Privilege management
AssigneeInternational Business Machines Corporation
InventorsGeorge Mathew Koikara, Vidya Ranganathan
Life of this patent
Estimating the term…
Abstract
A computer implemented method, apparatus, and computer program product for managing privileges on a data processing system. The process initiates a privilege monitor. All other entities in the data processing system are prevented from assigning privileges. The privilege monitor is the only entity authorized to assign privileges. The process monitors for requests for privileges. In response to detecting a request from a user for a privilege, the process selectively assigns the privilege to the user through the privilege monitor.
Claims19
A computer implemented method for managing privileges on a data processing system that is a multi level security system, the computer implemented method comprising:
- including a role-based access control interface;
- including a privilege monitor that is separate and apart from the role-based access control interface, wherein all other entities in the data processing system including the role-based access control interface are prevented from assigning privileges, and wherein the privilege monitor is the only entity authorized to assign privileges;
- monitoring, by one or more processors, for requests for privileges;
- and
- responsive to detecting, by the one or more processors, a request from a user for a privilege, selectively assigning the privilege to the user through the privilege monitor, wherein assigning privileges by the privilege monitor is a kernel space process, wherein the privilege monitor is associated with the user.
A computer program product comprising:
- a non-transitory computer usable medium including computer usable program code for managing privileges in a data processing system that is a multi level security system, said computer program product including:
- computer usable program code for including a role-based access control interface;
- computer usable program code for including a privilege monitor that is separate and apart from the role-based access control, wherein all other entities in the data processing system including the role-based access control interface are prevented from assigning privileges, and wherein the privilege monitor is an only entity authorized to assign privileges;
- computer usable program code for monitoring for requests for privileges;
- and
- computer usable program code for responsive to detecting a request from a user for a privilege, selectively assigning the privilege to the user through the privilege monitor, wherein assigning privileges by the privilege monitor is a kernel space process, wherein the privilege monitor is associated with the user.
A data processing system apparatus, which is a multi-level security system, the data processing system apparatus comprising:
- a bus system;
- a communications system connected to the bus system;
- a memory connected to the bus system, wherein the memory includes computer usable program code;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the computer usable program code to include a role-based access control interface;
- include a privilege monitor that is separate and apart from the role-based access control interface, wherein all other entities in the data processing system including the role-based access control interface are prevented from assigning privileges, and wherein the privilege monitor is the only entity authorized to assign privileges;
- monitor for requests for privileges;
- and selectively assign the privilege to a user through the privilege monitor, in response to detecting a request from the user for a privilege, wherein assigning privileges by the privilege monitor is a kernel space process, wherein the privilege monitor is associated with the user.
Dependencies are inferred from the claim text.