Method and system for managing security objects

A method for managing, in a computer system network, access by a user to a resource, comprising:

• receiving a message that the user is requesting an access to the resource, the access being associated with a requested access level, the access being granted if there exists an access path between the user and the resource for the requested access level, the access path comprising:
• an identity annunciator that represents an identity of the user;
• and
• an access control descriptor that represents an authorized access level up to which the user represented by the identity annunciator is authorized to access the resource or a group of resources comprising the resource;
• where the identity annunciator and the access control descriptor are both security objects each comprising a flag to represent its usage in authorizing access to resources;
• storing in a record, in response to the message reception, a first identifier of the user, a second identifier of the resource, the requested access level, and a first value that represents that the access to the resource was requested;
• identifying all access paths usable to determine whether the user is authorized to access the resource with the requested access level;
• setting the flag of the security objects of each identified access path to the first value;
• receiving another security object comprising a flag to represent its usage in authorizing access to the resources;
• and
• making a decision with respect to whether the received other security object was used within one of the identified access paths as a function of its flag value.

An apparatus for managing, in a computer system network, access by a user to a resource, comprising:

• a memory;
• and
• a processor programmed to:
• receive a message that the user is requesting an access to the resource, the access being associated with a requested access level, the access being granted if there exists an access path between the user and the resource for the requested access level, the access path comprising:
• an identity annunciator that represents an identity of the user;
• and
• an access control descriptor that represents an authorized access level up to which the user represented by the identity annunciator is authorized to access the resource or a group of resources comprising the resource;
• where the identity annunciator and the access control descriptor are both security objects each comprising a flag to represent its usage in authorizing access to resources;
• store in a record in the memory, in response to the message reception, a first identifier of the user, a second identifier of the resource, the requested access level, and a first value that represents that the access to the resource was requested;
• identify all access paths usable to determine whether the user is authorized to access the resource with the requested access level;
• set the flag of the security objects of each identified access path to the first value;
• receive another security object comprising a flag to represent its usage in authorizing access to the resources;
• and
• make a decision with respect to whether the received other security object was used within one of the identified access paths as a function of its flag value.

A computer program product for managing, in a computer system network, access by a user to a resource comprising a computer readable storage medium including computer readable program code, where the computer readable program code when executed on a computer causes the computer to:

• receive a message that the user is requesting an access to the resource, the access being associated with a requested access level, the access being granted if there exists an access path between the user and the resource for the requested access level, the access path comprising:
• an identity annunciator that represents an identity of the user;
• and
• an access control descriptor that represents an authorized access level up to which the user represented by the identity annunciator is authorized to access the resource or a group of resources comprising the resource;
• where the identity annunciator and the access control descriptor are both security objects each comprising a flag to represent its usage in authorizing access to resources;
• store in a record, in response to the message reception, a first identifier of the user, a second identifier of the resource, the requested access level, and a first value that represents that the access to the resource was requested;
• identify all access paths usable to determine whether the user is authorized to access the resource with the requested access level;
• set the flag of the security objects of each identified access path to the first value;
• receive another security object comprising a flag to represent its usage in authorizing access to the resources;
• and
• make a decision with respect to whether the received other security object was used within one of the identified access paths as a function of its flag value.