Method and system for assigning access rights in a computer system
AssigneeInternational Business Machines Corporation
InventorRuediger Kern
Life of this patent
Estimating the term…
Abstract
The invention relates to a system and a method for assigning access rights in a computer system. The system transforms an existing system of access rights to a more structured system. In many cases this is a prerequisite such that role-based administration can be used. The method identifies the existing system of access rights and identifies new roles by means of a correlation approach. New roles are created and all old roles are deleted. All direct access rights are avoided making an administration of the system easier and the computer system more secure.
Claims23
A system for assigning access rights to at least one subject on at least one object in a computer system, wherein said subject is associated with at least one role, said system comprising:
- a) means for identifying all access rights which have already been granted to said subject, including:
- a1) access rights said subject has because it is a member of an existing role (old role), wherein said role has been granted access rights, and
- a2) access rights said subject has irrespective of its membership in said existing role;
- b) means for identifying new roles;
- c) means for granting access rights to said new roles;
- d) means for assigning said at least one subject to at least one new role;
- and
- e) means for deleting old roles.
A method for assigning access rights to at least one subject on at least one object in a computer system, wherein said subject is associated with at least one role, said method comprising the steps of:
- a) identifying all access rights which have already been granted to said subject, including:
- a1) access rights said subject has because it is member of an existing role (old role), and wherein said role has been granted access rights, and
- a2) access rights said subject has irrespective of its membership in said existing role;
- b) identifying new roles;
- c) granting access rights to said new roles;
- d) assigning said at least one subject to at least one new role;
- and
- e) deleting all old roles.
A system for assigning access rights to at least one subject on at least one object in a computer system, wherein said subject is associated with at least one role, said system comprising:
- a) means for identifying all access rights which have already been granted to said subject;
- b) means for identifying new roles;
- c) means for granting access rights to said new roles;
- d) means for assigning said at least one subject to at least one new role;
- and
- e) means for deleting old roles.
A method for assigning access rights to at least one subject on at least one object in a computer system, wherein said subject is associated with at least one role, said method comprising the steps of:
- a) identifying all access rights which have already been granted to said subject;
- b) identifying new roles;
- c) granting access rights to said new roles;
- d) assigning said at least one subject to at least one new role;
- and
- e) deleting all old roles.
Dependencies are inferred from the claim text.