초록 ▼

An access control database has access control objects that collectively store information that specifies access rights by users to specified sets of the managed objects. The specified access rights include access rights to obtain management information from the network. An access control server prov

An access control database has access control objects that collectively store information that specifies access rights by users to specified sets of the managed objects. The specified access rights include access rights to obtain management information from the network. An access control server provides users access to the managed objects in accordance with the access rights specified by the access control database. An information transfer mechanism sends management information from the network to a database management system (DBMS) for storage in a set of database tables. Each database table stores management information for a corresponding class of managed objects. An access control procedure limits access to the management information stored in the database tables using at least one permissions table. A permissions table defines a subset of rows in the database tables that are accessible to at least one of the users. The set of database table rows that are accessible corresponds to the managed object access rights specified by the access control database. A user access request to access management information in the database is intercepted, and the access control procedure is invoked when the user access request is a select statement. The database access engine accesses information in the set of database tables using the permissions tables such that each user is allowed access only to management information in the set of database tables that the user would be allowed by the access control database to access.

대표청구항 ▼

[ What is claimed is:] [1.]1. A computer program product for controlling access to managed objects in a distributed network, the computer program product for use in conjunction with a computer system, the computer program product comprising a computer readable storage medium and a computer program m

[ What is claimed is:] [1.]1. A computer program product for controlling access to managed objects in a distributed network, the computer program product for use in conjunction with a computer system, the computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism comprising:instructions that store an access control database, including access control objects, the access control objects collectively storing information that specifies access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network;instructions for retrieving management information from the managed objects, in response to user access requests, the retrieving instructions including instructions for granting and denying access requests in accordance with the access rights information stored in the access control database;instructions that send management information from the network to a database management system; the management information sent to the database system replicating information stored in the managed objects in the network;instructions that, in the database management system:store in a set of database tables the management information sent by the send instructions, wherein each table in the set of database tables stores in individual rows the management information for corresponding managed objects;store in at least one permissions table, including permission objects, the permission objects collectively storing information that specifies the access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network, wherein the access rights of the permission objects correspond to the managed object access rights specified by the access control database for at least one of the users;intercept a user access request to access management information stored in the database tables;invoke an access control procedure when the user access request is a select statement to access any of the set of database tables;limit access, in the access control procedure, to the management information stored in the set of database tables, the access control procedure using the set of access rights stored in the at least one permissions table to define a permitted subset of rows in at least one of the database tables that are accessible, wherein the permitted subset of rows corresponds to the managed object access rights specified by the at least one permissions table for at least one of the users; andaccess management information stored in the permitted rows in the set of database tables.