US5265221A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Access restriction facility method and apparatus
Assignee: Tandem Computers Inc
•
Filing: 1992-12-02
•
Granted: 1993-11-23
•
Expires: 2012-12-02
Abstract
Abstract An access control mechanism for granting, revoking, and denying authorization to computer system objects using a customer supplied set of verbs, parameters, attributes, and functions. The access control mechanism employs a processor for providing access controls to objects comprising subject memory, verb memory, object memory, definition memory, rule memory and an evaluator. The processor may be embodied as a microprocessor and memory, or a computer using software. The subject memory stores specified user attributes in a matrix having information for each user on each row, with user attributes in each field. The object memory stores object names, object attributes, and rules for defined verb names. The definition memory stores field definitions, external function declarations and strings. The rule memory stores rule names with their associated boolean expressions. The evaluator determines whether or not access to a specific object is allowed according to specified or default rules, user and object attributes, and definitions. While the term "Discretionary Access Control" is used throughout this document, the mechanism described herein can be used to implement discretionary, mandatory, and nonOdiscretionary (Clark-Wilson) security models.
Inventors
- 👤 Donald V. Miller
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 19:26
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/604; G06F21/70; G06F21/71; G06F9/00; G06F9/06; G06F9/46; G06F9/468; G06F2221/00; G06F2221/21; G06F2221/2141; G06F2221/2145
Claims Analysis
Total Claims: 45
Claim 1
Independent Claim
224 words
An access restriction mechanism using a processor for controlling access to objects in a computer system, comprising: subject means for storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to each of the specific users in each field of the matrix; verb means for storing at least one verb name with a default rule for each of the verb names; object means for storing at least one object name with object attributes and object rules expressed as object-boolean expressions for each of the verb names; definition means for storing field definitions, external function declarations and strings; rule means for storing at least one rule name with a rule-boolean expression for each of the rule names; and evaluation means coupled to said subject means, said object means, said definition means, said verb means and said rule means, responsive to the user information, at least one verb name, at least one object name, at least one rule name and at least one of the field definitions, external function declarations and strings for determining, changing, and controlling access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of default rules, object rules, field definitions, external function declarations, strings, rule-boolean expressions, user attributes, and object attributes.
Claim 2
Dependent Claim
224 words
An access restriction mechanism using a processor for controlling access to objects in a computer system, comprising: subject means for storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to each of the specific users in each field of the matrix; verb means for storing at least one verb name with a default rule for each of the verb names; object means for storing at least one object name with object attributes and object rules expressed as object-boolean expressions for each of the verb names; definition means for storing field definitions, external function declarations and strings; rule means for storing at least one rule name with a rule-boolean expression for each of the rule names; and evaluation means coupled to said subject means, said object means, said definition means, said verb means and said rule means, responsive to the user information, at least one verb name, at least one object name, at least one rule name and at least one of the field definitions, external function declarations and strings for determining, changing, and controlling access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of default rules, object rules, field definitions, external function declarations, strings, rule-boolean expressions, user attributes, and object attributes.
Claim 3
Dependent Claim
20 words
The access control mechanism as set forth in claim 1, wherein said access restriction mechanism includes a computer using software.
Claim 4
Dependent Claim
20 words
The access control mechanism as set forth in claim 1, wherein said access restriction mechanism includes a microprocessor having memory.
Claim 5
Dependent Claim
47 words
The access control mechanism as set forth in claim 1, further comprising: display means for displaying in a window format the contents of said subject means, said verb means, said object means, said definition means, said rule means, and said evaluation means for viewing by a user.
Claim 6
Dependent Claim
28 words
The access control mechanism as set forth in claim 4, further comprising input means coupled to said evaluation means for inputting data and instructions to the predetermined algorithm.
Claim 7
Dependent Claim
182 words
An access restriction mechanism for controlling access to objects in a computer system, comprising: subject means for storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to each of the specific users in each field of the matrix; verb means for storing at least one verb name with a default rule for each of the verb names; object means for storing at least one object name with object attributes and object rules for each of the verb names; rule means for storing at least one rule name with a rule-boolean expression for each of the rule names; and evaluation means coupled to said subject means, said object means, said verb means and said rule means, responsive to the user information, at least one verb name, at least one object name and at least one rule name for determining access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of default rules, object rules, rule-boolean expressions, user attributes, or object attributes.
Claim 8
Dependent Claim
182 words
An access restriction mechanism for controlling access to objects in a computer system, comprising: subject means for storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to each of the specific users in each field of the matrix; verb means for storing at least one verb name with a default rule for each of the verb names; object means for storing at least one object name with object attributes and object rules for each of the verb names; rule means for storing at least one rule name with a rule-boolean expression for each of the rule names; and evaluation means coupled to said subject means, said object means, said verb means and said rule means, responsive to the user information, at least one verb name, at least one object name and at least one rule name for determining access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of default rules, object rules, rule-boolean expressions, user attributes, or object attributes.
Claim 9
Dependent Claim
20 words
The access control mechanism as set forth in claim 6, wherein said access restriction mechanism includes a computer using software.
Claim 10
Dependent Claim
20 words
The access control mechanism as set forth in claim 6, wherein said access restriction mechanism includes a microprocessor having memory.
Claim 11
Dependent Claim
44 words
The access control mechanism as set forth in claim 6, further comprising: display means for displaying in a window format the contents of said subject means, said verb means, said object means, said rule means, and said evaluation means for viewing by a user.
Claim 12
Dependent Claim
145 words
An access restriction mechanism for controlling access to objects in a computer system, said access restriction mechanism comprising: subject means for storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to each of the specific users in each field of the matrix; object means for storing at least one object name with object attributes; rule means for storing at least one rule name with a rule-boolean expression for each of the rule names; and evaluation means coupled to said subject means, said object means, and said rule means, responsive to user information, at least one object name, and at least one rule name for determining access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of rule-boolean expressions, user attributes, and object attributes.
Claim 13
Dependent Claim
145 words
An access restriction mechanism for controlling access to objects in a computer system, said access restriction mechanism comprising: subject means for storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to each of the specific users in each field of the matrix; object means for storing at least one object name with object attributes; rule means for storing at least one rule name with a rule-boolean expression for each of the rule names; and evaluation means coupled to said subject means, said object means, and said rule means, responsive to user information, at least one object name, and at least one rule name for determining access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of rule-boolean expressions, user attributes, and object attributes.
Claim 14
Dependent Claim
20 words
The access control mechanism as set forth in claim 10, wherein said access restriction mechanism includes a computer using software.
Claim 15
Dependent Claim
20 words
The access control mechanism as set forth in claim 10, wherein said access restriction mechanism includes a microprocessor having memory.
Claim 16
Dependent Claim
41 words
The access control mechanism as set forth in claim 10, further comprising: display means for displaying in a window format the contents of said subject means, said object means, said rule means, and said evaluation means for viewing by a user.
Claim 17
Dependent Claim
26 words
The method as set forth in claim 10, further including the step of changing access authorization by said evaluation means according to a second predetermined algorithm.
Claim 18
Dependent Claim
23 words
The method as set forth in claim 14, further including the step of controlling access to objects according to a second predetermined algorithm.
Claim 19
Independent Claim
247 words
A method using a processor for controlling access to objects in a computer system, said processor having subject means, objects means, definition means, verb means, rule means and evaluation means with said evaluation means coupled to said subject means, said object means, said definition means, said verb means, and said rule means, comprising the steps, using said processor, of: storing in said subject means user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing in said verb means at least one verb name with a default rule for each of the at least one verb names; storing in said object means at least one object name wtih object attributes and object rules for each of the verb names; storing in said definition means field definitions, external function declarations and strings; storing in said rule means at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one object name, and at least one rule name, and any one of field definitions, external function declarations and strings, access authorization by said evaluation means, wherein access is granted or denied according to a predetermined computer algorithm including a combination f at least two of default rules, object rules, field definitions, external function declarations, strings, rule-boolean expressions, user attributes, and object attributes.
Claim 20
Independent Claim
247 words
A method using a processor for controlling access to objects in a computer system, said processor having subject means, objects means, definition means, verb means, rule means and evaluation means with said evaluation means coupled to said subject means, said object means, said definition means, said verb means, and said rule means, comprising the steps, using said processor, of: storing in said subject means user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing in said verb means at least one verb name with a default rule for each of the at least one verb names; storing in said object means at least one object name wtih object attributes and object rules for each of the verb names; storing in said definition means field definitions, external function declarations and strings; storing in said rule means at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one object name, and at least one rule name, and any one of field definitions, external function declarations and strings, access authorization by said evaluation means, wherein access is granted or denied according to a predetermined computer algorithm including a combination f at least two of default rules, object rules, field definitions, external function declarations, strings, rule-boolean expressions, user attributes, and object attributes.
Claim 21
Dependent Claim
27 words
The method as set forth in claim 16 further including the step of changing access authorization by said evaluation means according to a second predetermined computer algorithm.
Claim 22
Dependent Claim
28 words
The method as set forth in claim 16, further including the step of controlling access to objects by said evaluation means according to a second predetermined computer algorithm.
Claim 23
Dependent Claim
48 words
The method using a processor as set forth in claim 16, further including the step of: displaying in a window format the contents of said subject means, said verb means, said object means, said definition means, said rule means, and said evaluation means for viewing by a user.
Claim 24
Dependent Claim
24 words
The method using a processor as set forth in claim 19, further including the step of inputting data and instructions to the predetermined algorithm.
Claim 25
Independent Claim
216 words
A method using an access restriction mechanism for controlling access to objects in a computer system, said access restriction mechanism having subject means, objects means, verb means, rule means and evaluation means with said evaluation means coupled to said subject means, said object means, said verb means, and said rule means, comprising the steps, using said access restriction mechanism, of: storing in said subject means user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing in said verb means at least one verb name with a default rule for each of the verb names; storing in said object means at least one object name with object attributes and object rules for each of the verb names; storing in said rule means at least one rule name with a rule-boolean expression for each of the rule names; determining, in response to user information, at least one verb name, at least one object name, and at least one rule name, access authorization by said evaluation means, wherein access is granted or denied according to a predetermined computer algorithm including a combination of at least any two of default rules, object rules, rule-boolean expressions, user attributes, and object attributes.
Claim 26
Independent Claim
216 words
A method using an access restriction mechanism for controlling access to objects in a computer system, said access restriction mechanism having subject means, objects means, verb means, rule means and evaluation means with said evaluation means coupled to said subject means, said object means, said verb means, and said rule means, comprising the steps, using said access restriction mechanism, of: storing in said subject means user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing in said verb means at least one verb name with a default rule for each of the verb names; storing in said object means at least one object name with object attributes and object rules for each of the verb names; storing in said rule means at least one rule name with a rule-boolean expression for each of the rule names; determining, in response to user information, at least one verb name, at least one object name, and at least one rule name, access authorization by said evaluation means, wherein access is granted or denied according to a predetermined computer algorithm including a combination of at least any two of default rules, object rules, rule-boolean expressions, user attributes, and object attributes.
Claim 27
Dependent Claim
45 words
The method using a processor as set forth in claim 21, further including the step of: displaying in a window format the contents of said subject means, said verb means, said object means, said rule means, and said evaluation means for viewing by a user.
Claim 28
Dependent Claim
27 words
The method as set forth in claim 21, further including the step of changing access authorization by said evaluation means according to a second predetermined computer algorithm.
Claim 29
Dependent Claim
28 words
The method as set forth in claim 21, further including the step of controlling access to objects by said evaluation means according to a second predetermined computer algorithm.
Claim 30
Independent Claim
213 words
A method using an access restriction mechanism for controlling access to objects in a computer system, said access restriction mechanism having subject means, definition means, verb means, rule means and evaluation means with said evaluation means coupled to said subject means, said definition means, said verb means, and said rule means, comprising the steps, using said access restriction mechanism, of: storing in said subject means user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing in said verb means at least one verb name with a default rule for each of the verb names; storing in said definition means field definitions, external function declarations and strings; storing in said rule means at least one rule name with a rule-boolean expression for each of the rule names; determining, in response to user information, at least one verb name, at least one rule, and at least one of filed definitions, external function declarations and strings, access authorization by said evaluation means, wherein access is granted or denied according to a predetermined computer algorithm including a combination of at least any two of default rules, field definitions, external function declarations, strings, rule-boolean expressions, and user attributes.
Claim 31
Independent Claim
213 words
A method using an access restriction mechanism for controlling access to objects in a computer system, said access restriction mechanism having subject means, definition means, verb means, rule means and evaluation means with said evaluation means coupled to said subject means, said definition means, said verb means, and said rule means, comprising the steps, using said access restriction mechanism, of: storing in said subject means user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing in said verb means at least one verb name with a default rule for each of the verb names; storing in said definition means field definitions, external function declarations and strings; storing in said rule means at least one rule name with a rule-boolean expression for each of the rule names; determining, in response to user information, at least one verb name, at least one rule, and at least one of filed definitions, external function declarations and strings, access authorization by said evaluation means, wherein access is granted or denied according to a predetermined computer algorithm including a combination of at least any two of default rules, field definitions, external function declarations, strings, rule-boolean expressions, and user attributes.
Claim 32
Dependent Claim
42 words
The method using a processor as set forth in claim 25, further including the step of: displaying in a window format the contents of said subject means, said object means, said rule means, and said evaluation means for viewing by a user.
Claim 33
Dependent Claim
27 words
The method as set forth in claim 25, further including the step of changing access authorization by said evaluation means according to a second predetermined computer algorithm.
Claim 34
Dependent Claim
28 words
The method as set forth in claim 25, further including the step of controlling access to objects by said evaluation means according to a second predetermined computer algorithm.
Claim 35
Independent Claim
179 words
A method using an access restriction facility for controlling access to objects, in a computer system comprising the steps, using said access restriction facility, of: storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing at least one verb name with a default rule for each of the verb names; storing at least one object name with object attributes and object rules for each of the verb names; storing at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one object name, and at least one rule names, and any one of filed definitions, external function declarations and strings, access authorization wherein access us granted or denied according to a predetermined algorithm including a combination of at least any two of the default rules, object rules, field definitions, external function declarations, strings, rule-boolean expressions, user attributes, and object attributes.
Claim 36
Independent Claim
179 words
A method using an access restriction facility for controlling access to objects, in a computer system comprising the steps, using said access restriction facility, of: storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing at least one verb name with a default rule for each of the verb names; storing at least one object name with object attributes and object rules for each of the verb names; storing at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one object name, and at least one rule names, and any one of filed definitions, external function declarations and strings, access authorization wherein access us granted or denied according to a predetermined algorithm including a combination of at least any two of the default rules, object rules, field definitions, external function declarations, strings, rule-boolean expressions, user attributes, and object attributes.
Claim 37
Dependent Claim
24 words
The method using a processor as set forth in claim 29, further including the step of inputting data and instructions to the predetermined algorithm.
Claim 38
Dependent Claim
22 words
The method as set forth in claim 29, further including the step of changing access authorization according to a second predetermined algorithm.
Claim 39
Dependent Claim
23 words
The method as set forth in claim 29, further including the step of controlling access to objects according to a second predetermined algorithm.
Claim 40
Independent Claim
162 words
A method using an access restriction facility for controlling access to objects, in a computer system comprising the steps, using said access restriction facility, of: storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing at least one verb name with a default rule for each of the verb names; storing at least one object name with object attributes and object rules for each of the verb names; storing at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one object name, and at least one rule name, access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of the default rules, object rules, rule-boolean expressions, user attributes, and object attributes.
Claim 41
Independent Claim
162 words
A method using an access restriction facility for controlling access to objects, in a computer system comprising the steps, using said access restriction facility, of: storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing at least one verb name with a default rule for each of the verb names; storing at least one object name with object attributes and object rules for each of the verb names; storing at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one object name, and at least one rule name, access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of the default rules, object rules, rule-boolean expressions, user attributes, and object attributes.
Claim 42
Independent Claim
159 words
A method using an access restriction facility for controlling access to objects in a computer system, comprising the steps, using said access restriction facility, of: storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing at least one verb name with a default rule for each of the verb names; storing field definitions, external function declarations and strings; storing at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one rule, and at least one of filed definitions, external function declarations and strings, access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of the default rules, field definitions, external function declarations, strings, rule-boolean expressions, and user attributes.
Claim 43
Independent Claim
159 words
A method using an access restriction facility for controlling access to objects in a computer system, comprising the steps, using said access restriction facility, of: storing user information in a matrix having a specific user on each row of the matrix, with user attributes pertaining to the specific user in each field of the matrix; storing at least one verb name with a default rule for each of the verb names; storing field definitions, external function declarations and strings; storing at least one rule name with a rule-boolean expression for each of the rule names; and determining, in response to user information, at least one verb name, at least one rule, and at least one of filed definitions, external function declarations and strings, access authorization, wherein access is granted or denied according to a predetermined algorithm including a combination of at least any two of the default rules, field definitions, external function declarations, strings, rule-boolean expressions, and user attributes.
Claim 44
Dependent Claim
22 words
The method as set forth in claim 34, further including the step of changing access authorization according to a second predetermined algorithm.
Claim 45
Dependent Claim
23 words
The method as set forth in claim 34, further including the step of controlling access to objects according to a second predetermined algorithm.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1996-11-22 | 1997-05-24 | 1997-11-23 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2000-11-22 | 2001-05-24 | 2001-11-23 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2004-11-22 | 2005-05-24 | 2005-11-23 | $7700.00 | Window Closed / Lapsed |