Patent Publication Number: US-2004049677-A1

Title: Authorization and security management system and method

Description:
FIELD OF THE INVENTION  
       [0001] This invention is related to systems and methods for controlling security of computer implemented systems, and especially to systems and methods for controlling system security by assigning authorities to users.  
       BACKGROUND OF THE INVENTION  
       [0002] Security is becoming increasingly important for computer implemented systems. Traditional technologies for providing system security include access control tables and group access. An access control table controls a user&#39;s access based on predetermined access rights assigned to the user. In group access, a plurality of groups of users is defined, each group is assigned predetermined access rights, and each user is assigned to one or more of the groups. The aforesaid technology lacks flexibility in managing users and in assigning different authorities to each user. Furthermore, user IDs and passwords assigned by administrators are generally stored in original format that can be easily obtained by unauthorized persons.  
       [0003] U.S. Pat. No. 6,295,605 entitled Method And Apparatus For Multi-level Security Evaluation discloses a security system. The security system in large part applies the advantages of several traditional security technologies, including access control tables and group access. The security system divides users into different classes that are assigned with different authorities, and divides system resources into different classes. When a user requests to access a particular class of system resource, the system automatically selects a proper security technology to process the user&#39;s request based on predetermined rules. The security system controls security based on system resources. However, when system resources are expanded and multiplied in an organization, incorporating the extra system resources into the security system&#39;s classes is problematic.  
       [0004] Accordingly, it is desired to provide a system and method which overcomes the abovementioned problems and difficulties.  
       SUMMARY OF THE INVENTION  
       [0005] A primary object of the present invention is to provide an authorization and security management system and method which assigns authorities to users based on operations.  
       [0006] Another object of the present invention is to provide an authorization and security management system and method which encrypts user passwords in order that the passwords can be securely transmitted through a network and securely stored in a database.  
       [0007] To achieve the above objects, in one aspect of the present invention, an authorization and security management system comprises a plurality of client computers, an application server, and a database. Each client computer is interconnected with the application server through a common network, and the application server is interconnected with the database through a database link. Each client computer comprises an interactive user interface for users to send requests for operations. The application server comprises an authorization device, a security device, and a verification device. The authorization device is for maintaining user passwords and assigning roles to users. The security device is for encrypting user passwords and decrypting encrypted passwords. The verification device is for verifying passwords input by users when the users request to log in the system, and for verifying whether operations requested by users are valid. The authorization device comprises a role defining unit and a user management unit. The verification device comprises a first verification unit. The role defining unit is for defining at least one role, the at least one role comprising a set of one or more operations. The user management unit is for adding, modifying or deleting user IDs and roles assigned to users. The first verification unit is for verifying users&#39; requests for particular operations. The database is for storing user IDs, user passwords, and roles assigned to users.  
       [0008] In another aspect of the present invention, an authorization and security management method comprises: providing a plurality of client computers; providing an application server; and providing a database for storing user IDs, user passwords, and roles assigned to users. Each client computer comprises an interactive user interface through which users request operations. The application server comprises a role defining unit, a user management unit, and a first verification unit. The role defining unit is for defining at least one role, the at least one role comprising a set of one or more operations. The user management unit is for adding, modifying and deleting user IDs and roles assigned to users. The first verification unit is for verifying users&#39; requests for particular operations.  
       [0009] In still another aspect of the present invention, another authorization and security management method comprises: (a) defining at least one role, the at least one role comprising a set of one or more operations; (b) assigning at least one role to a user, and saving the assigned at least one role to a database; and (c) determining whether an operation requested by a user is valid according to the at least one role assigned to the user.  
       [0010] These and other objects and features of the present invention will become more fully apparent from the following description and appended claims, or may be learned by practice of the invention as set forth hereinafter. 
     
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
     [0011]FIG. 1 shows hardware architecture of an authorization and security management system in accordance with a preferred embodiment of the present invention.  
     [0012]FIG. 2 shows architecture of functional modules of the system of FIG. 1.  
     [0013]FIG. 3 is a flow chart of setting a password using the system of FIG. 1.  
     [0014]FIG. 4 is a flow chart of a preferred method of implementing the system of FIG. 1. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
     [0015]FIG. 1 shows hardware architecture of an authorization and security management system in accordance with a preferred embodiment of the present invention. The authorization and security management system comprises a plurality of client computers  10 , an application server  12 , and a database  14 . Each client computer  10  is interconnected with the application server  12  through a common electronic communication network  11 . The network  11  may for example be an Intranet, the Internet or another suitable network. The application server  12  is connected with a database  14  through a database link  13 . The database link  13  may for example be Open Database Connectivity (ODBC) or Java Database Connectivity (JDBC).  
     [0016]FIG. 2 shows architecture of functional modules of the authorization and security management system. Each client computer  10  comprises an interactive user interface (UI)  100 , and a first encryption unit  101 . The UI  101  is for accessing information stored in the database  14 , and for performing certain operations such as sending out requests. The first encryption unit  101  is for encrypting users&#39; passwords in order that the users&#39; passwords are transmitted through the network  11  in an encrypted state.  
     [0017] The application server  12  comprises an authorization device  120 , a security device  121 , and a verification device  122 . The authorization device  120  is for assigning authorities to users, and comprises a role defining unit  1201  and a user management unit  1202 . All the authorization and security management system operations are predetermined by system analysts. Such operations include user management, assigning authorities, accessing certain system resources, and undertaking certain cases. The role defining unit  1201  is for defining at least one role. The at least one role is a set of at least one operation. The user management unit  1202  is used for newly adding, modifying, and deleting users and roles assigned to the users. Each user is assigned at least one role so that he has the authority to perform operations involved in all roles assigned to him.  
     [0018] The security device  121  comprises a first decryption unit  1210 , a second encryption unit  1211 , and a second decryption unit  1212 . The first decryption unit  1210  is used for decrypting user passwords that have been encrypted by the first encryption unit  101 . The second encryption unit  1211  is used for encrypting user passwords decrypted by the first decryption unit  1210 , in order that the user passwords can be stored in the database  14  in an encrypted state. The second decryption unit  1212  is used for decrypting passwords encrypted by the second encryption unit  1211 .  
     [0019] The verification device  122  comprises a first verification unit  1220 , and a second verification unit  1221 . The first verification unit  1220  is used for checking users&#39; passwords. When a user requests to log in the authorization and security management system, he keys in his password, and the first verification unit  1220  checks the password keyed in against the user&#39;s password stored in the database  14 . The second verification unit  1221  is used for verifying each user&#39;s request for a specific operation as being valid.  
     [0020]FIG. 3 is a flow chart of setting a password using the authorization and security management system. In step S 30 , a password is set for a user. When a new user is added to the authorization and security management system, a system administrator assigns both a user ID and a password to the user. The user can change his password through the UI  100 . Once a password has been assigned by the system administrator or has been changed by the user, in step S 31 , the password is encrypted by the first encryption unit  101 . In step S 32 , the encrypted password is transmitted to the application server  12  through the network  11 . In step S 33 , the encrypted password is decrypted by the first decryption unit  1210 . In step S 34 , the decrypted password is encrypted by the second encryption unit  1211 . Finally, in step S 35 , the encrypted password is stored in the database  14  through the database link  13 .  
     [0021]FIG. 4 is a flow chart of a preferred method of implementing the authorization and security management system. Firstly, in step S 40 , a user requests to log in the authorization and security management system by keying in his user ID and password through the UI  100 . The password keyed in by the user is encrypted by the first encryption unit  101 , and is then transmitted to the application server  12  together with the user ID. In step S 41 , the application server  12  prepares to check the password received from the client computer  10  against the corresponding password stored in the database  14  according to the user ID. The password received from the client computer  10  is decrypted by the first decryption unit  1210 . The first verification unit  1220  searches the database  14  according to the user ID in order to obtain the stored password. The password obtained from the database  14  is decrypted by the second decryption unit  1212 . In step S 42 , the first verification unit  1220  checks the password decrypted by the first decryption unit  1210  against the password decrypted by the second decryption unit  1212 , to determine whether the password keyed in by the user is valid. If the password decrypted by the first decryption unit  1210  is the same as the password decrypted by the second decryption unit  1212 , the password keyed in by the user is valid; otherwise, the password keyed in by the user is not valid. If the password is not valid, in step S 43 , the request to log in the authorization and security management system is denied, and the procedure returns to step S 40 . If the password is valid, in step S 44 , the user requests an operation through the UI  100 , and the request is sent to the application server  12  through the network  11 . In step S 45 , the second verification unit  1221  determines whether the operation is valid. The second verification unit  1221  searches the database  14  according to the user ID in order to obtain roles assigned to the user, and determines whether the operation is included in the roles assigned to the user. If the operation is included in the roles assigned to the user, the operation is valid; otherwise, the operation is not valid. If the operation is not valid, in step S 46 , the request for the operation is denied. If the operation is valid, in step S 47 , the operation is performed. In step S 48 , the user decides whether he wants to request another operation. If the user wants to request another operation, the procedure returns to step S 44 . If the user does not want to request another operation, the procedure is ended.  
     [0022] Although the present invention has been described in language specific to structural features and/or methodological steps, it is to be understood that the invention defined in the appended claims is not necessarily limited to the specific features or steps described above. Rather, the above-described specific features and steps are disclosed as preferred forms of implementing the claimed invention.