries of the respective group;

a second role that grants read and write permissions to view, search, and modify the token-related entries of the respective group; and

a third role that grants read-only permissions to view and search the token-related entries of the respective group, permissions to add a token to the respective group, permissions to delete a token from the respective group, permissions to add, modify, and delete one or more TPS clients associated with the respective group.

12. The method of claim 11, wherein the first role further grants read-only permissions to view and search token-related entries comprising certificates associated with tokens of the respective group and activities for the tokens of the respective group, and wherein the second role further grants read and write permissions to view, search, and modify the token-related entries comprising the certificates and the activities.

13. The method of claim 1, wherein at least one of the plurality of groups is a default top-level group, and wherein at least one role of the default top-level group is an administrator role that allows the TPS client having been assigned the administrator role to create a new group.

14. The method of claim 13, wherein the administrator role further allows the TPS client having been assigned the administrator role to list all groups and create other TPS client in any of these groups.

15. The method of claim 1, wherein the profile data structure is a profile table, and the token profiles are stored as profile records in the profile table.

16. A certificate system, comprising:

a data storage device to store a plurality of token profiles, wherein each of the plurality of token profiles corresponds to one of a plurality of groups, each of the plurality of groups having a plurality of tokens, and wherein each of the plurality of token profiles specifies a role that defines the TPS client'"'"'s access privileges to entries of a token database corresponding to the tokens in the respective group; and

a first server, comprising a token processing system (TPS), coupled to the data storage device, wherein the TPS is configured to communicate with the data storage device and is configured to communicate over a network with a TPS client and one or more additional clients having the tokens assigned to the plurality of groups, wherein the TPS is configured to receive a request from the TPS client to perform an operation on the entries of the token database, to identify a subset of the plurality of groups that corresponds to the entries indicated in the request of the TPS client, and to determine to which of the identified groups the TPS client belongs using the token profiles, each of the token profiles specifying one or more of the plurality of groups and one or more corresponding roles for access privileges to the entries corresponding to the respective one or more of the plurality of groups, and for each group the TPS client belongs, the TPS is configured to determine a corresponding role for the TPS client from the token profiles, and to allow the TPS client access to the entries of the respective group to perform the operation when the TPS client has the appropriate role assigned within the respective group.

17. The certificate system of claim 16, further comprising a Lightweight Directory Access Protocol (LDAP) directory server coupled to the first server, wherein the LDAP directory server is configured to manage the entries of the token database as LDAP entries stored in a LDAP repository, and wherein the TPS is configured to manage role-based access control of the LDAP entries using the token profiles assigned to the TPS client and the corresponding roles assigned to the respective token profile.

18. The certificate system of claim 16, wherein the TPS comprises a role-based access control module that comprises a token database access manager coupled to the data storage device to access the token profiles assigned to the TPS client to determine a role-based access of the TPS client to the entries of the token database stored in the data storage device, and wherein the token database access manager is coupled to receive the request from the TPS client via an interface and is configured to control access to the entries of the token database based on the role-based access of the TPS client.

19. The certificate system of claim 16, wherein the token profiles are stored as profile records in a profile table.

20. A non-transitory machine-readable storage medium having instructions, which when executed, cause a computing system to perform a method, the method comprising:

receiving, by a token processing system (TPS) executing on the computing system, a request from a TPS client over a network to perform an operation on entries of a token database, wherein each of the entries of the token database is associated with a token assigned to one of a plurality of groups, wherein the TPS is configured to communicate with the token database and configured to communicate over the network with one or more additional clients having the tokens assigned to the plurality of groups;

identifying a subset of the plurality of groups that corresponds to the entries indicated in the request of the TPS client;

determining to which of the identified groups the TPS client belongs using token profiles stored in a profile data structure, each of the token profiles specifying one or more of the plurality of groups and one or more corresponding roles for access privileges to the entries corresponding to the respective one or more of the plurality of groups;

for each group the TPS client belongs, determining a corresponding role for the TPS client from the token profiles, wherein the corresponding role defines the TPS client'"'"'s access privileges to the entries corresponding to the tokens in the respective group; and

for each group the TPS client belongs, allowing the TPS client access to the entries of the respective group to perform the operation when the TPS client has the appropriate role assigned within the respective group.

21. The non-transitory machine-readable storage medium of claim 20, wherein at least one of the plurality of groups is a default top-level group, and wherein at least one role of the default top-level group is an administrator role that allows the TPS client having been assigned the administrator role to create a new group.

22. The non-transitory machine-readable storage medium of claim 21, wherein the administrator role further allows the TPS client having been assigned the administrator role to list all groups and create other TPS client in any of these groups.

23. The non-transitory machine-readable storage medium of claim 20, wherein the profile data structure is a profile table, and the token profiles are stored as profile records in the profile table.