System for determining the rights of object access for a server process by ...

[54] SYSTEM FOR DETERMINING THE RIGHTS OF OBJECT ACCESS FOR A SERVER PROCESS BY COMBINING THEM WITH THE RIGHTS OF THE CLIENT PROCESS

[75] Inventors: Jeffrey A. East, Aptos, Calif.; James J. Walker, Redmond, Wash.; Steven M. Jenness, Redmond, Wash.; Mark C. Ozur, Redmond, Wash.; James W. Kelly, Jr., Redmond, Wash.

[73] Assignee: Digital Equipment Corporation,

Maynard, Mass.

[ * ] Notice: The portion of the term of this patent subsequent to Feb. 16, 2010 has been disclaimed.

[21] Appl. No.: 11,293

[22] Filed: Jan. 29,1993

Related U.S. Application Data

[63] Continuation of Ser. No. 873,359, Apr. 21, 1992, Pat. No. 5,187,790, which is a continuation of Ser. No. 373,878, Jun. 29, 1989, abandoned.

[51] Int.C1.5 G06F 13/14

[52] U.S. CI 395/725; 395/650;

364/DIG. 1; 364/DIG. 2; 364/241.8: 364/246.6; 364/280; 364/280.4; 364/281.4; 364/284; 364/284.3; 364/285.4; 364/286.4:

364/286.5

[58] Field of Search 395/650, 725;

364/DIG. 1, DIG. 2

[56] References Cited

U.S. PATENT DOCUMENTS

4,135,240 1/1979 Ritchie 395/425

4,455,602 6/1984 Baxter, III et al 395/775

4,525,780 6/1985 Bratt et al 395/425

4,584,639 4/1986 Hardy 395/650

4,621,321 11/1986 Boebert et al 395/600

4,656,579 4/1987 Bachman et al 395/425

4,701,840 10/1987 Boebert et al 395/800

4,713,753 12/1987 Boebert et al 395/425

4,714,996 12/1987 Gladney et al 395/600

4,800,488 1/1989 Agrawal et al 395/800

4;809,160 2/1989 Mahon et al :395/700

4,825,354 4/1989 Agrawal et al 395/600

4,849,877 7/1989 Bishop et al 395/650

4,901,231 2/1990 Bishop et al. 395/325

5,057,996 10/1991 Cutler et al 395/650

5.129.083 7/1992 Cutler et al 395/600

5.129.084 7/1992 Kelly, Jr. et al 395/650

5,136,712 8/1992 Perazzoli, Jr. et al 395/600

5,187,790 2/1993 East et al 395/725

5,249,293 9/1993 Schreiber et al 395/650

Primary Examiner—Thomas C. Lee
Assistant Examiner—Wayne Amsbury
Attorney, Agent, or Firm—Flehr, Hohbach, Test,
Albritton & Herbert

[57] ABSTRACT

In a multitasking, multiuser computer system, a server process temporarily impersonates the characteristics of a client process when the client process preforms a remote procedure call on the server process. Each process has an identifier list with a plurality of identifiers that characterize the process. The server process generates a new identifier list which is either the same as the client process's list, or is the union of the server's and the client's lists. Each object in the system can have an access control list which defines the identifiers that a process must have in order to access the object. The operation system has access checking software for enabling a selected process access to a specified object when the identifiers for the process match the list of identifiers in the access control list of the specified object. The server can therefore access all objects accessible to the client while the server is working for the client. The server can restore its original identifier list after completing the services that it performs for the client.

8 Claims, 20 Drawing Sheets