Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/604—Tools and structures for managing or administering access control systems
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/104—Grouping of entities
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

• the present invention relates to data security generally and more particularly to data security in large organizations having a large number of resources and a large number of users.
• the present invention seeks to provide methodology and a system for ascertaining access permissions of users to computer resources in a large organization having a large number of resources and a large number of users.
• a method for ascertaining access permissions of a first multiplicity of users to a second multiplicity of computer resources on at least one storage unit including:
• the given user is a member of the one of the first plurality of groups, ascribing to the given user the user/resource access permissions of the one of the first plurality of groups,
• the given resource is a member of the one of the second plurality of groups, ascribing to the given resource the resource/user access permissions of the one of the second plurality of groups.
• the grouping users includes identifying a set of user security groups, each of the user security groups having access permissions to at least one of the second multiplicity of computer resources on the at least one storage unit, identifying, for each user of the first multiplicity of users, a subset of the user security groups of which the user is a member, and if a first subset of the user security groups, of which a first user of the first multiplicity of users is a member, is identical to a second subset of the user security groups, of which a second user of the first multiplicity of users is a member, grouping the first user and the second user in a single one of the first plurality of groups with respect to the at least one storage unit.
• the grouping users includes dividing the second multiplicity of computer resources into at least two portions, and grouping the users, among the first multiplicity of users, into the first plurality of groups wherein all members of one of the first plurality of groups have at least nearly identical user/resource access permissions to computer resources included in one of the at least two portions.
• the dividing includes for each user of the first multiplicity of users, calculating a fraction of the second multiplicity of computer resources to which the user has access permissions, and comparing the fraction to a threshold value, denoting each user, for whom the fraction is smaller than the threshold value, as a degenerate security group, and defining a first portion of the second multiplicity of computer resources to be the union of all computer resources which include access permissions for any degenerate security group.
• computer resources in the second multiplicity of computer resources are arranged in a computer resource hierarchy.
• the grouping resources includes for each resource in the computer resource hierarchy, retrieving the resource/user access permissions of the resource and the resource/user access permissions of an immediate ancestor of the resource in the computer resource hierarchy, and if the resource/user access permissions of the immediate ancestor are identical to the resource/user access permissions of the resource, grouping the resource and the immediate ancestor in a single one of the second plurality of groups.
• the grouping the resource includes providing a pointer from the resource to the immediate ancestor and extending pointers which point to the resource to point to the immediate ancestor.
• a method for ascertaining access permissions of a first multiplicity of users to a second multiplicity of computer resources on at least one storage unit including grouping users, among the first multiplicity of users, into a first plurality of groups wherein all members of at least one of the first plurality of groups have at least nearly identical user/resource access permissions to the second multiplicity of computer resources on the at least one storage unit, ascertaining whether a given user is a member of one of the first plurality of groups, and if the given user is a member of the one of the first plurality of groups, ascribing to the given user the user/resource access permissions of the one of the first plurality of groups.
• the grouping users includes identifying a set of user security groups, each of the user security groups having access permissions to at least one of the second multiplicity of computer resources on the at least one storage unit, identifying, for each of the first multiplicity of users, a subset of the user security groups of which the user is a member, and if a first subset of the user security groups, of which a first user of the first multiplicity of users is a member, is identical to a second subset of the user security groups, of which a second user of the first multiplicity of users is a member, grouping the first user and the second user in a single one of the first plurality of groups with respect to the at least one storage unit.
• the grouping users includes dividing the second multiplicity of computer resources into at least two portions, and grouping the users, among the first multiplicity of users, into the first plurality of groups wherein all members of one of the first plurality of groups have at least nearly identical user/resource access permissions to computer resources included in one of the at least two portions.
• the dividing includes for each user of the first multiplicity of users, calculating a fraction of the second multiplicity of computer resources to which the user has access permissions, and comparing the fraction to a threshold value, denoting each user, for whom the fraction is smaller than the threshold value, as a degenerate security group, and defining a first portion of the second multiplicity of computer resources to be the union of all computer resources which include access permissions for any degenerate security group.
• a method for ascertaining access permissions of a first multiplicity of users to a second multiplicity of computer resources on at least one storage unit including grouping resources, among the second multiplicity of computer resources, into a plurality of groups wherein all members of at least one of the plurality of groups have at least nearly identical resource/user access permissions, ascertaining whether a given resource is a member of one of the plurality of groups, and if the given resource is a member of the one of the plurality of groups, ascribing to the given resource the resource/user access permissions of the one of the plurality of groups.
• the computer resources in the second multiplicity of computer resources are arranged in a computer resource hierarchy.
• the grouping resources includes for each resource in the computer resource hierarchy, retrieving the resource/user access permissions of the resource and the resource/user access permissions of an immediate ancestor of the resource in the computer resource hierarchy, and if the resource/user access permissions of the immediate ancestor are identical to the resource/user access permissions of the resource, grouping the resource and the immediate ancestor in a single one of the second plurality of groups.
• the grouping the resource includes providing a pointer from the resource to the immediate ancestor and extending pointers, which point to the resource to point to the immediate ancestor.
• apparatus for ascertaining access permissions of a first multiplicity of users to a second multiplicity of computer resources on at least one storage unit, the apparatus including:
• user grouping functionality operative to group users, among the first multiplicity of users, into a first plurality of groups wherein all members of at least one of the first plurality of groups have at least nearly identical user/resource access permissions to the second multiplicity of computer resources on the at least one storage unit,
• computer resource grouping functionality operative to group computer resources, among the second multiplicity of computer resources, into a second plurality of groups wherein all members of at least one of the second plurality of groups have at least nearly identical resource/user access permissions
• user access permissions ascribing functionality operative to ascertain whether a given user is a member of one of the first plurality of groups, and if the given user is a member of the one of the first plurality of groups, to ascribe to the given user the user/resource access permissions of the one of the first plurality of groups, and
• computer resource access permissions ascribing functionality operative to ascertain whether a given computer resource is a member of one of the second plurality of groups, and if the given computer resource is a member of the one of the second plurality of groups, to ascribe to the given computer resource the resource/user access permissions of the one of the second plurality of groups.
• the user grouping functionality includes user security group identification functionality operative to identify a plurality of user security groups, each of the user security groups having access permissions to at least one of the second multiplicity of computer resources on the at least one storage unit, user security group subset identification functionality operative to identify, for each of the first multiplicity of users, a subset of the user security groups of which the user is a member, and user subset comparison functionality operative to group a first user and a second user in a single one of the first plurality of groups, with respect to the at least one storage unit, if a first subset of the user security groups of which the first user is a member is identical to a second subset of the user security groups of which the second user is a member.
• the apparatus also includes a computer resource dividing functionality operative to divide the second multiplicity of computer resources into at least two portions, and wherein the user grouping functionality is operative to group users, among the first multiplicity of users, into the first plurality of groups wherein all members of one of the first plurality of groups have at least nearly identical user/resource access permissions to computer resources included in one of the at least two portions.
• the computer resource dividing functionality includes fraction calculating functionality operative, for each user of the first multiplicity of users, to calculate a fraction of the second multiplicity of computer resources to which the user has access permissions, and to compare the fraction to a threshold value, user denoting functionality operative to denote each user, for whom the fraction is smaller than the threshold value, as a degenerate security group, and portion defining functionality operative to define a first portion of the second multiplicity of computer resources to be the union of all computer resources which include access permissions for any degenerate security group.
• computer resources in the second multiplicity of computer resources are arranged in a computer resource hierarchy.
• the computer resource grouping functionality includes resource/user access permissions retrieval functionality operative, for each resource in the computer resource hierarchy, to retrieve the resource/user access permissions of the resource and the resource/user access permissions of an immediate ancestor of the resource in the computer resource hierarchy and resource/user access permissions comparison functionality, operative to compare the resource/user access permissions of the resource to the resource/user access permissions of the immediate ancestor, and if the resource/user access permissions of the immediate ancestor are identical to the resource/user access permissions of the given resource, to group the resource and the immediate ancestor in a single one of the second plurality of groups.
• the resource/user access permissions comparison functionality is operative to provide a pointer from the resource to the immediate ancestor and to extend pointers which point to the resource to point to the immediate ancestor.
• apparatus for ascertaining access permissions of a first multiplicity of users to a second multiplicity of computer resources on at least one storage unit including user grouping functionality operative to group users, among the first multiplicity of users, into a first plurality of groups wherein all members of at least one of the first plurality of groups have at least nearly identical user/resource access permissions to the second multiplicity of computer resources on the at least one storage unit, and user access permissions ascribing functionality operative to ascertain whether a given user is a member of one of the first plurality of groups, and if the given user is a member of the one of the first plurality of groups, to ascribe to the given user the user/resource access permissions of the one of the first plurality of groups.
• the user grouping functionality includes user security group identification functionality operative to identify a plurality of user security groups, each of the user security groups having access permissions to at least one of the second multiplicity of computer resources on the at least one storage unit, user security group subset identification functionality operative to identify, for each of the first multiplicity of users, a subset of the user security groups of which the user is a member, and user subset comparison functionality operative to group a first user and a second user in a single one of the first plurality of groups, with respect to the at least one storage unit, if a first subset of the user security groups of which the first user is a member is identical to a second subset of the user security groups of which the second user is a member.
• the apparatus also includes a computer resource dividing functionality operative to divide the second multiplicity of computer resources into at least two portions, and wherein the user grouping functionality is operative to group users, among the first multiplicity of users, into the first plurality of groups wherein all members of one of the first plurality of groups have at least nearly identical user/resource access permissions to computer resources included in one of the at least two portions.
• the computer resource dividing functionality includes fraction calculating functionality operative, for each user of the first multiplicity of users, to calculate a fraction of the second multiplicity of computer resources to which the user has access permissions, and to compare the fraction to a threshold value, user denoting functionality operative to denote each user, for whom the fraction is smaller than the threshold value, as a degenerate security group, and portion defining functionality operative to define a first portion of the second multiplicity of computer resources to be the union of all computer resources which include access permissions for any degenerate security group.
• apparatus for ascertaining access permissions of a first multiplicity of users to a second multiplicity of computer resources on at least one storage unit including computer resource grouping functionality operative to group resources, among the second multiplicity of computer resources, into a second plurality of groups wherein all members of at least one of the second plurality of groups have at least nearly identical resource/user access permissions, and computer resource access permissions ascribing functionality operative to ascertain whether a given computer resource is a member of one of the second plurality of groups, and if the given computer resource is a member of the one of the second plurality of groups, to ascribe to the given computer resource the resource/user access permissions of the one of the second plurality of groups.
• computer resources in the second multiplicity of computer resources are arranged in a computer resource hierarchy.
• the computer resource grouping functionality includes resource/user access permissions retrieval functionality operative, for each resource in the computer resource hierarchy, to retrieve the resource/user access permissions of the resource and the resource/user access permissions of an immediate ancestor of the resource in the computer resource hierarchy and resource/user access permissions comparison functionality, operative to compare the resource/user access permissions of the resource to the resource/user access permissions of the immediate ancestor, and if the resource/user access permissions of the immediate ancestor are identical to the resource/user access permissions of the resource, to group the resource and the immediate ancestor in a single one of the second plurality of groups.
• the resource/user access permissions comparison functionality is operative to provide a pointer from the resource to the immediate ancestor and to extend pointers which point to the resource to point to the immediate ancestor.
• Fig. 1 is a simplified illustration of operation of a preferred embodiment of the present invention in a large organization having a large number of resources and a large number of users;
• Fig. 2 is a simplified flowchart illustrating general methodology for ascertaining access permissions of users to computer resources in a large organization having a large number of resources and a large number of users in accordance with a preferred embodiment of the present invention
• Figs. 3A and 3B taken together, are a simplified flowchart illustrating methodology for grouping users in a large organization based on their access permissions, which methodology forms part of the methodology of Fig. 2;
• Figs. 4A and 4B taken together, are a simplified flowchart illustrating methodology for grouping computer resources in a large organization based on the access permissions to the computer resources, which methodology forms part of the methodology of Fig. 2;
• Figs. 5A, 5B and 5C taken together, are a simplified flowchart illustrating methodology for computing a response to an access permissions query, which methodology forms part of the methodology of Fig. 2.
• Data security policies typically determine who has access to an organization's data, which data is typically stored on various computer systems. These policies are rarely static. This is partly because users from within the organization, such as employees, partners and contractors, can pose a threat to sensitive data as severe as threats from outside the organization. Thus, as the structure and personnel makeup of the organization change ⁇ the security policy should be adjusted accordingly. Information technology departments often find it difficult to manage user data access permissions and to ensure that required information is conveniently available, while protecting the organization's sensitive data.
• Large business organizations may operate computer systems comprising large numbers of servers, which are often geographically distributed. Storage elements in such systems may be accessible by a large numbers of users.
• Various people associated with data access authorizations including information technology personnel, operational personnel such as account managers and third party reviewers such as legal advisors may need to routinely inquire as to user access permissions to specific data.
• Access control technologies have not been optimally implemented in systems that utilize diverse access control models.
• the state of the art today is such that there is no easy way for system administrators to know which users are authorized to access each specific data item in such environments.
• a solution is also lacking for the related problems of redundant access permissions and of orphan accounts belonging to personnel who no longer belong to the organization.
• improvements in controlling user access permissions in order to improve data security, prevent fraud, and improve company productivity.
• misuse of data access permissions, even by authorized users is a concern for those charged with simplification and automation of system security.
• FIG. 1 there is seen a schematic representation of a large organization having a first multiplicity of users and a second multiplicity of computer resources, such as computer files, which may reside on many file servers.
• the users and the file servers may be geographically distributed independently of their function.
• a hierarchical structure of the second multiplicity of computer resources, and/or a grouping of the first multiplicity of users in accordance with their access permissions with respect to computer resources residing on a specific server are employed when responding to access permission queries, thereby allowing for better response times to such queries.
• the term "user/resource access permissions" relates to a list of computer resources, located on a specific server or storage unit, to which the given user has access permissions.
• two users have identical user/resource access permissions if, with respect to a specific server or storage unit, both users have access permissions to an identical list of computer resources located on that server or storage unit.
• resource/user access permissions relates to a list of users with access permissions to the given computer resource.
• resource/user access permissions two computer resources have identical resource/user access permissions if an identical list of users has access permissions to both computer resources.
• access permissions relates to reading permissions, writing permissions and executing permissions, or any combination thereof. For example, a given user has access permissions to a given resource if the user has reading permissions to the given resource, even if the user does not have writing permissions or executing permissions to the given resource.
• a first plurality of groups of users is defined, wherein all members of each one of the first plurality of groups of users have at least nearly identical user/resource access permissions to the computer resources on a given file server 106.
• a second plurality of groups of computer resources is defined, wherein all members of each one of the second plurality of groups of computer resources have at least nearly identical resource/user access permissions, for example each computer file in a given group is accessible by an identical or nearly identical group of users.
• all files relating to accounts payable may be members of the same computer resource group, here designated by the letter 'a'.
• all files relating to development of a door may be members of the same computer resource group, here designated by the letter 'd'.
• all members of each user group have at least nearly identical user/resource access permission profiles. For example, all members of user group A have access to the company's accounts and all members of user group D have access to the engineering files.
• all members of each computer resource group have at least nearly identical resource/user access permission profiles, for example all members of computer resource group 'a' are accessible by bookkeepers and all members of computer resource group'd' are accessible by design engineers.
• FIG. 2 is a simplified flowchart illustrating general methodology for ascertaining access permissions of users to computer resources in a large organization having a large number of resources and a large number of users in accordance with a preferred embodiment of the present invention.
• a first preparatory stage users in the organization are divided into groups based on their access permissions with respect to a given server in the organization, as seen at step 200. Specifically, for each server, users in the organization are divided into a plurality of user groups, wherein users in each group have similar or preferably identical access permissions with respect to files in the server. The methodology for grouping the users is described in further detail hereinbelow with reference to Fig. 3.
• the computer resources of the organization are grouped based on the access permissions thereto. Specifically, in a hierarchical server system, unless otherwise specified, a computer resource has the same access permissions as the direct ancestor thereof.
• computer resources may be grouped such that each descendant computer resource, which has access permissions identical to those of its ancestor computer resource, points to the access control list of its ancestor, rather than duplicating that access control list.
• the methodology for grouping the computer resources is described in further detail hereinbelow with reference to Fig. 4.
• grouping of users of step 200 and grouping of computer resources of step 202 may be carried out in any sequence, or in parallel, and preferably is performed periodically, in order to account for changes in user access permissions and/or in the hierarchical structure of the computer resources in the organization.
• an access permissions query is presented, typically by a member of the organization or a department thereof, as seen at step 204.
• a typical query would comprise a subset of users and a subset of storage elements.
• a response to such a query would list, for each user in the subset of users, access permissions to each of the storage elements in the subset of storage elements.
• one query may include all the users in the organization as the user subset, and a given computer resource as the storage element subset. A response to this query would identify all the users who have permission to access the given computer resource.
• the query may include all of the computer resources of the organization as the storage element subset, and a given user as the user subset. A response to this query would identify all the storage elements, which may be accessed by the given user.
• the query is processed and a response thereto is computed.
• the response to the query includes, for each user listed in the query, a list of a sub-group of the computer resources listed in the query to which the user has access.
• the methodology for computing the response to the query is described in further detail hereinbelow with reference to Fig. 5.
• the response to the query is then forwarded to the person or party who presented the access permissions query, indicated as step 208.
• Figs. 3A and 3B are a simplified flowchart illustrating methodology for grouping users in a large organization based on their access permissions, which methodology constitutes the first preparatory stage 200 of the methodology of Fig. 2.
• the goal of such grouping is to create user groups, wherein users in a single user group have similar, or preferably identical, access permissions with respect to computer resources stored on a given server.
• a prerequisite for the creation of such user groups is the definition of user security groups, which is carried out prior to first step 300 of Fig. 3A.
• User security groups are pre-defined by the system administrator. Typically, user security groups correspond to different departments within the organization. User security groups may include, for example, an accounting user security group, a research and development user security group, etc. Each respective user security group includes those users who belong to the department to which the user security group corresponds. Users may belong to more than one user security group. For example, the secretary of a research and development department may belong to an administrative user security group and a research and development user security group.
• Each user security group has pre-assigned access permissions to computer resources on a given server.
• An access control list for a given computer resource is a list of user security group access permissions to that computer resource.
• a server is selected, as seen at step 300. It is appreciated that the users will be grouped only with respect to their access permissions to computer resources residing on the selected server.
• the access control list for computer resources which reside on the selected server is reviewed, in order to extract those user security groups, and hence those users belonging to those user security groups, with permission to access at least some of the computer resources stored on the server, as seen at step 302.
• the users' access permissions to computer resources stored on the selected server are compared to check whether they are identical with respect to all computer resources stored on the selected server as seen at decision step 304. If both users in the pair have identical access permissions to computer resources stored on the selected server they are assigned to the same initial user group with respect to the selected server, as seen at step 306. Otherwise, they are assigned to two different initial user groups with respect to the selected server, as seen at step 308.
• the initial user groups are pre-runners of the user groups that this methodology seeks to create.
• the initial user groups may require further refinement, as described below, to arrive at the desired final user groups. It is appreciated that two users may have very similar access permissions on the selected server, other than one or two specific computer resources to which their access permissions differ. This may happen, for example, when the server includes some users' home directories, in which case two users could have identical access permissions to all computer resources in the server other than the home directories, for which each user would have access permission to his or her own specific home directory, but would generally not have access permission to other users' home directories.
• This situation may cause the server to be grouped into many small initial user groups or even singletons, even though there are larger potential initial user groups with very similar, although not identical, access permissions. As will be described hereinbelow, this situation may be overcome by virtually dividing the computer resources on the server into two or more virtual servers.
• the number of resulting initial user groups and the sizes thereof are reviewed.
• the number of initial user groups is compared to a first predetermined threshold number, as seen at decision step 310, and the number of singleton initial user groups is compared to a second predetermined threshold number, as seen at decision step 312. If the number of initial user groups does not exceed the first threshold number and if the number of singleton initial user groups does not exceed the second threshold number the user assignment is complete.
• the initial user groups and singletons now constitute user groups, as referred to above, specifically in reference to step 200 of Fig. 2.
• Fig. 3B it is seen that if the number of initial user groups exceeds the first threshold number, and/or if the number of singleton initial user groups exceeds the second threshold number, the server is divided into two virtual servers, as seen at step 314.
• the number of computer resources stored on the server to which the specific user or user security group is permitted access is established, as seen at step 316.
• the fraction of computer resources to which the specific user or user security group is permitted access is then calculated and compared to a fraction threshold value, such as 1%, as seen at decision step 318.
• the user or user security group is denoted as a degenerate security group, as seen at step 320. Otherwise, the user or user security group is denoted as an important security group, as seen at step 322.
• the union of computer resources including access permissions for the degenerate security groups is defined as one virtual server, denoted a disorganized virtual server, as seen at step 324.
• the disorganized virtual server is assumed to include few computer resources with similar access control lists and/or few users with identical access permissions. Assignment of users to initial user groups based on the computer resources in the disorganized virtual server is likely to result in a large number of initial user groups and/or singleton initial user groups and is inefficient and therefore unnecessary.
• the computer resources on the server which do not belong to the disorganized virtual server are defined as a second virtual server, denoted an organized virtual server, as seen at step 326.
• the organized virtual server is assumed to include files with similar access control lists, such that assignment of users to initial user groups based on their access permissions to computer resources in this virtual server is likely to result in a small number of organized initial user groups.
• the organized virtual server is selected as the server with respect to which users will be assigned to initial user groups, as seen at step 328. Subsequently, users are assigned to initial user groups again based on their access permissions to computer resources stored on the organized virtual server, as described hereinabove with reference to steps 302 to 308.
• These initial user groups and singleton initial user groups now constitute user groups, as referred to above, specifically in reference to step 200 of Fig. 2.
• Figs. 4A and 4B are a simplified flowchart illustrating methodology for grouping computer resources in a large organization based on access permissions to the computer resources, which methodology constitutes the second preparatory stage 202 of the methodology of Fig. 2.
• a node of the computer resource hierarchy is selected for processing, as seen at step 400.
• the computer resource hierarchy is processed from the leaves to the root, in which case the first nodes selected for processing are the leaves, or nodes at the lowest level of the computer resource hierarchy.
• the existence of an immediate ancestor thereof in the hierarchy is checked, as seen at decision step 402. If the selected node does not have an immediate ancestor, it is deduced to be the root of the hierarchy. The node is designated as a distinct node as seen at step 404, and the process is finished. Otherwise, the access control list of the node is extracted as seen at step 405, and the access control list of the immediate ancestor of the selected node is extracted as seen at step 406. The access control lists of the selected node and of its immediate ancestor are subsequently compared, as seen at decision step 408.
• a pointer which points from the selected node to the access control list of its immediate ancestor is added to the hierarchy, as seen at step 410. Additionally, all pointers pointing to the access control list of the selected node are moved to point to the access control list of the immediate ancestor of the selected node, as seen at step 412, and a processing indication, indicating that the node has been processed, is added to the selected node, as seen at step 414.
• the node is designated as a distinct node as seen at step 416, and a processing indication, indicating that the node has been processed, is added to the selected node, as seen at step 418.
• the level of the hierarchy to which the selected node belongs is reviewed in order to determine if there are any unprocessed nodes at that level, as seen at decision step 420. If there are any unprocessed nodes at the level of the selected node, a new node at that level is selected as seen at step 422, and the processing of that node proceeds as described hereinabove with reference to steps 402-418. Otherwise, a node which is located one level higher in the hierarchy than the selected node, such as the immediate ancestor of the selected node, is selected, as seen at step 424, and the processing thereof proceeds as described hereinabove with reference to steps 402-418.
• Figs. 5 A, 5B and 5C are a simplified flowchart illustrating methodology for computing a response to an access permissions query, which methodology constitutes step 206 of the methodology of Fig. 2.
• a group of computer resources to be processed is defined, as seen at step 500.
• the group is typically empty and is populated during the processing of the query.
• step 501 is performed for each computer resource included in the query, to detect all of the distinct computer resource nodes included in the query.
• step 502 for each computer resource included in the query, it is detected whether it comprises a distinct node of the computer resource hierarchy.
• the computer resource does comprise a distinct node of the computer resource hierarchy, it is added to the group of computer resources to be processed, as seen at step 504. If the computer resource does not comprise a distinct node, the pointer associated therewith is followed to an ancestor node that comprises a distinct node, as seen at step 506.
• step 508 it is established if the computer resource comprising the ancestor node that comprises a distinct node has been previously added to the group of computer resources to be processed. If the computer resource comprising the ancestor node has been not previously added to the group of computer resources to be processed, it is now added to the group, as seen at step 510. If the computer resource comprising the ancestor node has been previously added to the group of computer resources to be processed, it is not added to the group a second time, but is associated, in the group of computer resources to be processed, with the currently processed computer resource, in order to enable the provision of a complete query response, as seen at step 512. This is typically achieved by defining a pointer which points from the currently processed computer resource to the instance of the distinct ancestor which is included in the group of computer resources to be processed.
• a user included in the query whose access permissions will now be processed, is selected.
• a computer resource which is included in the group of resources to be processed, is selected, and the physical server on which it resides is ascertained, as seen at step 515.
• the specific user group to which the user belongs, with respect to the server on which the computer resource resides is ascertained, as seen at step 516. It is then checked whether, during the processing of this computer resource, the access permissions of another user belonging to the same specific user group have been computed, as seen at decision step 518.
• the computed access permissions are assigned to the present user, as seen at step 520. Otherwise, the access permissions of the user, and/or of the user group to which the user belongs, to the computer resource, are extracted from the access control list associated with the computer resource, as seen at step 522.
• a computer resource exists, that computer resource is selected, as seen at step 526, and is processed with respect to the selected user as described hereinabove with reference to steps 515 to 522. If no such computer resource exists, it is checked whether there are any users included in the query whose access permissions have not yet been computed, as seen at decision step 528. If such a user exists, that user is selected, as seen at step 530, and processing of access permissions thereof proceeds as described hereinabove with reference to steps 514 to 522.
• a response to the query which comprises a paired list including a pair for each user and each computer resource included in the original query. It is appreciated that when generating such a query response, the results for each computer resource which comprises a distinct node ancestor for more than one of the computer resources included in the query are provided multiple times, in order to provide a query response for each computer resource included in the query.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Computer Hardware Design (AREA)
• Computer Security & Cryptography (AREA)
• General Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Software Systems (AREA)
• General Health & Medical Sciences (AREA)
• Bioethics (AREA)
• Health & Medical Sciences (AREA)
• Automation & Control Theory (AREA)
• Computing Systems (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)

Priority Applications (4)

Applications Claiming Priority (1)

Publications (1)

Family

ID=46382381

Family Applications (1)

Country Status (3)

Cited By (5)

Families Citing this family (5)

Citations (3)

Family Cites Families (3)

• 2010
  • 2010-12-29 EP EP10861449.6A patent/EP2659351A4/en not_active Withdrawn
  • 2010-12-29 CN CN201611141689.5A patent/CN106650508A/zh active Pending
  • 2010-12-29 WO PCT/IL2010/001090 patent/WO2012090189A1/en active Application Filing
  • 2010-12-29 CN CN201080071011.9A patent/CN103299268B/zh active Active

Patent Citations (3)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events