Implementation of role/group permission association using object access type

摘要

Security administration in a computer system is simplified by defining a new and independent entity called an Object Access Type (OAT). OATs comprise access control specifications associating roles with permissions, and associating the roles with a set of objects, such as resources or files. Different roles may have differing permissions to objects associated with an OAT, and objects may be assigned to plural OATs. A mechanism is also presented whereby system administrators are provided with the capability to display and manipulate access designations by operating only on the independent OATS.