International Business Machines Corporation

Michael Andrew Powell

Timothy Simon Bartley

Rodney Carlton Burnett

Scott Anthony Exton

Elizabeth Marie Hughes

Philip A J Nye

Brian James Turner

Peter Terence Cogill

A computer implemented method, data processing system, and computer program product for role-based privilege management is provided. A transformation request is received from a requester to form a received request, and a target environment of the received request is identified. A determination is made whether the target environment matches a predefined environment in a set of role-based privileges and, responsive to a determination that the target environment matches a predefined environment in the set of role-based privileges, the parameterized privileges from the set of role-based privileges are mapped to the target environment and the request is performed.

Role-based privilege management

In this invention, when security policy is attached to a file, a device protection manager is given the protected file's name. If the file is a special device file, then the device manager records the device specification in a device database. When a device access occurs, the device specification is extracted from the special device file used in the access. This extracted device specification is then used to search the device database. If a matching device specification is found in the database and the accessed device file has the same name as the protected resource, then authorization policy rules on that resource determine the access. If the match is a different device file name from the protected file name for the same device, then the search continues until the exact accessed device is found or until all device specification matches are found. In the absence of an exact device file match, all the matching device files are presented to the external security manager for authorization checking and the most restrictive outcome prevails.

Method for adding and enforcing enhanced authorization policy on devices in computer operation systems

The method of the invention assumes there is a security manager and mechanism present for defining, attaching, and evaluating external authorization policy to file resources based on the file's path name. In this invention, protected symbolic links and the resources that the link points to are stored in a protected object database. When a system access attempt occurs, the file attribute is extracted from the file used in the access. The file attribute is then used to search the protected object database. If a matching system resource is found, and that resource is protected but does not have independent security policy on it, then the resource will have the security policy of a symbolic link that points to it. In this case, the security of each protected symbolic link pointing to the system resource has to grant access in order for allowance of the access attempt. This approach insures that the most restrictive outcome prevails.

Method for adding external security to file system resources through symbolic link references

An administration model is provided that uses access control lists to define permissions for users and groups of users. The model identifies a number of objects to be administered. Associated with each of these objects is a set of administrative operations that can be performed on the object. For each of these operations a permission in an access control list entry is defined. The protected resources are arranged in a hierarchical fashion and an access control list can be associated with any point in the hierarchy. The access control list provides fine-grained control over the protected resources. At the time an administrator requests to perform an operation, the administrator's identification is used to look up the prevailing access control list to determine whether the operation is permitted.

Growing community of inventors

Clear Island Waters, Australia

Michael Andrew Powell