US5414852A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method for protecting data in a computer system
Assignee: International Business Machines Corp
•
Filing: 1992-10-30
•
Granted: 1995-05-09
•
Expires: 2012-10-30
Abstract
Abstract A data processing system include a plurality of data objects which are accessible by application programs through a system level interface. Each data object has an associated user access list. In addition, each object has at least one key indicating which applications can access that object. The key is preferably maintained in a protected storage area, accessible only by the low level system interface. Both the application identifier key and the user who invoked that application must match the identifier information in the data object for access to be allowed to that object. If an unauthorized user attempts access to the data object through the correct application, or an authorized user attempts access through an incorrect application, access to the data object will be denied by the low level interface.
Inventors
- 👤 Paul H. Kramer
- 👤 Kay A. Tate
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-25 17:28
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F2221/00; G06F2221/21; G06F2221/2141
Claims Analysis
Total Claims: 16
Claim 1
Independent Claim
127 words
In a data processing system, a computer-implemented method for controlling access to a plurality of data objects, comprising the steps of: when each of the plurality of objects is created, associating with such object at least one user identifier, and at least one list of data manager identifiers; invoking a first data manager using a user identifier to identify an invoking user; invoking a second data manager from the first data manager; and when the second data manager later attempts to access a data object, allowing such access only if one of the lists of data manager identifiers associated with the data object contains both the first and second data managers, and the first data manager has been invoked with a user identifier associated with the object.
Claim 2
Dependent Claim
127 words
In a data processing system, a computer-implemented method for controlling access to a plurality of data objects, comprising the steps of: when each of the plurality of objects is created, associating with such object at least one user identifier, and at least one list of data manager identifiers; invoking a first data manager using a user identifier to identify an invoking user; invoking a second data manager from the first data manager; and when the second data manager later attempts to access a data object, allowing such access only if one of the lists of data manager identifiers associated with the data object contains both the first and second data managers, and the first data manager has been invoked with a user identifier associated with the object.
Claim 3
Dependent Claim
38 words
The method of claim 1, wherein each data object is created by a data manager, and an identifier of the creating data manager is included in one of the lists of data managers associated with each created object.
Claim 4
Dependent Claim
28 words
The method of claim 2, wherein identifiers for at least three data managers are included in one of the lists associated with at least one selected data object.
Claim 5
Dependent Claim
28 words
The method of claim 2, wherein a list of user identifiers associated with a data object can be modified by the data manager which created the data object.
Claim 6
Dependent Claim
36 words
The method of claim 2, wherein data objects are created by data managers through a system level interface, and the data manager identifier associated with each data object is accessible only by the system level interface.
Claim 7
Dependent Claim
47 words
The method of claim 1, wherein each user identifier associated with each data object has a type of access permission, and access to that data object by a process utilizing any particular user identifier is allowed to perform only those actions defined by the access permission type.
Claim 8
Dependent Claim
25 words
The method of claim 6, wherein the access permission types include read for read only access, write for write access, and delete for delete access.
Claim 9
Dependent Claim
49 words
The method of claim 1, wherein each data manager associated with any particular data object has a type of access permission, and access to that data object by a process utilizing any particular data manager identifier is allowed to perform only those actions defined by the access permission type.
Claim 10
Dependent Claim
36 words
The method of claim 8, wherein the access permission types include read for read only access, write for write access, delete for delete access, and update for access to the associated user identifiers for modification thereof.
Claim 11
Dependent Claim
147 words
A computer-implemented method for controlling access to a plurality of data objects in a data processing system, comprising the steps of: for each data object, providing a user list containing at least one user identifier, and a data manager list containing at least two data manager identifiers; each time a data manager accesses a data object, comparing an identifier for such data manager with the data manager list for such object, and comparing a user identifier of a user which invoked the data manager with the user list for such object; and permitting access to the data object only if the user identifier is contained in the user identifier list, each of the data manager identifiers are contained in the data manager identifier list, and each of the data managers in the data manager list has been invoked in a chain to access the selected data object.
Claim 12
Dependent Claim
147 words
A computer-implemented method for controlling access to a plurality of data objects in a data processing system, comprising the steps of: for each data object, providing a user list containing at least one user identifier, and a data manager list containing at least two data manager identifiers; each time a data manager accesses a data object, comparing an identifier for such data manager with the data manager list for such object, and comparing a user identifier of a user which invoked the data manager with the user list for such object; and permitting access to the data object only if the user identifier is contained in the user identifier list, each of the data manager identifiers are contained in the data manager identifier list, and each of the data managers in the data manager list has been invoked in a chain to access the selected data object.
Claim 13
Dependent Claim
53 words
The method of claim 10, wherein each user identifier contained in the user identifier list of each data object has a type of access permission, and access to that data object by a data manager utilizing any particular user identifier is allowed to perform only those actions defined by the access permission type.
Claim 14
Dependent Claim
25 words
The method of claim 11, wherein the access permission types include read for read only access, write for write access, and delete for delete access.
Claim 15
Dependent Claim
55 words
The method of claim 10, wherein each data manager contained in the data manager identifier list of each data object has a type of access permission, and access to that data object by a data manager utilizing any particular data manager identifier is allowed to perform only those actions defined by the access permission type.
Claim 16
Dependent Claim
35 words
The method of claim 13, wherein,the access permission types include read for read only access, write for write access, delete for delete access, and update for access to the associated user identifiers for modification thereof.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-05-08 | 1998-11-07 | 1999-05-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-05-08 | 2002-11-07 | 2003-05-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-05-08 | 2006-11-07 | 2007-05-09 | $7700.00 | Window Closed / Lapsed |