Patent · US Expired

Access control subsystem and method for distributed computer system using compound principals

US5173939A · kind A · utility

150Cited by
6References
14Claims
0Family size

Assignee

Inventors

Key dates

Filing dateOct 28, 1991
Grant dateDec 22, 1992
Priority date
Expiry dateOct 28, 2011

Classification

  • Technology area (CPC Y)Emerging Cross-Sectional Technologies
  • CPC primaryY10S707/99939
  • WIPO fieldComputer technology
  • WIPO sectorElectrical engineering

Abstract

A distributed computer system has a number of computers coupled thereto at distinct nodes and a naming service with a membership table that defines a list of assumptions concerning which principals in the system are stronger than other principals, and which roles adopted by principals are stronger than other roles. Each object in the system has an access control list (ACL) having a list of entries. Each entry is either a simple principal or a compound principal. The set of allowed compound principals is limited to a predefined set of allowed combinations of simple principals, roles, delegations and conjunctions in accordance with a defined hierarchical ordering of the conjunction, delegation and role portions of each compound principal. The assumptions in the membership table reduce the number of entries needed in an ACL by allowing an entry to state only the weakest principals and roles that are to be allowed access. The reference checking process, handled by a reference monitor found at each node of the distributed system, grants an access request if the requestor is stronger than any one of the entries in the access control list for the resource requested. Furthermore, one entry…

Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.