Autonomous role-based security for database management systems

Patent metadata

Field	Value
Publication number	US-9298933-B2
Application number	US-201313945148-A
Country	US
Kind code	B2
Filing date	Jul 18, 2013
Priority date	Jul 18, 2013
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

Embodiments described herein generally relate to creating an autonomous role-based security system for a database management system, wherein a super user may not always be required. A computer-implemented method is described. The method includes establishing one or more privileges in a database system, each privilege controlling access to an administrative function for the database system. Each privilege is assigned to one or more roles. Each role may always have a minimum set of users with only administrative rights over the role. A request is received from a first user to grant a role to a second user. A database management system determines whether the first user has administrative privileges over the role. If the first user has administrative privileges over the role, the role is granted to the second user. The database system may satisfy the principles of least privilege and separation of duties.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
establishing one or more privileges in a database system, each privilege controlling access to an administrative function for the database system;
assigning each privilege to one or more roles;
receiving a request from a first user to grant a role to a second user;
determining whether the first user has administrative rights over the role;
granting the role to the second user when the first user is determined to have administrative rights over the role;
receiving a request from the first user to revoke a role from a third user;
determining whether the first user has administrative rights over the role;
determining whether revoking the role from the third user would result in the role not having a threshold number of administrators; and
revoking the role from the third user when the first user is determined to have administrative rights over the role and when the role is determined to have at least the threshold number of administrators after revoking the role from the third user.

2. The method of claim 1 , wherein the determining further comprises determining whether the first user has been granted only administrative rights over the role.

3. The method of claim 1 , wherein the request includes an instruction to grant administrative rights to the second user.

4. The method of claim 3 , wherein the instruction to grant administrative privileges specifies that only administrative rights are to be granted to the second user.

5. The method of claim 1 , wherein the threshold number of administrators is set at a global level or a role-specific level.

6. The method of claim 1 , wherein the first user is an administrative user, and further comprising:
determining that the administrative user's account has been locked;
determining that the administrative user has been assigned a role allowing the administrative user to unlock other accounts;
if the administrative user has been assigned the role allowing the administrative user to unlock other accounts, determining whether a configured time period has passed since the administrative user's account has been locked; and
unlocking the administrative user's account if the configured time period has passed.

7. The method of claim 1 , further comprising:
receiving a request from the first user to grant a change password privilege for an entity to the second user, wherein the entity includes one of a set of users, a set of users possessing a subset of a specific set of roles, or all users;
determining whether the first user has administrative rights over the change password privilege; and
granting the privilege to the second user when the first user is determined to have administrative rights over the change password privilege.

8. The method of claim 1 , further comprising:
receiving a request from the first user to grant an impersonation privilege for an entity to the second user, wherein the entity includes one of a set of users, a set of users possessing a subset of a specific set of roles, or all users;
determining whether the first user has administrative rights over the impersonation privilege; and
granting the privilege to the second user when the first user is determined to have administrative rights over the impersonation privilege.

9. A system, comprising:
one or more processors; and
memory, the memory storing instructions that, when executed by the one or more processors, cause the one or more processors to:
establish one or more privileges in a database system, each privilege controlling access to an administrative function for the database system;
assign each privilege to one or more roles;
receive a request from a first user to grant a role to a second user;
determine whether the first user has administrative rights over the role;
grant the role to the second user when the first user is determined to have administrative rights over the role;
receive a request from the first user to revoke a role from a third user;
determine whether the first user has administrative rights over the role;
determine whether revoking the role from the third user would result in the role not having a threshold number of administrators; and
revoke the role from the third user when the first user is determined to have administrative rights over the role and when the role is determined to have at least the threshold number of administrators after revoking the role from the third user.

10. The system of claim 9 , wherein the memory further stores instructions that cause the one or more processors to determine whether the first user has been granted only administrative rights over the role.

11. The system of claim 9 , wherein the request includes an instruction to grant administrative rights to the second user.

12. The system of claim 11 , wherein the instruction to grant administrative privileges specifies that only administrative rights are to be granted to the second user.

13. The system of claim 9 , wherein the threshold number of administrators is set at a global level or a role-specific level.

14. The system of claim 9 , wherein the first user is an administrative user, and wherein the memory further stores instructions that cause the one or more processors to:
determine that the administrative user's account has been locked;
determine that the administrative user has been assigned a role allowing the administrative user to unlock other accounts;
if the administrative user has been assigned the role allowing the administrative user to unlock other accounts, determine whether a configured time period has passed since the administrative user's account has been locked; and
unlock the administrative user's account if the configured time period has passed.

15. A non-transitory computer-readable storage medium having instructions stored thereon, the instructions when executed causing at least one computing device to perform operations, the operations comprising:
establishing one or more privileges in a database system, each privilege controlling access to an administrative function for the database system;
assigning each privilege to one or more roles;
receiving a request from a first user to grant a role to a second user;
determining whether the first user has administrative rights over the role;
granting the role to the second user when the first user is determined to have administrative rights over the role;
receiving a request from the first user to revoke a role from a third user;
determining whether the first user has administrative rights over the role;
determining whether revoking the role from the third user would result in the role not having a threshold number of administrators; and
revoking the role from the third user when the first user is determined to have administrative rights over the role and when the role is determined to have at least the threshold number of administrators after revoking the role from the third user.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the determining further comprises determining whether the first user has been granted only administrative rights over the role.

17. The non-transitory computer-readable storage medium of claim 15 , wherein the request includes an instruction to grant administrative rights to the second user.

18. The non-transitory computer-readable storage medium of claim 17 , wherein the instruction to grant administrative privileges specifies that only administrative rights are to be granted to the second user.

Assignees

• Goel Anil
• Desai Asif Iqbal
• Gupta Ramesh
• Ghosh Somnath
• Vadodaria Harin
• Sybase Inc

Inventors

• Goel Anil
• Desai Asif Iqbal
• Gupta Ramesh
• Ghosh Somnath
• Vadodaria Harin

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title