Controlling access rights to network resources based on a hierarchical arrangement of security sets
View Patent ↗Mechanisms for securing access to network resources are described. The mechanisms may perform operations for securing access to a network element and which can include associating a network element with a set of data, and configuring a portion of the data to be responsive to a first subset of access rights. The mechanisms may further perform operations for selection an appropriate security to govern access by a user to network resources.
1. A method, in a data processing system comprising at least one hardware processor, for securing access to an element of a network comprising:
associating, the at least one hardware processor, the element with a set of data;
configuring, by the at least one hardware processor, a portion of the data to be responsive to a first subset of access rights;
generating, by the at least one hardware processor, a request by a user to acquire a first type of access;
determining, by the at least one hardware processor, whether to permit the first type of access;
associating, by the at least one hardware processor, at least the portion of the data with a first node of a hierarchical data structure;
defining, by the at least one hardware processor, a first security set as including the first subset of access rights associated with the user;
associating, by the at least one hardware processor, the first security set with a second node of the hierarchical data structure, wherein the second node is at a higher level of the hierarchical data structure than is the first node; and
propagating, by the at least one hardware processor, the first subset of access rights through inheritance from the second node to the first node.
2. The method of claim 1 further comprising permitting a first type of access to the portion of the data if a first access right of the first subset of access rights is granted.
3. The method of claim 1 further comprising prohibiting a second type of access to the portion of the data if a second type of the first subset of access rights is denied.
4. The method of claim 2 wherein the first access right is one of a view access right, an add access right, a modify access right and a delete access right.
5. The method of claim 1 , further comprising overriding the first subset of access rights inherited from the second node.
6. The method of claim 5 wherein overriding the first subset further comprises:
defining a second security set as including a second subset of access rights associated with the user;
associating the second security set with an intervening node of the hierarchical data structure; and
propagating the second subset of access rights to the first node,
wherein the intervening node is located at an intervening level between the second node and the first node.
7. The method of claim 1 , further comprising generating a dynamic security set to apply to the access related to the first node.
8. The method of claim 7 further comprising:
defining a third security set as including a third subset of access rights associated with the user;
associating the third security set with a third node of the hierarchical data structure; and
forming the dynamic security set from the first and the third subsets of access rights.
9. The method of claim 8 wherein the user belongs to both a first group associated with the first security set and a second group associated with the second security set.
10. The method of claim 8 wherein the dynamic security set is formed by the taking the union of the first and the third subsets of access rights.
11. The method of claim 1 , further comprising rejecting the request by the user.
12. The method of claim 11 wherein rejecting the request further comprises:
defining a fourth security set as including a fourth subset of access rights associated with the user;
associating the fourth security set with a fourth node of the hierarchical data structure; and
determining a first access right of at least one of the first and fourth subsets of access rights is denied.
13. The method of claim 12 wherein the first node resides in a first realm and the fourth node resides in a second realm.
14. The method of claim 1 wherein the set of data constitutes a document and the subset of the data is a portion of the document.
15. The method of claim 14 wherein the document is a configuration record.
16. The method of claim 1 wherein the subset of data includes one or more executable instructions.
17. The method of claim 1 wherein the element is a router.