Data processing: database and file management or data structures – Database design – Data structure types
Reexamination Certificate
1998-10-21
2002-04-02
Corrielus, Jean M. (Department: 2172)
Data processing: database and file management or data structures
Database design
Data structure types
C707S793000, C707S793000, C707S793000, C707S793000, C709S201000, C709S242000, C709S244000
Reexamination Certificate
active
06366913
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Technical Field
The invention relates to a method of improving administration and management of services provided in a network. More specifically, the invention relates to defining groups of users who access network services, or are provided network services, in such a way as to determine membership only when the service is requested or about to be provided, and to determine this membership based on a flexible specification of user or object attributes.
2. Description of the Prior Art
Traditional methods of identifying groups of users who are to receive network services can be classified as follows:
A group may be comprised of a list of members belonging to the group.
A user may be identified as a member of a group by having a specific attribute with a specific value identifying the user as a member of the group.
Static Lists
The Unix file system supports a groups permission model to specify who may access various files (and directories.) Each file is owned by a specific user and group. To determine whether a user can access a file, the user must be identified as its owner or must be in the list of users who belong to the group which owns the file.
Electronic mailing lists are maintained to allow electronic mail to be distributed to all users who are listed as members of the list. Systems such as majordomo implement mechanisms to maintain membership in the list on a user-by-user basis.
Calendaring software, such as Corporate Time from Corporate Software & Technologies Int. Inc., supports specific groups of users who may modify the schedule to a room or network resource, or who may be invited to a particular meeting.
While all of the above groups may contain other groups, they all require specific maintenance of membership information about the group. Specifically, whomever is a member of the group to receive access or service must be explicitly listed in the group itself, or as a member of a group which is listed as a member. Each time a user enters or exits an organization, the user must be specifically added to all appropriate groups, or specifically removed from such groups. As the number of different groups in an organization grows, this can be a major administrative burden.
While removal of user names from all groups can be automated, it is more difficult to automate entering users in all appropriate groups. Typically, information about who should and should not be entered in a group is distributed throughout an organization, and services for a new user can be made available relatively haphazardly, depending on when the administrative entity responsible for each group learns about a user and their need for service. In the case of mailing lists, an information service (for example) may never be made available to a user if the administrator fails to know that the user is entitled to the information (such as a contractor working in a building may not be entered in the mailing list for people who work in the building because the contractor is not administered by the same entity as everyone else in the building.)
Group Attributes
An alternative method of identifying group membership consists of adding specific group identification information to the collection of information about a user.
An example of physical group attribute identification involves issuing an employee identification badge or key. The user can be granted a service or admitted to a building upon presentation of the badge or by using the key to open a lock. In this case, control of a user's right to access requires providing or confiscating a physical token (the badge or key.)
Electronic badge sensor systems can now communicate to a centralized service to check whether the badge bearer can access a service or system. This access, however, is usually granted to a list of badges—which is identical to the group list method described above.
In digital certificate technology, groups can be identified as those people possessing certificates that have been signed by a specific certification authority (CA). For example, all company employees may be identified as those who possess certificates signed by the company CA. There is no need to consult a static list to determine membership in the company (the CA's signature is verified using algorithmic means.) While this is a very scaleable mechanism for identifying group membership it remains relatively rigid, i.e. the person is a member of the group or not.
It would be advantageous to provide a technique for defining groups of users who access network services, or are provided network services, in such a way as to determine membership only when the service is requested or about to be provided, and to determine this membership based on a flexible specification of user or object attributes.
SUMMARY OF THE INVENTION
The invention herein provides a technique, referred to as dynamic group membership, which is based on a more flexible model of specifying group membership. Specifically, a group member can be determined by whether the information maintained in a centralized directory service matches an arbitrary specification. Thus, instead of checking to see whether a user possesses a specific group attribute, dynamic group membership is determined by checking any user attribute.
REFERENCES:
patent: 4925311 (1990-05-01), Neches et al.
patent: 5677851 (1997-10-01), Kingdon et al.
patent: 5687167 (1997-11-01), Bertin et al.
patent: 5694393 (1997-12-01), Kaye
patent: 5748736 (1998-05-01), Mittra
patent: 5787442 (1998-07-01), Hacherl et al.
patent: 5991393 (1999-11-01), Kamen
patent: 5991807 (1999-11-01), Schmidt et al.
patent: 6018766 (2000-01-01), Samuel et al.
patent: 6049799 (2000-04-01), Mangat et al.
patent: 6061499 (2000-05-01), Hlebovy
patent: 6065054 (2000-05-01), Dutcher et al.
patent: 6092199 (2000-07-01), Dutcher et al.
patent: 6105027 (2000-08-01), Schneider et al.
patent: 6192362 (2001-02-01), Schneck et al.
Dinsmore et al. “Policy based security management for large dynamic groups” pp. 64-73.*
Caronni et al., “Efficient security for large and dynamic multicast groups” pp. 376-383.*
Shaw-Cheng Chuang, “A flexible and secure multicast architecture for ATM networks” pp. 701-707.
Fitler, Jr. William H.
Howes Timothy A.
Steinback Bruce L.
Corrielus Jean M.
Glenn Michael A.
Netscape Communications Corporation
LandOfFree
Centralized directory services supporting dynamic group... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Centralized directory services supporting dynamic group..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Centralized directory services supporting dynamic group... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2888820