Method and system for generating user group permission lists
A method and apparatus for generating user group identifiers using a permissions matrix is disclosed. The permissions matrix includes an entry that is associated with a row and a column of the permissions matrix. The row of the permissions matrix is indexed with a first role and the column of the permissions matrix is indexed with a second role. A data structure implementing such a method can include, for example, a user group identifier matrix. Alternatively, a method is disclosed in which the expiration of a user group identifier is detected. In such a case, the user group identifier is updated by accessing a user group identifier matrix.
1. A method comprising:
creating a user group permissions list,
wherein
the user group permissions list is created using a role permissions list,
the role permissions list is accessible via an entry in a role permissions matrix,
the entry is associated with a row and a column of the role permissions matrix,
the row of the role permissions matrix is indexed using a first role, wherein the first role represents a first function within an organization, and
the column of the role permissions matrix is indexed using a second role,
wherein
the second role represents a second function within the organization, and
the role permissions list defines an access control relationship between the first role and the second role.
2. The method of claim 1 , wherein
the role permissions list is an access control list.
3. The method of claim 2 , wherein
the access control relationship comprises at least one of:
an intra-role relationship, and
an inter-role relationship.
4. The method of claim 3 , wherein
the entry in the role permissions matrix comprises at least one of:
a reference to the role permissions list, and
the role permissions list.
5. The method of claim 4 , wherein
the first role and the second role are the same.
6. The method of claim 1 , wherein
the access control relationship consists of a relationship between the first role and the second role.
7. The method of claim 6 , further comprising:
defining a role set, wherein
the role set comprises the first role and the second role.
8. The method of claim 1 , wherein the creating the user group permissions list further comprises:
assigning a first user group identifier to a first role subset;
assigning a second user group identifier to a second role subset; and
creating the user group permissions list such that the user group permissions list sets forth the access control relationship between the first user group identifier and the second user group identifier.
9. The method of claim 8 , further comprising:
creating the first role subset, wherein
the first role subset comprises the first role; and
creating the second role subset, wherein
the second role subset comprises the second role.
10. The method of claim 8 , wherein the creating the user group permissions list further comprises:
taking a Cartesian product of the first user group identifier and the second user group identifier.
11. The method of claim 10 , wherein the taking the Cartesian product of the first user group identifier and the second user group identifier further comprises:
replacing the first user group identifier with the first role subset;
replacing the second user group identifier with the second role subset; and
taking the Cartesian product of the first role subset and the second role subset to obtain a set of ordered pairs.
12. The method of claim 11 , further comprising:
obtaining a first role permissions list by using a first ordered pair from the set of ordered pairs;
obtaining a second role permissions list by using a second ordered pair from the set of ordered pairs; and
merging the first role permissions list and the second role permissions list to create the user group permissions list.
13. The method of claim 12 , wherein
the merging the first role permissions list and the second role permissions list is performed in a least restrictive manner.
14. The method of claim 11 , further comprising:
minimizing the set of ordered pairs.
15. The method of claim 1 , further comprising:
updating a set of role permissions matrix entries,
wherein the updating is performed responsive to at least one of:
a time stamp, and
a generation number.
16. The method of claim 15 , further comprising:
updating the set of role permissions matrix entries, wherein
the updating is performed responsive to at least one of:
a time stamp, and
a generation number.
17. The method of claim 1 , wherein
the first function and the second function are the same.
18. A computer program product comprising:
a first set of instructions, executable on a computer system, configured to create a user group permissions list, wherein
the user group permissions list is created using a role permissions list,
the role permissions list is accessible via an entry in a role permissions matrix,
the entry is associated with a row and a column of the role permissions matrix,
the row of the role permissions matrix is indexed using a first role, wherein the first role represents a first function within an organization, and
the column of the role permissions matrix is indexed using a second role, wherein the second role represents a second function within the organization, and
the role permissions list defines an access control relationship between the first role and the second role; and
a persistent computer readable media, wherein the computer program product is encoded in the persistent computer readable media.
19. The computer program product of claim 18 , wherein the role permissions list is an access control list.
20. The computer program product of claim 19 , wherein
the access control relationship comprises at least one of:
an intra-role relationship, and
an inter-role relationship.
21. The computer program product of claim 20 , wherein
the entry in the role permissions matrix comprises at least one of:
a reference to the role permissions list, and
the role permissions list.
22. The computer program product of claim 21 , wherein
the first role and the second role are the same.
23. The computer program product of claim 18 , wherein
the access control relationship consists of a relationship between the first role and the second role.
24. The computer program product of claim 23 , further comprising:
a second set of instructions, executable on the computer system, configured to define a role set, wherein
the role set comprises the first role and the second role.
25. The computer program product of claim 18 , wherein the first set of instructions comprises:
a first subset of instructions, executable on the computer system, configured to
assign a first user group identifier to a first role subset,
assign a second user group identifier to a second role subset, and
create the user group permissions list such that the user group permissions list sets forth the access control relationship between the first user group identifier and the second user group identifier.
26. The computer program product of claim 25 , further comprising:
a second set of instructions, executable on the computer system, configured to
create the first role subset, wherein the first role subset comprises the first role, and
create the second role subset, wherein the second role subset comprises the second role.
27. The computer program product of claim 25 , wherein the first set of instructions further comprises:
a second subset of instructions, executable on the computer system, configured to take a Cartesian product of the first user group identifier and the second user group identifier.
28. The computer program product of claim 27 , wherein the second subset of instructions comprises:
a third subset of instructions, executable on the computer system, configured to
replace the first user group identifier with the first role subset,
replace the second user group identifier with the second role subset, and
take the Cartesian product of the first role subset and the second role subset to obtain a set of ordered pairs.
29. The computer program product of claim 28 , further comprising:
a second set of instructions, executable on the computer system, configured to
obtain a first role permissions list by using a first ordered pair from the set of ordered pairs,
obtain a second role permissions list by using a second ordered pair from the set of ordered pairs, and
merge the first role permissions list and the second role permissions list to create the user group permissions list.
30. The computer program product of claim 29 , wherein the second set of instructions comprises:
a first subset of instructions, executable on the computer system, configured to
merge the first role permissions list and the second role permissions list in a least restrictive manner.
31. The computer program product of claim 28 , further comprising:
a second set of instructions, executable on the computer system, configured to
minimize the set of ordered pairs.
32. The computer program product of claim 18 , further comprising:
a second set of instructions, executable on the computer system, configured to
download a set of role permissions matrix entries associated with a user group identifier of a source.
33. The computer program product of claim 32 , further comprising:
a third set of instructions, executable on the computer system, configured to
update the set of role permissions matrix entries, wherein
the updating is performed responsive to at least one of:
a time stamp and
a generation number.
34. An apparatus comprising:
means for generating an entry of a role permissions matrix; and
means for creating a user group permissions list, wherein
the user group permissions list is created using a role permissions list,
the role permissions list is accessible via an entry in a role permissions matrix,
the entry is associated with a row and a column of the role permissions matrix,
the row of the role permissions matrix is indexed using a first role, wherein the first role represents a first function within an organization, and
the column of the role permissions matrix is indexed using a second role, wherein
the second role represents a second function within the organization, and
the role permissions list defines an access control relationship between the first role and the second role.
35. The apparatus of claim 34 , wherein
the role permissions list is an access control list.
36. The apparatus of claim 35 , wherein
the access control relationship comprises at least one of:
an intra-role relationship, and
an inter-role relationship.
37. The apparatus of claim 36 , wherein
the entry in the role permissions matrix comprises at least one of:
a reference to the role permissions list, and
the role permissions list.
38. The apparatus of claim 37 , wherein
the first role and the second role are the same.
39. The apparatus of claim 34 , wherein
the access control relationship consists of a relationship between the first role and the second role.
40. The apparatus of claim 39 , further comprising:
means for defining a role set, wherein
the role set comprises the first role and the second role.
41. The apparatus of claim 34 , wherein the means for creating the user group permissions list further comprises:
means for assigning a first user group identifier to a first role subset;
means for assigning a second user group identifier to a second role subset; and
means for creating the user group permissions list such that the user group permissions list sets forth an access control relationship between the first user group identifier and the second user group identifier.
42. The apparatus of claim 41 , further comprising:
means for creating the first role subset, wherein
the first role subset comprises the first role; and
means for creating the second role subset, wherein
the second role subset comprises the second role.
43. The apparatus of claim 41 , wherein the means for creating the user group permissions list further comprises:
means for taking a Cartesian product of the first user group identifier and the second user group identifier.
44. The apparatus of claim 43 , wherein the taking the Cartesian product of the first user group identifier and the second user group identifier further comprises:
replacing the first user group identifier with the first role subset;
replacing the second user group identifier with the second role subset; and
taking the Cartesian product of the first role subset and the second role subset to obtain a set of ordered pairs.
45. The apparatus of claim 44 , further comprising:
means for obtaining a first role permissions list by using a first ordered pair from the set of ordered pairs;
means for obtaining a second role permissions list by using a second ordered pair from the set of ordered pairs; and
means for merging the first role permissions list and the second role permissions list to create the user group permissions list.
46. The apparatus of claim 45 , wherein
the merging the first role permissions list and the second role permissions list is performed in a least restrictive manner.
47. The apparatus of claim 44 , further comprising:
means for minimizing the set of ordered pairs.
48. The apparatus of claim 34 , further comprising:
means for downloading a set of role permissions matrix entries associated with a user group identifier of a source.
49. The apparatus of claim 48 , further comprising:
means for updating the set of role permissions matrix entries, wherein
the updating is performed responsive to at least one of:
a time stamp, and
a generation number.
50. A method comprising:
accessing a role permissions list using a role permissions matrix, wherein
the role permissions matrix is configured to allow the role permissions list to be accessed via an entry in the role permissions matrix,
the entry in the role permissions matrix references the role permissions list,
the role permissions list describes a role access control relationship between a first role and a second role,
a row of the role permissions matrix is indexed using the first role,
wherein
the first role represents a first function within an organization, and
a column of the role permissions matrix is indexed using the second role,
wherein
the second role represents a second function within the organization.
51. The method of claim 50 , further comprising:
forming the role permissions list.
52. The method of claim 50 , further comprising:
assigning a first role subset to a first user, wherein
the first role subset comprises the first role; and
assigning a second role subset to a second user, wherein
the second role subset comprises the second role.
53. The method of claim 52 , further comprising:
assigning a first user group identifier to the first role subset;
assigning a second user group identifier to the second role subset; and
defining a user group permissions list such that the user group permissions list sets forth a user group access control relationship between the first user group identifier and the second user group identifier.
54. The method of claim 53 , further comprising:
forming a user group identifier matrix, wherein the user group permissions list is accessible through an entry in the user group identifier matrix.
55. The method of claim 53 , wherein
the first user group identifier is a security group tag.
56. The method of claim 52 , wherein
the first role subset comprises a different subset of roles than the second role subset.
57. A method comprising:
detecting an expiration of a user group identifier, wherein
the user group identifier represents a first user group and a first subset of roles, and
the first subset of roles represent a first subset of functions within an organization; and
updating the user group identifier by accessing a user group identifier matrix,
wherein
the user group identifier matrix comprises an entry,
the entry is associated with a row and column of the user group identifier matrix,
the row of the user group identifier matrix is indexed according to a first user group identifier, and
a column of the user group identifier matrix is indexed according to a second user group identifier.
58. The method of claim 57 , wherein
the updating the user group identifier is performed responsive to at least one of:
a time stamp, and
a generation number.
59. The method of claim 57 , wherein the updating the user group identifier further comprises:
downloading a column of the user group identifier matrix.
60. The method of claim 59 , wherein the downloading the column of the user group identifier matrix further comprises:
downloading a time stamp associated with the user group identifier; and
downloading a generation number associated with the user group identifier.
61. The method of claim 57 , wherein
the detecting the expiration of the user group identifier is performed during an
authentication of a host.
62. A data structure, in a computer readable medium, comprising:
a user group identifier matrix, wherein
the user group identifier matrix comprises an entry,
the entry is associated with a row and a column of the user group identifier matrix,
the row of the user group identifier matrix is indexed using a first user group identifier, wherein
the first user group identifier represents a first user group and a first subset of roles, and
the first subset of roles represents a first subset of functions within an organization, and
the column of the user group identifier matrix is indexed using a second user group identifier, wherein
the second user group identifier represents a second user group and a second subset of roles, and
the second subset of roles represents a second subset of functions within the organization.
63. The data structure of claim 62 , further comprising:
a user group permissions list, wherein
the user group permissions list is accessible through the entry in the user group identifier matrix, and
the user group permissions list designates an access control relationship between the first user group identifier and the second user group identifier.
64. The data structure of claim 63 , wherein
the user group permissions list is an access control list.
65. The data structure of claim 64 , wherein
the access control relationship comprises at least one of:
an intra-role relationship, and
an inter-role relationship.
66. The data structure of claim 65 , wherein
the entry in the user group identifier matrix comprises at least one of:
a reference to the user group permissions list, and
the user group permissions list.
67. An apparatus comprising:
a user group identifier matrix, wherein
the user group identifier matrix comprises an entry,
the entry is associated with a row and a column of the user group identifier matrix,
the row of the user group identifier matrix is indexed using a first user group identifier, wherein
the first user group identifier represents a first user group and a first subset of roles, and
the first subset of roles represents a first subset of functions within an organization, and
the column of the user group identifier matrix is indexed using a second user group identifier, wherein
the second user group identifier represents a second user group and a second subset of roles, and
the second subset of roles represents a second subset of functions within the organization.
68. The apparatus of claim 67 , further comprising:
a user group permissions list, wherein
the user group permissions list is accessible through the entry in the user group identifier matrix, and
the user group permissions list designates an access control relationship between the first user group identifier and the second user group identifier.
69. The apparatus of claim 68 , wherein
the user group permissions list is an access control list.
70. The apparatus of claim 69 , wherein
the access control relationship comprises at least one of:
an intra-role relationship, and
an inter-role relationship.
71. The apparatus of claim 70 , wherein the entry in the user group identifier matrix comprises at least one of:
a reference to the user group permissions list, and
the user group permissions list.