GB2430280A

GB2430280A - Configuring security settings

Info

Publication number: GB2430280A
Application number: GB0518849A
Authority: GB
Inventors: Lewis Marshall
Original assignee: TECHNOPLUS IT Ltd
Current assignee: TECHNOPLUS IT Ltd
Priority date: 2005-09-15
Filing date: 2005-09-15
Publication date: 2007-03-21
Also published as: GB0518849D0

Abstract

The invention relates to configuring security settings in an access control system. An access configurator 10 requests changes to access settings in a security database 11 under the authority of a user of terminal 12. The access configurator provides a user interface, preferably in the form of web pages, for receiving input from the user of the terminal. The user requests changes to the security settings in the database via the user interface and the access configurator then passes the request to an access controller 13. The access configurator also passes user authority information to the access controller, e.g. by forwarding user credentials entered into the user interface, or by passing challenge/response information between the controller and the user terminal. The controller verifies the request before making changes to the security database. The software running on the access configurator does not run under an authority that would allow it to make changes in the database. Instead the software requests changes under the authority of the user requesting the change. As a result, if the software is compromised by a hacker the hacker would not be able to exploit the software to make changes in the database. The requests may be in accordance with LDAP (Lightweight Directory Access Protocol).

Description

1 2430280

CONFIGURING SECURITY

This invention relates to configuring security settings. Examples of security settings are settings that indicate whether a particular user of a system has access to a particular function of the system and settings that indicate whether a particular user is a member of a group of users that has certain access rights associated with it. The system may, for example, be single computer, a set of networked computers or one or more dedicated devices such as door access controllers.

In a typical computerised system each user has credentials that allow them to gain access to functions of the system. The credentials are typically a username and a password but they could be other data such as biometric information. In order to gain access to a function of the system the user supplies their credentials, or a function of them, to the system. The system then checks the credentials against its database of all users' credentials to verify the identity of the user. The system also stores data indicating which of its facilities each user is to be allowed access to. Once the user's identity is verified the system gives the user access rights in accordance with that data. Examples of access rights are the rights to administer each function of the system, the rights to access each file or directory on the system, the rights to launch each application on the system and the right to shut down the system.

The LDAP (Lightweight Directory Access Protocol) protocol is commonly used for managing access control. LDAP provides a hierarchical directory structure for managing the storage of user information. This is used by some systems to maintain some access controls relating to the directory itself. The majority of access controls are governed by the structures that manage a resource e.g. a file system or a database system. These in turn can use data from LDAP to define what users and groups exist but the access is ultimately controlled by the system that secures the information.

In a complex system the management of access rights is problematic. In a large company there may be many file servers, printers, email accounts, remote access gateways and door access controllers distributed across many sites and access to each of them must be restricted to only the desired set of users.

Certain individuals in an organisation are designated as having the authority to define certain access rights. It is desirable to delegate access control to the person in the business who is best placed to decide on which users should have the rights in question. For example, the leader of a small workgroup may have the right to define which users can access folders on a file server that are to be shared between those users; and the security manager of an office may have the right to define which users can release which door access controllers at that office. However, many of those users will not have sufficient familiarity with computing to operate a typical access configuration tool. For that reason some organisations delegate the setting of access rights to a specialist group of people.

Those people take instructions from those who have the authority to define access rights, and set the rights as instructed. A major problem with this approach is that using a separate group of people to set the access rights introduces significant security risks: those people must be trusted not to give authority to the wrong person. Another problem is that although rights can be expected to be set reliably when a user wants to gain access to a resource (since the user will urge that he should be given access), setting is normally less reliable when rights ought to be denied after a user has left the organisation or moved from one workgroup to another. This is because the group of people who set the security permissions may well not find out that the user has left or moved. This results in remnant access permissions being left in place, which is a security risk.

To address these problems, a number of software products are available that allow LDAP access permissions to be controlled through a readily understood user interlace that can be operated by users who have no special IT skills.

Figure 1 illustrates the operation of such a product. Figure 1 shows a system comprising a server I on which the access control software runs, a client terminal 2 and a set of access controllers 3 which implement the LDAP protocol and control access to resources in the system. The server I includes a web server application 4, a security database 5 (this could, and in most large organisations will, reside on a separate dedicated database server) and an LDAP interface application 6. The database 5 stores data defining which users are allowed to change which access permissions. A user of the client terminal 2 can access the web server 4, which will return a web page including a form that allows the user to enter details of the modifications to access controls that he wishes to make. The user submits that form to the web server, which passes the changes to the LDAP interface application 6. The LDAP interface checks from the database 5 that the user who submitted the page is allowed to make the requested changes. If they are then the LDAP interface application communicates with the LDAP controllers 3 to make the changes.

Current systems of this type suffer from a number of problems. First, when the server I communicates with the LDAP controllers in order to have a change made it must authenticate itself to the LDAP controllers in a manner that ensures that the LDAP controllers will give it the authority to make the changes. To achieve this the LDAP interface application 6 has the authority of a top-level administrator of the system, giving it the authority to make any changes that may be required, and it conveys that authority to the LDAP controllers when it needs to have a change made. The problem with this is that although the LDAP controllers are a highly trusted part of the system, the software product that comprises the LDAP interface is not so highly trusted. If an attacker were able to gain access to the database 5 or the LDAP interface application 6 then he could use the administrative authority of the LDAP application to make widespread changes to permissions in the LDAP controllers 3.

It is conventional for LDAP controllers to make use of user groups. Certain rights can be allocated to a user group, and a user can automatically be given all those rights simply by being made a member of the group. This makes administration of user rights considerably easier. However, current systems of the type shown in figure 1 are based on the concept that the membership of groups will be handled by staff having administrative rights. Therefore they do not allow the permission to change the membership of groups to be managed. It has now been identified that for the reasons discussed above it would be advantageous to be able to delegate the administration of groups to individuals who have a better knowledge of which people should be members of that group and what rights the group should have. This is especially the case in larger organisations, where the IT administrators are relatively remote from many of the staff. Such a scheme preferably requires the tool that is to be used for administration to be readily usable by users who are not skilled in IT; this is not the case with many current administration tools.

Similar problems apply to systems that use other security protocols than LDAP.

There is therefore a need for a means of configuring security settings in a more secure and user-friendly manner.

According to one aspect of the present invention there is provided a data processing entity for configuring access by users to facilities of a system, the system having a user terminal and an access controller for governing access to the facilities in accordance with stored access data indicating which users of the system are to be permitted to access which facilities, the data processing entity comprising: an physical interface for communicating with the access controller and the user terminal; a user interface controller for providing to the user terminal over the physical interface a user interface for receiving from the user terminal an indication of a change to be made to the access data; and an access configurator arranged to, on receipt by the user interface controller of an indication of a change to be made to the access data, transmit to the access controller a request comprising an indication of the change and user authentication data authenticating a user of the user terminal, whereby the access controller can treat the request as a request to make the change under the authority of the user of the user terminal.

The user authentication data may comprise a response from the user terminal to a challenge from the access configurator.

The user authentication data comprises a username and a password. The user authentication data may comprise credentials of another type, such as biometric information.

The data processing entity preferably comprises a local data store for storing local access data indicating which users of the system are to be permitted to access which facilities, and wherein the user interface controller is arranged to determine the identity of the user of the user terminal and provide to the user terminal a personalised user interface that is dependent on the identity of the user.

The facilities preferably include permissions to change permissions defined by the access data.

The personalised user interface may be such as to offer the user the option to change only those aspects of the access data that the local access data indicates that the user may change.

The data processing entity is may be arranged to populate the local access data by requesting at least some of the stored access data from the access controller and storing that data as the local access data.

The data processing entity may be arranged to populate the local access data by updating it in dependence on the content of requests made by the access configurator to the access controller.

The request is may be a request in accordance with the LDAP protocol.

Alternatively, it may be in accordance with another protocol or language.

The access controller is conveniently capable of storing definitions of the members of one or more groups of users and the facilities that members of that group are to be permitted to access, and the data processing entity is capable of operating such that the change to be made to the access data is a change to the membership of one or more of the groups.

The access controller is conveniently capable of storing definitions of the members of at least two groups of users and the user interface controller configurable by means of the selection by a user of two or more groups for providing to the user terminal over the physical interface a user interface in which the selected groups are presented next to each other for entry of changes to the membership thereof.

Preferably the access configurator is capable of storing definitions of one or more roles as comprising one or more groups; the user interface controller is capable of receiving from the user terminal an indication of a change to be made to the membership of a role; and the access configurator is arranged to, on receipt by the user interface controller of an indication of a change to be made to the membership of a role, transmit to the access controller one or more requests for comprising an indication of the change and user authentication data authenticating a user of the user terminal, whereby the access controller can treat the request as a request to make the change under the authority of the user of the user terminal.

According to a second aspect of the present invention there is provided a method for configuring access by users to facilities of a system, the system having a user terminal and an access controller for governing access to the facilities in accordance with stored access data indicating which users of the system are to be permitted to access which facilities, the method comprising: the access controller providing to the user terminal by means of physical interface a user interface for receiving from the user terminal an indication of a change to be made to the access data; on receipt by the user interface controller of an indication of a change to be made to the access data, transmitting to the access controller a request comprising an indication of the change and user authentication data authenticating a user of the user terminal, whereby the access controller can treat the request as a request to make the change under the authority of the user of the user terminal.

The present invention will now be described by way of example with reference to the accompanying drawings.

In the drawings: Figure 1 shows a prior security setting system; Figure 2 illustrates a security system according to one embodiment of the present invention.

Figure 3 shows the flow of communications during the making of a change.

The system of figure 2 includes an access configurator 10 which is capable of altering access settings in a security database 11 under the command of the user of a user terminal 12. The software running on the access configurator does not run under an authority that would allow it to make changes in the database II. As a result, if the software is compromised by a hacker the hacker would not be able to exploit the software to make changes in the database, Instead, the software requests changes in the database 11 under the authority of the user requesting the change. This authority is passed from the user terminal 12. The controller 13 of the security database makes the change only if the requesting user is permitted to make that change.

In more detail, the access configurator 10 of figure 2 comprises a central processing unit 101, a non-volatile program store 102 such as a hard disk and a physical interface 103 whereby it can communicate with other devices connected to network 14. The program store stores software that is executable by the processor and that enables the configurator to provide a user interface for receiving input from a user of terminal 12 and to communicate with the security controller 13 for configuring the database 11. The user interface is preferably provided in the form of web pages, in which case the software that provides the user interface could be a web server having access to suitable page definitions.

Alternatively the user interface could be provided from software that runs on the terminal 12 and can be downloaded by the terminal from the access configurator 10.

The access configurator could also store a replica security database 104. This could be populated by means of periodically querying the security database 11 and replicating its content, either in the same or a different format. This avoids the possibility of data being present in the database 104 that has never been accepted by the controller 13. However, the database 104 could be populated by updating it based on the nature of updates to the database 11 that are made through the access configurator 10. Thus, when the access configurator requests a change to the database 11 under the command of a user (or more preferably when such a request is acknowledged by the security controller 13 as having been made) the security configurator could make the corresponding change in its local database 104. One advantage of using a local database is that it can reduce the time needed to get information about the existing access controls for an individual, by avoiding the need to query the security database 11 each time that information is needed. This is especially valuable in generating or refreshing user interface pages. However, the access configurator could alternatively query the security database 11 directly each time security information is needed.

The replica security database is preferably used by the access configurator to control the content of the user interface that is made available to a particular user so that the user is offered the option of changing only those aspects of the database 11 that they are actually permitted to change. For example, if the database 11 stores access rights to folders and to printers, when a user who is only permitted to configure the printers accesses the user interface the access configurator determines his access rights from the database 104 and only offers him the possibility of making changes to the settings of the printers; settings of the folders are suppressed. This simplifies the user interface since users do not have to navigate through options that are of no concern to them, and provides an extra level of security since users are not even able to try making changes that they should not make. Thus the operation of the software that generates the user interface is preferably dependent on the content of the database. Preferably the set of settings that it offers a user the possibility of changing is dependent on the content of the database and the identity of the user. Most preferably the set of settings that it offers is limited to those that the database indicates can be changed by the user to whom the user interface is being presented. The user can be identified from a log-on to the access configurator, or from embedded operating system features that allow the user's identity to be passed from the user terminal to the access configurator.

In the example of a web-based user interface, the interface may be provided by one or more HTML-coded pages including forms that have a number of fields 20 where a user can input data. When the form is submitted that data is passed to the configurator for processing.

At the configurator, when the user has provided to the user interface information defining a change to be made to the security settings information defining the change is passed to the software that communicates with the access controller.

That software forms a request message for transmission to the access controller, which includes a definition of the change. That request is sent to the access controller. The request may include the user's authorisation data, or that may be forwarded separately to the access controller. The access controller preferably returns a message indicating whether the change has been successfully made.

In order to have the access controller process a request under the authority of the user who requested it the access configurator must be able to pass that authority through to the access controller. That may be done in a number of ways. First, the user may enter their username and password into the user interface provided by the access configurator, and the access configurator may then use those credentials to authenticate the request to the access controller. The access configurator can then delete the username and password from its memory. This method is not preferred because it involves the username and password being held at least temporarily by the access configurator. As a result, if the access configurator is compromised by a hacker the hacker may be able to retrieve the username and password. Second, if the access controller authenticates users by means of a challenge/response protocol the access configurator will expect to receive a challenge when it requests a change to the security database. It passes that challenge through to the user terminal which processes it in accordance with its credentials in order to form the response, and the response is returned to the access controller via the access configurator. Third, the operating systems used by the various units may support automatic pass-through of user authentication, in which case that may be used.

Figure 3 shows the flow of information in a preferred example. The steps in figure 3 are as follows.

201: The user uses the user terminal to request a user interface web page from the access configurator.

202: The access configurator returns the web page, including a form whose options are tailored to the user's permissions.

203: The user completes the form to indicate changes to be made and submits the entered data to the access configurator.

204: The user interface software of the access configurator informs the communication software of the change to be made. The communication software forms a request to be passed to the access controller.

205: The access configurator passes the request to the access controller.

206: The access controller returns an authentication challenge to the access controller, including challenge data.

207: The access configurator forwards the challenge to the user terminal.

208: The user terminal forms a response to the challenge data. The response could include the user name of the user of the terminal and response data formed as a cryptographic function of the user's password and the challenge data.

209: The user terminal passes the response to the access configurator.

210: The access configurator passes the response to the access controller.

211: The access controller verifies the response. If the response is verified it makes the change to the security database. If not, it does not make the change.

212: The access controller returns to the access configurator a message indicating whether the change succeeded or failed.

213: If the change was successful the access configurator updates its local database to reflect the change. It also emails the user who is the subject of the change to inform them of the change having been made.

214: The user interface provided by the access configurator signals the user terminal to indicate whether the change was successful.

The access controller governs access by users to facilities of the system. Those facilities could be facilities for making use of services of the system, for instance accessing files or opening a door controlled by the system, or could be facilities for configuring the system, for instance permissions to configure access settings in the access database. When a device (for instance a file server, printer or door controller) is requested to give a user a service that device communicates with the access controller to identify whether the user is to be permitted to access the service.

In order to enable security permissions in a system to be more easily administered it is conventional to assign user accounts to account groups.

Access permissions set for a group can then be applied automatically to the members of that group. In some vendors' systems one group may be a member of another group ("group nesting"). Other vendors' system may not permit this, or ) may limit it to certain types of group. Conveniently the access controller stores a list of the groups, and for each one a list of the group's members and an indication of the rights associated with that group. Rights are granted to users in accordance with that data.

The access configurator can, in accordance with input made to the user interface, signal the access controller to add a user to the membership of a group so as to give that user the access rights associated with that group, or to remove a user from the membership of a group so as to deny that user the access rights associated with that group. To permit this the user interface can present to a user a list of groups and can allow the user to input information indicating which users are to be added to or removed from each group. Preferably the user interface is configurable under the input of a user so as to present the user with a view in which pre-selected groups are shown next to each other. For example, the user may want to see the groups "Read Access to Routers Files", Write Access to Routers Files" and "Routers Feed Access" next to each other so as to make configuring them more intuitive.

In operation, an administrator may configure one or more groups such that a particular user has permission to modify the list of members of that group. That user may then access the user interface to provide input to the access configurator for altering the list of members. On receiving that input the access configurator forms and transmits a request to the access controller to alter the membership of that group as stored in its security database.

Changes may be made to the access rights of users, the access rights of groups and to the membership of groups (i.e. which users or other groups are to be treated as having the permissions associated with a particular group). New groups may also be set up through the system. The ability to change the membership of groups through the system is highly advantageous, since it allows the a user of the system to set up a group that has the rights associated with a set of users that he is responsible for administering. He can then add users to that group or remove users from the group as necessary. This simplifies administration and increases the likelihood that users will have rights removed when they leave a certain workgroup. The combination of this ability with the use of the credentials of the individual who makes the change offers a further advantage in that the right to administer a group can be delegated to an individual who does not have full administrative rights, without the risks involved in giving administrative rights to the access server itself.

The access configurator can also store definitions of one or more "roles". The definition of each role includes a list of groups associated with that role. Details of the roles are not stored at the access controller; they are local to the access configurator. An operator can signal to the access configurator via the user interface that a user is to be added to that role. In response to that the access configurator will automatically request that that user is added to all the groups that are associated with that role. It does that by automatically transmitting one or more requests to the access controller, under the authority of the operator who made the request, to add the user to each of those groups. The access configurator allows the operator to remove users from roles. In response to that the access configurator signals the access controller to request that the user is removed from each of the groups that are associated with that role. For example, the manager of a workgroup may have available to him a "workgroup member" role, which is associated with a group that permits use of the printers in the workgroup's area and with a group that permits use of the workgroup's shared files. The manager can assign users to the workgroup member role, and the access configurator will then automatically request that they be given access to the workgroup's printers and files. The use of such roles makes it easier to configure the system. Definitions of the roles are stored on the access configurator and not on the access controller(s). The access configurator maintains a record of the groups that are associated with each role. )

The permissions are held exclusively by the access controllers and are in effect inherited by the membership of all the groups which together are defined as a role'.

The access controller may operate in accordance with the LDAP protocol. The access controller may operate according to a system such as MicrosoftvActive Directory or the equivalent in other operating systems. The access configurator can be set up to communicate in whatever way is required to suit the system in which it is installed.

The access controller 13 is configured so as to permit a change to be made to the security database 11 only when that change is authorised by a user whom the database indicates has the authority to make that change. The database may be distributed between a number of access controllers, which can each store permissions separately. Alternatively, each of a plurality of controllers may store a replica of the overall security database and propagate changes to the others.

The software running on the security configurator may cache credentialsthat it can use as authority to gain access to facilities in the system, or it may run under a certain level of authority associated with a particular user. It is preferred that that software does not store any authority to make changes in the security database.

Some facilities can be accessed in a number of ways. For instance, a file can be the subject of read access, write access, access such that its existence in a folder can be seen, access such that it can be deleted and access such that access permissions on it can be set. Permissions for these forms of access can be set separately.

The applicant hereby discloses in isolation each individual feature described herein and any combination of two or more such features, to the extent that such features or combinations are capable of being carried out based on the present specification as a whole in the light of the common general knowledge of a person skilled in the art, irrespective of whether such features or combinations of features solve any problems disclosed herein, and without limitation to the scope of the claims. The applicant indicates that aspects of the present invention may consist of any such individual feature or combination of features. In view of the foregoing description it will be evident to a person skilled in the art that various modifications may be made within the scope of the invention.

Claims

1. A data processing entity for configuring access by users to facilities of a system, the system having a user terminal and an access controller for governing access to the facilities in accordance with stored access data indicating which users of the system are to be permitted to access which facilities, the data processing entity comprising: an physical interface for communicating with the access controller and the user terminal; a user interface controller for providing to the user terminal over the physical interface a user interface for receiving from the user terminal an indication of a change to be made to the access data; and an access configurator arranged to, on receipt by the user interface controller of an indication of a change to be made to the access data, transmit to the access controller a request comprising an indication of the change and user authentication data authenticating a user of the user terminal, whereby the access controller can treat the request as a request to make the change under the authority of the user of the user terminal.

2. A data processing entity as claimed in claim 1, wherein the user authentication data comprises a response from the user terminal to a challenge from the access configu rator.

3. A data processing entity as claimed in claim 1, wherein the user authentication data comprises a username and a password.

4. A data processing entity as claimed in any preceding claim, comprising a local data store for storing local access data indicating which users of the system are to be permitted to access which facilities, and wherein the user interface controller is arranged to determine the identity of the user of the user terminal and provide to the user terminal a personalised user interface that is dependent on the identity of the user.

5. A data processing system as claimed in any preceding claim, wherein the facilities include permissions to change permissions defined by the access data.

6. A data processing entity as claimed in claim 4, wherein the personalised user interface is such as to offer the user the option to change only those aspects of the access data that the local access data indicates that the user may change.

7. A data processing entity as claimed in any of claims 4 to 6, wherein the data processing entity is arranged to populate the local access data by requesting at least some of the stored access data from the access controller and storing that data as the local access data.

8. A data processing entity as claimed in any of claims 4 to 7, wherein the data processing entity is arranged to populate the local access data by updating it in dependence on the content of requests made by the access configurator to the access controller.

9. A data processing entity as claimed in any preceding claim, wherein the request is a request in accordance with the LDAP protocol.

10. A data processing entity as claimed in any preceding claim, wherein the access controller is capable of storing definitions of the members of one or more groups of users and the facilities that members of that group are to be permitted to access, and the data processing entity is capable of operating such that the change to be made to the access data is a change to the membership of one or more of the groups.

11. A data processing entity as claimed in claim 10, wherein the access controller is capable of storing definitions of the members of at least two groups of users and the user interface controller configurable by means of the selection by a user of two or more groups for providing to the user terminal over the physical interface a user interface in which the selected groups are presented next to each other for entry of changes to the membership thereof.

12. A data processing entity as claimed in any preceding claim, wherein: the access configurator is capable of storing definitions of one or more roles as comprising one or more groups; the user interface controller is capable of receiving from the user terminal an indication of a change to be made to the membership of a role; and the access configurator is arranged to, on receipt by the user interface controller of an indication of a change to be made to the membership of a role, transmit to the access controller one or more requests for comprising an indication of the change and user authentication data authenticating a user of the user terminal, whereby the access controller can treat the request as a request to make the change under the authority of the user of the user terminal.

13. A method for configuring access by users to facilities of a system, the system having a user terminal and an access controller for governing access to the facilities in accordance with stored access data indicating which users of the system are to be permitted to access which facilities, the method comprising: the access controller providing to the user terminal by means of physical interface a user interface for receiving from the user terminal an indication of a change to be made to the access data; on receipt by the user interface controller of an indication of a change to be made to the access data, transmitting to the access controller a request comprising an indication of the change and user authentication data authenticating a user of the user terminal, whereby the access controller can treat the request as a request to make the change under the authority of the user of the user terminal.

14. A data processing entity substantially as herein described with reference to figures 2 and 3 of the accompanying drawings.

15. A method for configuring access substantially as herein described with reference to figures 2 and 3 of the accompanying drawings.