Method and system for providing user access control within a distributed data processing system by the exchange of access control profiles

Patent 5263157 Issued on November 16, 1993. Estimated Expiration Date:

November 16, 2010. Estimated Expiration Date is calculated based on simple USPTO term provisions. It does not account for terminal disclaimers, term adjustments, failure to pay maintenance fees, or other factors which might affect the term of a patent.

Abstract Claims Description Full Text

Patent References

Distributed data processing system
Patent #: 4145739
Issued on: 03/20/1979
Inventor: Dunning , et al.

Data processing system
Patent #: 4325120
Issued on: 04/13/1982
Inventor: Colley , et al.

Data processing system having a memory using object-based information and a protection scheme for determining access rights to such information
Patent #: 4525780
Issued on: 06/25/1985
Inventor: Bratt , et al.

Mechanical handling apparatus
Patent #: 4543638
Issued on: 09/24/1985
Inventor: Scarffe

Method and system for providing system security in a remote terminal environment
Patent #: 4652698
Issued on: 03/24/1987
Inventor: Hale , et al.

Funtionally structured distributed data processing system
Patent #: 4714989
Issued on: 12/22/1987
Inventor: Billings

Distributed control of alias name usage in networks
Patent #: 4718005
Issued on: 01/05/1988
Inventor: Feigenbaum , et al.

License mangagement system and license storage key
Patent #: 4924378
Issued on: 05/08/1990
Inventor: Hershey, et al.

Network license server
Patent #: 5023907
Issued on: 06/11/1991
Inventor: Johnson, et al.

Distributed security auditing subsystem for an operating system Patent #: 5032979
Issued on: 07/16/1991
Inventor: Hecht, et al.

Inventor

Janis, Frederick L.

Application

No. 480437 filed on 02/15/1990

US Classes:

707/9, Privileged access709/217, REMOTE DATA ACCESSING713/167Object protection

Examiners

Primary: Lee, Thomas C.
Assistant: Lintz, Paul R.

Attorney, Agent or Firm

Dillon; Andrew J.

International Class

G06F 015/40

Abstract

A method is disclosed for providing user access control for a plurality of resource objects within a distributed data processing system having a plurality of resource managers. A reference monitor service is established and a plurality of access control profiles are stored therein. Thereafter, selected access control profiles are exchanged between the reference monitor service and a resource manager in response to an attempted access of a particular resource object controlled by that resource manager. The resource manager may then control access to the resource object by utilizing the exchanged access control profile. In a preferred embodiment of the present invention, each access control profile may include access control information relating to a selected user; a selected resource object; a selected group of users; a selected set of resource objects; or, a predetermined set of resource objects and a selected group of users.