Back to results
US 7,890,998 B2Granted
System and method for selective authentication when acquiring a role
AssigneeInternational Business Machines Corporation
InventorsYantian Tom Lu, Thomas Walters Drew
Life of this patent
Estimating the term…
Abstract
A system, method, and program product is provided that provides authentication on a per-role basis in a Role-Based Access Control (RBAC) environment. When a user attempts to acquire a role, the improved RBAC system determines whether (a) no authentication is required (e.g., for a non-sensitive role such as accessing a company's product catalog), (b) a user-based authentication (e.g., password) is required, or (c) a role-based authentication (e.g., role-specific password is required).
Claims17
A computer-implemented method comprising:
- receiving a role request for a user of a computer system, wherein the role request corresponds to a plurality of selected roles requested by the user, wherein a plurality of roles were previously established on the computer system, and wherein each of the established plurality of roles corresponds to one or more functions performed by the computer system;
- retrieving a plurality of authentication modes corresponding to the plurality of selected roles requested by the user, wherein each of the retrieved authentication modes either indicates a role-based authentication requirement or a user-based authentication requirement;
- storing in a data structure a non-duplicate list of the plurality of authentication modes corresponding to the plurality of selected roles requested by the user;
- in response to a first plurality of the retrieved authentication modes indicating the role-based authentication requirement:
- receiving a plurality of role-based authentication tokens from the user, wherein each received role-based authentication token corresponds to one of the first plurality of the retrieved authentication modes;
- for each received role-based authentication token, granting the user access to a requested role corresponding to the received role-based authentication token in response to the received role-based authentication token matching an expected role-based authentication token;
- and
- for each received role-based authentication token, denying the user access to the requested role corresponding to the received role-based authentication token in response to the received role-based authentication token not matching the expected role-based authentication token;
- and
- in response to a second plurality of the retrieved authentication modes indicating the user-based authentication requirement:
- receiving a single user-based authentication token from the user, based on the non-duplicate list of the plurality of authentication modes in the data structure;
- granting the user access to a plurality of requested roles corresponding to the received single user-based authentication token in response to the received single user-based authentication token matching an expected user-based authentication token;
- and
- denying the user access to the plurality of requested roles corresponding to the received single user-based authentication token in response to the received single user-based authentication token not matching the expected user-based authentication token.
11 more elements
A information handling system comprising:
- one or more processors;
- a memory accessible by at least one of the processors;
- a nonvolatile storage area accessible by at least one of the processors;
- a set of instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
- receiving a role request for a user of a computer system, wherein the role request corresponds to a plurality of selected roles requested by the user, wherein a plurality of roles were previously established on the computer system, and wherein each of the established plurality of roles corresponds to one or more functions performed by the computer system;
- retrieving a plurality of authentication modes corresponding to the plurality of selected roles requested by the user, wherein each of the retrieved authentication modes either indicates a role-based authentication requirement or a user-based authentication requirement;
- storing in a data structure a non-duplicate list of the plurality of authentication modes corresponding to the plurality of selected roles requested by the user;
- in response to a first plurality of the retrieved authentication modes indicating the role-based authentication requirement:
- receiving a plurality of role-based authentication tokens from the user, wherein each received role-based authentication token corresponds to one of the first plurality of the retrieved authentication modes;
- for each received role-based authentication token, granting the user access to a requested role corresponding to the received role-based authentication token in response to the received role-based authentication token matching an expected role-based authentication token;
- and
- for each received role-based authentication token, denying the user access to the requested role corresponding to the received role-based authentication token in response to the received role-based authentication token not matching the expected role-based authentication token;
- and
- in response to a second plurality of the retrieved authentication modes indicating the user-based authentication requirement:
- receiving a single user-based authentication token from the user, based on the non-duplicate list of the plurality of authentication modes in the data structure;
- granting the user access to a plurality of requested roles corresponding to the received single user-based authentication token in response to the received single user-based authentication token matching an expected user-based authentication token;
- and
- denying the user access to the plurality of requested roles corresponding to the received single user-based authentication token in response to the received single user-based authentication token not matching the expected user-based authentication token.
15 more elements
A computer program product stored in a computer readable storage medium, comprising functional descriptive material that, when executed by an information handling system, causes the information handling system to perform actions comprising:
- receiving a role request for a user of a computer system, wherein the role request corresponds to a plurality of selected roles requested by the user, wherein a plurality of roles were previously established on the computer system, and wherein each of the established plurality of roles corresponds to one or more functions performed by the computer system;
- retrieving a plurality of authentication modes corresponding to the plurality of selected roles requested by the user, wherein each of the retrieved authentication modes either indicates a role-based authentication requirement or a user-based authentication requirement;
- storing in a data structure a non-duplicate list of the plurality of authentication modes corresponding to the plurality of selected roles requested by the user;
- in response to a first plurality of the retrieved authentication modes indicating the role-based authentication requirement:
- receiving a plurality of role-based authentication tokens from the user, wherein each received role-based authentication token corresponds to one of the first plurality of the retrieved authentication modes;
- for each received role-based authentication token, granting the user access to a requested role corresponding to the received role-based authentication token in response to the received role-based authentication token matching an expected role-based authentication token;
- and
- for each received role-based authentication token, denying the user access to the requested role corresponding to the received role-based authentication token in response to the received role-based authentication token not matching the expected role-based authentication token;
- and
- in response to a second plurality of the retrieved authentication modes indicating the user-based authentication requirement:
- receiving a single user-based authentication token from the user, based on the non-duplicate list of the plurality of authentication modes in the data structure;
- granting the user access to a plurality of requested roles corresponding to the received single user-based authentication token in response to the received single user-based authentication token matching an expected user-based authentication token;
- and
- denying the user access to the plurality of requested roles corresponding to the received single user-based authentication token in response to the received single user-based authentication token not matching the expected user-based authentication token.
11 more elements
Dependencies are inferred from the claim text.