Method to support role based prioritization of processes

A method is disclosed to assign Priority to Processes based on Roles. The method calculates the process priority of the process using a scheduler running in the computer system, based on either a first weight of a first role, a second weight of a second role, or a calculated weight if both the first and second roles can unlock access to the process. The method then assigns a share of the computer system's time to the process, the share of time being based on the process priority calculated for the process.

FIELD

The embodiments relate to supporting role based prioritization of computer processes.

BACKGROUND

Computer-based access controls can limit which users or processes may have access to a specific system resource and the type of access permitted. The access decisions in Role-Based Access Control (RBAC) are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as system administrator, project manager, design engineer, or part-time employee, etc.) Access rights are grouped by role name, and the use of resources is restricted to individuals authorized to assume the associated role. For example, a system administrator can access user authentication data for an entire organization, whereas the role of a project manager can be limited to information associated with that particular project, and not to information associated with other projects.

A program or command that is actually running on the computer is referred to as a process. When a process is started on a system, the process uses a part of the available system resources. When more than one process is running, a scheduler that is built into the operating system gives each process its share of the computer's time, based on established priorities.

In Role Based Access Control (RBAC), what is needed is a way to control the priority of the running processes based on roles. For example, a system has two roles: “Security Administration” and “Backup Administration”. A set of authorizations has been assigned to these roles. If there is a requirement to give more priority to the “Security Administration” role, i.e. more priority is to be given to the commands (processes) that a Security Administration executes on the system, then the “Backup Administration” role should be given a lesser priority than the “Security Administration” role. These priorities are required since “Security Administration” commands are considered more important and the person exercising that role needs more priority for his commands then a person exercising the “Backup Administration” role.

What is needed is a way to assign priority of a process in accordance with the role of the person accessing that process. In other words the priority of the process needs to be set based on the role that a user has, i.e. prioritize processes based on the roles with which they are associated. What is needed is a method to assign priority to processes based on roles.

SUMMARY

A method is disclosed to assign Priority to Processes based on Roles. The method includes storing first role data representing a first role, comprising a first set of authorizations to unlock access to a process running in a computer system, the first role having a first weight. The method then continues by storing second role data representing a second role, comprising a second set of authorizations to unlock access to the process running in the computer system, the second role having a second weight. The method then continues by selecting a process weight for the process from the group consisting of the first weight of the first role, the second weight of the second role, and a calculated weight based on the first and second weights. The method then continues by calculating a process priority of the process, using a scheduler running in the computer system, based on the first weight, if the first role data is to unlock access to the process. The method then continues by calculating the process priority of the process, using the scheduler running in the computer system, based on the second weight, if the second role data is to unlock access to the process. The method then continues by calculating the process priority of the process, using the scheduler running in the computer system, based on either the first weight, the second weight, or the calculated weight, if the first and second role data can unlock access to the process. Finally, the method then continues by assigning a share of the computer system's time to the process, the share of time being based on the process priority calculated for the process.

DISCUSSION OF EXAMPLE EMBODIMENTS OF THE INVENTION

FIG. 1is a functional block diagram of a computer system that performs role based prioritization of computer processes. The computer system includes a memory50, processor192, bulk storage194, and input/output interface196connecting the computer system to communication networks, other processors, and various user input and output devices. The role data buffer100in memory50stores first role data102representing a first role. The first role data102includes a first set of authorizations182in the memory50to unlock access to a process190running in the memory50of the computer system and being executed by the processor192. The first role has a first weight102′ stored in the role data buffer100.

The role data buffer100in memory50stores second role data104representing a second role. The second role data104includes a second set of authorizations184in the memory50to unlock access to the process190running in the memory50of the computer system. The second role has a second weight104′ stored in the role data buffer100.

The processor192, under program control, selects a process weight for the process190from the group consisting of the first weight102′ of the first role, the second weight104′ of the second role, and a calculated weight based on the first and second weights,102′ and104′.

The processor192, under program control, calculates a process priority146of the process190, using a scheduler140running in the memory50of the computer system, based on the first weight102′, if the first role data102is to unlock access to the process190.

The processor192, under program control, calculates the process priority146of the process190, using the scheduler140running in the memory50of the computer system, based on the second weight104′, if the second role data104is to unlock access to the process190.

The processor192, under program control, calculates the process priority146of the process190, using the scheduler140running in the memory50of the computer system, based on either the first weight102′, the second weight104′, or the calculated weight of weights102′ and104′, if both the first and second role data102and104can unlock access to the process190.

The timer160then assigns a share of the computer system's time to the process190, the share of time being based on the process priority146calculated for the process190.

More generally, the process priority146of the process190will be calculated according to the roles authorized to access it. Each role will have a weight, for example102′, assigned to it. If a process190is associated with multiple roles, the system administrator will have the flexibility as how he/she wants to calculate process priority146of the process190based on the various weights102′,104′, etc. of the associated roles. The system administrator can choose the following example policy to calculate the process weight for the process190in case the process is associated with multiple roles:

Best weight:-Best weight from the set of roles will be used.

Least weight:-Least weight from the set of roles will be used.

Average weight:-An average is calculated of all the weight.

The system administrator will be able to assign a weight to each role. This weight will be used by the scheduler140to calculate the priority146of the process. To implement the role based priority, a default role will be created on the system and it will have a weight of zero. All the processes190on the system will have this default role. This default role will have a minimum set of authorizations associated with it.

For example, the system administrator-defined weight for each role on the system is:

Suppose a process190is running with a Backup role, then it will have a weight of 10 and the scheduler140will use this weight to assign priority146to the process. Alternately, if a process190has multiple roles, then processor192, under program control, calculates process weight for the process190according to the policy specified by the system administrator. For example if a process190is running with backup and XYZ roles then the Best weight policy will give this process a weight of 10. The Least weight policy will give this process a weight of 1 (the XYZ role has a weight of 1). And, the average weight policy will give this process a weight of 5.5. This process weight is then used by the scheduler140to calculate the process priority146. The above policy does not use Default class for calculation, since it does not have any weight.

FIG. 2is an example flow diagram of an example embodiment for the sequence of steps carried out by the computer system ofFIG. 1.

Step202is storing first role data representing a first role, comprising a first set of authorizations to unlock access to a process running in a computer system, the first role having a first weight.

Step204is storing second role data representing a second role, comprising a second set of authorizations to unlock access to said process running in said computer system, the second role having a second weight.

Step206is selecting a process weight for said process from the group consisting of the first weight of said first role, the second weight of said second role, and a calculated weight based on said first and second weights.

Step208is calculating a process priority of said process, using a scheduler running in the computer system, based on said first weight, if said first role data is to unlock access to said process.

Step210is calculating the process priority of said process, using the scheduler running in the computer system, based on said second weight, if said second role data is to unlock access to said process.

Step212is calculating the process priority of said process, using the scheduler running in the computer system, based on either said first weight, said second weight, or said calculated weight, if said first and second role data can unlock access to said process.

Step214is assigning a share of the computer system's time to said process, the share of time being based on said process priority calculated for said process.

In this manner, the method to assigns Priority to Processes based on Roles.

Using the description provided herein, the embodiments may be implemented as a machine, process, or article of manufacture by using standard programming and/or engineering techniques to produce programming software, firmware, hardware or any combination thereof.

Any resulting program(s), having computer-readable program code, may be embodied on one or more computer-usable media such as resident memory devices, smart cards or other removable memory devices, or transmitting devices, thereby making a computer program product or article of manufacture according to the embodiments.

Although specific example embodiments have been disclosed, a person skilled in the art will understand that changes can be made to the specific example embodiments without departing from the spirit and scope of the invention.