Control of access rights in a networked system with data processing

Description

Field of invention

[0001] The invention relates to the management of permissions or access rights in a networked system with data processing.

[0002] Networked systems with data processing encompass a wide variety of systems, such as distributed computer systems, process engineering plants, or supply systems for district heating or natural gas. The objects that can belong to these systems are correspondingly diverse. Examples include hardware and software components, peripheral devices or external devices, as well as application programs, services, data objects such as files or records, and network components. These objects are available to users of a networked system in a variety of ways, for example, to control devices or systems connected to the system, or to query information and records stored on the system's data storage device.

[0003] A control system establishes and monitors communication between users and the system's objects. It also manages access rights, i.e., assigning and controlling rights or permissions that specify whether and how a user can access an object.

[0004] Access control is relevant for many applications. One example is file management on a personal computer (PC), or within a client-server architecture, where multiple users typically have different read and write permissions. The effort required for this type of access control increases with both the number and type of users. The same applies to access rights and objects related to... Internet der Dinge (loT, Internet of Things) or smart production facilities within the framework of a Industrie 4.0. This involves monitoring and controlling physical and virtual objects via public networks such as the internet or non-public networks such as a company intranet. This enables, for example, predictive maintenance. (predictive maintenance) or the optimization of supply chains. Furthermore, the items or objects can be networked with each other, enabling them to perform actions autonomously and collaborate.

[0005] Accordingly, unwanted or unforeseen user access to objects – depending on the type and area of ​​application – can lead to various dangerous scenarios. This is particularly relevant in the IoT environment when it comes to accessing thousands of devices, for example, for controlling supply systems for district heating, drinking water, natural gas, or electricity. State of the art

[0006] Typically, a hierarchical approach is chosen for managing access rights in a networked system with data processing: The objects have a hierarchical organizational structure (e.g., a directory tree). Users and user groups exist. There are different types of permissions or access rights for accessing the objects (read, write, etc.).

[0007] A central administrator is responsible for assigning access permissions to users (or user groups) on devices within the hierarchical structure. Two common methods for such assignment are rwx bits (Unix world) or access control lists (Windows world): Unix world: Each object is assigned to exactly one owner and exactly one user group. Access permissions—e.g., read (r), write (w), and execute (x)—can then be defined for the owner, group members, and "Everyone Else." Windows world: Each object is associated with a list of access control entries. Each entry checks, based on username or group membership, whether access is permitted or not.

[0008] For the IoT application, the known methods have the following disadvantages: Organizing devices in a strictly hierarchical or tree structure may not always be feasible—a single device (e.g., a temperature sensor) can be used in different contexts. Managing these assignments quickly becomes complex and error-prone. For example: Devices in a specific residential area may be viewed by employees of housing association X. A subset of these devices may also be viewed by caretaker Y. Another subset may be viewed by tenant Z. If Y's responsibilities or the premises rented by Z change, adjustments to the device hierarchy, group memberships, and / or permissions may be necessary. In more complex situations, the effects of changes to the device hierarchy or group memberships may not be immediately apparent.Temporary device access (for example, until a specific problem is resolved) is usually only possible by sending reminders to the administrator.

[0009] To manage a large number of users and user groups, an additional hierarchical level is often used, in which different group memberships are grouped into so-called roles. However, this role-based access control approach still relies on a strictly hierarchical structure with the aforementioned problems.

[0010] Another challenge is access control in a heterogeneous environment, which may include different operating or database systems. For example, US 2013 / 0332984 A1 describes a method that reduces access control to mechanisms that are present and usable in all environments. However, this method is still based on a hierarchical approach, specifically role-based access control.

[0011] Many processes are monitored and controlled using data objects that are continuously updated. These include log files used to monitor and control computer systems, supply and production chains, and business processes. For this purpose, data elements are generated and stored in the data objects—for example, at predefined time intervals or upon predefined state changes. These objects are often monitored, evaluated, and / or edited by a large number of users with varying access rights. The German Patent Application US 2013 / 0332984 A1 specifies a method for this scenario, whereby the individual elements of the data objects are assigned access rights corresponding to their content at the time of their creation or storage. In this way, each user can access only the parts of the data object that are relevant to them.However, the dynamic assignment of access rights is again carried out using role-based access control.

[0012] Similarly, according to US 2018 / 204022 A1, the content of a data object can be analyzed, and access to the data can be granted or denied to specific users. According to DE 10 2004 004 101 A1, a data object identifier can also be created in this way and used for access control. However, the effort required for such access control increases with the size and number of data objects.

[0013] WO 2004 / 001555 A2 also describes a role-based approach to access control to query and control, as needed, the performance of the components of a distributed computer system, especially application programs.

[0014] Role-based access control approaches are not limited to natural persons or groups of people, such as administrators, secretaries, or managing directors. As described in US 2012 / 0137213 A1, roles can also be defined for application programs, or roles can be transferred or inherited from natural persons or groups of people to application programs. Application programs can thus be granted the same access rights as natural persons or groups of people.

[0015] The last example shows that a user's role or group membership can change very quickly, especially when dealing with an application program that inherits its role or group membership from multiple users. This problem is addressed in WO 2012 / 151132 A1 with a method that allows for user grouping, which quickly captures and implements such changes, i.e., in "real time." As described in US 2008 / 0127354 A1, such a method can also be supplemented by time or location information.

[0016] Extensions to role-based or group-based access control are also state of the art. US 8,032,558 B2, for example, describes a method in which role-based access control is supplemented with policies that apply to specific nodes—so-called access control points. policy enforcement points - are assigned. Similarly, in the procedure presented in WO 02 / 097591 A2, the access rights of a role are controlled using tickets (tokens) and / or certificates. They can be assigned to or revoked from a role at any time.

[0017] Similarly, patent US 8,458,337 B2 describes an extension of role-based access control in which not the roles but the users are equipped with additional rights or attributes, so that they can acquire different access rights to the objects even though they have the same role.

[0018] Documents US 2011 / 167479 A1 and WO 2015 / 047338 A1 describe methods in which these types of characteristics are derived from the context in which a user requests access rights or from the behavior of a user.

[0019] The methods described in the aforementioned writings all utilize the user's membership in a group or role to manage access rights.

[0020] A slightly different approach can be found in WO 2013 / 048154 A2 or WO 2017 / 095741 A1. It involves grouping objects into logical groups. According to WO 2017 / 095741 A1, grouping is based on markers or tags of the objects, which are defined by an administrator. According to WO 2013 / 048154 A2, object groups are formed based on static criteria. This leads to similar disadvantages as the hierarchical organization of objects described above. Organizing devices into logical groups may not always be possible or desirable. Managing these assignments quickly becomes confusing and error-prone. In more complex situations, the effects of changes to group membership may not be immediately obvious. Temporarily granting device access (for example, until a specific problem is resolved) is usually only feasible by sending reminders to the administrator. Task

[0021] The object of the invention is to provide a method that simplifies the management of access rights in a networked system with data processing, making it more flexible and secure. Solution

[0022] This problem is solved by the subject matter of the independent claims. Advantageous embodiments of the subject matter of the independent claims are identified in the dependent claims. The wording of all claims is hereby incorporated by reference into this description.

[0023] The use of the singular should not exclude the plural, and the same applies in reverse, unless otherwise stated.

[0024] The following section describes individual process steps in more detail. These steps do not necessarily have to be carried out in the order given, and the process described may also include further, unmentioned steps.

[0025] To solve the problem, a method for controlling access rights of at least one user to objects in a networked data processing system is proposed, whereby the access rights control is computer-aided. In this method, at least one user is granted or denied access rights to at least one object. The objects are divided into at least one object group, and the objects' membership in this group is used to decide whether to grant or deny the user access rights. The division or grouping of the objects into this group is performed using at least one rule, which is a logical query used by the networked data processing system to divide the objects into groups.The "at least one" rule refers to at least one property of the objects, whereby the at least one property of the objects used for grouping is a property that changes over time. An object can be represented in more than one group, in a single group, or in no group at all.

[0026] The following properties, among others, are considered as time-varying, dynamic properties of the objects used for grouping: The temperature, pressure, or similar physical properties of parts of the objects; the duration of previous use; current meteorological conditions at the object's location; a history of the aforementioned values; current accesses or a history thereof; fill levels or similar information for components of the objects, such as remaining gas pressure, tank contents, or paper or ink levels; meter readings; information on the degree of wear; etc. The list can be continued indefinitely.

[0027] The basic idea behind this approach is to abandon the strictly hierarchical approach to classifying objects and replace it with a classification based on at least one property or a set of properties. This involves three key aspects or concepts: Access rights – What is a user allowed to do with a shared object? Users – Who is allowed to access the objects? (Dynamic) object group – Which objects are allowed to be accessed? Objects with defined properties are grouped into an object group, a dynamic object group if at least one of the properties used for grouping is subject to change over time. The members of a dynamic object group are continuously updated; that is, they are constantly redefined based on a set of rules or conditions.

[0028] The rules can be any Boolean expressions, as well as fuzzy logic decisions and neural networks for deciding on grouping.

[0029] The procedure offers several advantages: Access rights management is simplified – especially when managing a large number of objects. The process can be carried out independently of any hierarchical grouping of objects. Dynamic sharing via object properties enables fine-grained assignment of objects to users who need to perform a specific task using those objects. This is difficult to achieve with existing methods. Sharing defined objects increases information security: after the "need The "to know" principle means that objects with certain properties can only be accessed - if these properties are no longer present, access is no longer possible.

[0030] The method can generally be used for networked systems with data processing, e.g.: for the implementation of "Internet of Things" technologies, for the control of production facilities and supply systems such as for district heating, water, natural gas or electricity, for process control of process engineering plants, for control or user management in computer networks, computing clusters or supercomputers, for the maintenance or monitoring of a printer fleet, in telecommunications systems, in virtual plants and systems and in real plants and systems that can be extended with virtual objects.

[0031] Corresponding to the diversity of networked systems with data processing, the objects can represent, for example, devices, files, data objects, records, services, application programs, computer systems, software and / or hardware components.

[0032] The same applies to users, who can be real people on the one hand, and devices, services, application programs, computer systems, software and / or hardware components on the other. An application program, for example, can inherit permissions from a user and thus exercise access rights to services or other objects that are similar to or even equivalent to the access rights of the user, especially a natural person.

[0033] Access rights or permissions can be simple read and / or write access, or permissions to execute a program on a computer system or on a suitable subsystem belonging to one of the objects. Remote control or... remote control Controllable objects and / or further access via a first object to a second object is also possible.

[0034] The process relies on rules that can be defined, for example, by an administrator. Another option involves rules derived using data analysis methods or simulations. This allows access control to incorporate not only the current state of the objects but also empirical data, statistical analyses, or forecasts of object behavior. Access rights control can thus be proactively managed, for example, to plan maintenance cycles, or implemented using digital twins, which enable the simulation of object behavior in fast motion or testing under various conditions or scenarios.

[0035] Access rights rules are based on logical queries, such as whether a measured value lies within or outside a specified interval. The boundaries of these intervals represent thresholds. This allows object properties to be translated into logical statements (true or false), which can be expressed using multiple discrete or continuous values. Thresholds can also be defined using statistical functions (min, max, avg, mean, top 10, etc.) and time references (today, yesterday, last month, etc.).

[0036] The basic idea of ​​the method is based on time-varying properties. The associated rules can be based on one or more of these properties. They can also include static or unchanging properties, such as device type, location, or owner. For grouping the objects (or dividing the objects into groups), at least one static property of the objects can then be used. The term "static" refers to time scales that are typically larger than the time scales for a change in the time-varying property(ies) of the objects. In this way, existing hierarchical approaches can still be used: A subtree or subtree of an object hierarchy can be represented as a group formed based on a static property.

[0037] To group objects, the values ​​of the object properties that were last determined by the system's objects and / or stored in the system can be used. This allows for an update of the object groups that closely reflects the current state of the system. In other words, the grouping occurs in real time.

[0038] Should real-time grouping prove too volatile, the object grouping can also be checked and adjusted only at predefined intervals. Depending on the application and system, this interval can be, for example, a few microseconds or milliseconds, minutes, or hours. This is advantageous, for instance, for properties that can only be described with continuously changing or highly fluctuating values, as the object grouping does not need to be re-evaluated and adjusted after every change.

[0039] Another alternative for dealing with potentially noisy dynamic properties is to group the objects into at least one object group with temporal damping or artificial hysteresis. This prevents an object from unintentionally jumping back and forth between different groups.

[0040] If at least one time-varying property changes only very slowly within certain non-significant fluctuations, it is better to re-evaluate the grouping of the objects based on this property only when at least one property of the object has changed by a predetermined value.

[0041] The values ​​used to determine whether a change is significant should preferably be relative or percentage values. Otherwise, the grouping or subdivision of objects depends on fluctuating absolute values. This can impair the reliability of access control, for example, if the values ​​are very small.

[0042] In addition to grouping objects, the process can also include steps for grouping users. This is only useful if multiple users require at least one access right to at least one of the objects. The users are then divided into at least one user group, with this division being carried out using at least one rule that relates to at least one user attribute. The users' membership in the at least one user group is then used to decide whether to grant or deny members of a user group the at least one access right to at least one of the objects. A user can be a member of more than one user group.

[0043] Furthermore, the problem is solved by a computer program which, when executed on a computing unit, a microcontroller, DSP, FPGA or computer or on a plurality of them in a network, performs the inventive method in one of its embodiments.

[0044] Furthermore, the problem is solved by a computer program with program code means to carry out the method according to the invention in one of its embodiments when the program is executed on a computing unit, a microcontroller, DSP, FPGA or computer, or on a plurality of these in a network. In particular, the program code means can be instructions stored on a computer-readable data carrier.

[0045] Finally, the problem is solved by a modulated data signal which contains instructions executable by a computing unit, a microcontroller, DSP, FPGA or computer or by a plurality of them in a network to carry out the method according to the invention in one of its embodiments.

[0046] Both a computer system and a computer system can be used to execute the procedure. Stand-alone The invention can be implemented using computers or microcontrollers, DSPs or FPGAs, as well as a network of microcontrollers, DSPs, FPGAs or computers, for example, a closed, in-house network, or computers connected via the internet. Furthermore, the computer system can be implemented as a client-server configuration, with parts of the invention running on the server and others on a client. It comprises a device configured to execute the method according to the invention.

[0047] Furthermore, the problem is solved by a data carrier on which a data structure is stored which, after being loaded into a working and / or main memory of a computing unit, a microcontroller, DSPs, FPGAs or computer or a plurality of them in a network, can execute the inventive method in one of its embodiments.

[0048] To solve the problem, a networked data processing system is proposed in which at least one user can be granted or denied access to at least one object within the networked data processing system. This access right is controlled by a control mechanism linked to the objects. The control mechanism includes means for dividing the objects into at least one object group. Furthermore, the control mechanism provides means for using the objects' membership in this object group to determine whether to grant or deny the at least one user access to at least one of the objects.Finally, the control system also includes means by which the objects can be divided into at least one object group using at least one rule. This at least one rule is a logical query used by the networked data processing system to divide the objects into groups. The at least one rule refers to at least one property of the objects, and this property used for grouping is a time-varying property.

[0049] A computer program comprising commands that cause the control system to execute the process steps of a method according to the invention also solves the problem.

[0050] The task is solved remotely by a data carrier on which the computer program just described is stored.

[0051] Further details and features will become apparent from the following description of preferred embodiments in conjunction with the figures. The respective features can be implemented individually or in combination. The possibilities for solving the problem are not limited to the embodiments shown. One embodiment is shown schematically in the figures. Identical reference numerals in the individual figures denote identical or functionally equivalent elements, or elements that correspond to each other with respect to their functions. Specifically, the figures show: Fig. 1 a networked system with data processing; Fig. 2 a networked system with data processing in which access control is carried out, among other things, using simulation results and results of data analyses; and Fig. 3 an exemplary formation of user and object groups and the associated schematic access rights. Figure 1

[0052] Fig. 1 The system represents a networked data processing system (100) in which access rights can be requested by a set of users (N1 to Ni) for a set of objects (O1 to Ot) (where n and t are natural numbers). The system includes a user group management system (110), an access rights management system (120), and an object group management system (130). The user group management system (110) uses a set of rules (140) to divide users (N1 to Ni) into groups. Similarly, the object group management system (130) uses a set of rules (150) to divide objects (O1 to Ot) into object groups. Access rights are granted or denied by the access rights management system (120) based on the membership of users (N1 to Ni) in user groups and objects (O1 to Ot) in object groups, applying a set of rules (160). An administrator 170 manages the rule sets 140, 150 and 160.

[0053] Objects O1 to Ot are assigned to object groups in System 100, all of which are at the same organizational level and are therefore treated as equivalent by System 100. This simplifies access control, as a user's request for access rights to an object O1 to Ot can be resolved with a single logical query, rather than with the series of queries required in hierarchical organizational structures. Furthermore, changes in System 100, its administrative structures, or access profiles can be easily incorporated into rule sets 140, 150, and 160. This eliminates the need to create additional organizational structures or align them with older ones.

[0054] Furthermore, operating System 100 with the proposed method allows for the management of access rights to a large number of objects, since access control is carried out at the group membership level and not at the object level.

[0055] In particular, the assignment of objects O1 to Ot to the object groups can be dynamic, e.g., based on a time-varying property of objects O1 to Ot. After the "need-to-know" Therefore, according to this principle, users N1 to Ni can only access objects O1 to Ot with specific properties. This further simplifies the management of objects O1 to Ot, as the object group management system only forwards access rights to objects O1 to Ot that are organized in the corresponding group. Furthermore, this makes the system more secure, as objects O1 to Ot that do not meet certain properties are not visible to users N1 to Ni and therefore cannot be attacked.

[0056] As an example of a networked system 100, access control to the devices and components of a district heating supply system can be considered, with the following exemplary specifications: Specification of dynamic device group G: "A controller that is in a fault state and whose outdoor temperature sensor displays a value < 10 °C." Specification of user group N: "A caretaker in Berlin." Specification of the assignment: "All members in user group N are permitted to view the system diagram of the devices from dynamic device group G in read-only mode."

[0057] Group G can contain no devices, one device, or multiple devices. Members of group N only see the devices experiencing a problem. Once the problem is resolved, the affected devices disappear from group G.

[0058] The characteristics for forming the device groups can be, for example: Device information (e.g., name, address, contact person, or other meta information), device types (e.g., controller, pump, counter, actuator, measuring or control station), device information from any existing web application (e.g., groups, tags, number of defined alarms), or device data (all measured values ​​transmitted by the device).

[0059] Numerical values ​​can also be used in statistical functions (min, max, avg, mean, top10, ...) and with a temporal reference (today, yesterday, last month, ...).

[0060] Multiple conditions regarding the properties of the devices can be linked. A device is included in the group, for example, if all conditions are met. Any Boolean expressions are conceivable for formulating the rules, as are fuzzy logic decisions and neural networks for deciding on the grouping.

[0061] The specification for the aforementioned device group G can also look like this: "Release all faulty heating controllers to the appropriate technicians." "(Read-only) release of all heat meters in Senate buildings to Senate staff." "Read-only release of the device location of heat meters that do not provide a flow measurement to the central control room of X." "Release of the top 10 consumers on supply line Y last year to the sales department of company Z." "Release of all devices with the label / flag / tag "Problem" to technicians." (Call centers can use such flags to identify systems.) "Release of all devices whose name begins with 0815 to the customer with customer number 0815." "Release of all devices with (outdated) firmware version < 1.35 to customer service to prepare an update." "Release of all devices in area X that consumed less than Y kWh last year to the sales department." Other examples from the general IT environment include: "All .JPG files larger than 100 MB are granted to the intern." "Read-only access to all Word documents in a specific directory that are older than 2 years." (For example, they may no longer be modified for compliance reasons.) Figure 2

[0062] Fig. 2 Figure 1 shows a networked system with data processing 200, in which the administrator can incorporate results from simulations and data analyses 210 when creating rule sets 140, 150, and 160. In a preferred embodiment, these results can be directly incorporated into rule set 160. In this way, for example, results obtained using digital twins of objects O1 to Ot or using records of the properties of objects O1 to Ot or comparable objects can be used to predict the behavior of objects O1 to Ot and, if necessary, to assign an object O1 to Ot (or several objects) to an object group, even if that object O1 to Ot does not meet the necessary conditions. This can be used, for example, for planning maintenance cycles. It is also conceivable to subject the system to a virtual stress test and incorporate the test results into the access control. Figure 3

[0063] Fig. 3 This shows further details of the operational part of a networked system with data processing 100 or 200, which consists of users N1 to Ni, user group management 110, access rights management 120, object group management 130, and objects O1 to Ot. Users N1 to Ni are assigned to user groups NG1 to NGj according to the connections shown (where j is a natural number). Similarly, objects O1 to Ot are assigned to object groups OG1 to OGs according to their current state, as shown (where s is a natural number). Access rights management 120 manages access rights Z1 to Zk, which are generated using rules 160 (where k is a natural number). In the example shown, users N1 and N4 belong to user group NG1.Access rights management 120 can grant you access right Z 1 to objects O 1, O 3 and O 4 in object group OG 1. Access right Z 2 is not available to user N 4.

[0064] Groups can contain multiple users N1 to Ni or objects O1 to Ot, one user N1 to Ni or one object O1 to Ot, or none of the users N1 to Ni or none of the objects O1 to Ot. Multiple user groups can also access one access right Z1 to Zk, or multiple access rights Z1 to Zk can be directed to an object group OG1 to OGs. Furthermore, a user group NG1 to NGj can have multiple access rights Z1 to Zk, or one access right can be directed to multiple object groups OG1 to OGs. References to and from empty groups are also possible; that is, groups to which no members are assigned according to the current system state. glossary Real-time

[0065] Information technology systems operate in real time (English) real-time Data processing programs are continuously operational and their results are available (almost) simultaneously, meaning within a predefined timeframe and without delays exceeding system-related processing times. Depending on the use case, the data may be generated randomly or at predetermined times. The predefined timeframe can range from a few microseconds or milliseconds, to minutes or hours, depending on the application and system. Property of an object

[0066] An object's property, belonging to a networked system with data processing, can be static information about the object, such as its name, owner, location, or type, or time-varying information, such as size, pressure, temperature, or fill level. This information, data, or property can be stored on a central server or storage medium within the system, reside in decentralized structures within the system, be transmitted by the object itself, and / or be provided by a web application. users

[0067] A user of a data processing system is a natural person, an application program, a service, a computer system, a hardware or software component, or a device connected to the system. A user can authenticate themselves in a networked data processing system or obtain authentication from another user. Users can request access rights to objects in a networked data processing system and use those objects to perform a specific task. User group

[0068] A user group is formed from the set of users of a networked data processing system based on a rule. This rule represents a logical query of a user group management system, which assigns users to a user group based on the result of this query. A user group can contain multiple users, one user, or no users. object

[0069] An object is an application program, a service, a device, a file, a data object, a record, a computer system, or a hardware or software component of a networked data processing system. An object is available to users of a networked data processing system to accomplish one or more tasks, such as providing information, data, or specific functionalities. Users can request access rights to objects within a networked data processing system to complete a task. Object group

[0070] An object group is formed from the set of objects in a networked data processing system based on a rule. This rule represents a logical query for an object group manager, which assigns objects to an object group based on the result of this query. An object group can contain multiple objects, one object, or no objects. Rule

[0071] A rule typically represents a logical query. Rules can be used in networked systems with data processing to divide users or objects into groups, or to define user access rights to objects. The rules can be any Boolean expressions, as well as fuzzy logic decisions and neural networks used to determine grouping. Time-varying property

[0072] A time-varying property is a characteristic of an object in a networked data processing system that can change without external intervention. External intervention can be performed, for example, by a system administrator or a user; that is, external intervention requires input or a change to a system parameter that the system cannot perform itself or autonomously. In contrast, static or unchanging properties are characterized by the fact that they do not change or can only be changed through external intervention. This includes properties that arise when an object is created or installed and cannot be changed after creation or installation, or only through external intervention. Access rights / authorization

[0073] An access right or authorization allows a user of a networked system with data processing to access objects within the system in order to perform specific actions. These include simple read or write access, executing programs, remote control of objects, especially devices or hardware components, and further access from one object to another. Reference sign

[0074] 100 Networked system with data processing 110 User group management 120 Access rights management 130 Object group management 140 Rules for creating user groups 150 Rules for creating object groups 160 Rules for creating access rights 170 Administrator N a User of system 100, where a ∈ {1, 2, ... i} O a Object of system 100, where a ∈ {1, 2, ... t} 200 Networked system with data processing, in which simulation results and data analyses are used to manage access rights 210 Computer system for simulation and data analysis 300 Schematic representation of access control in a networked system with data processing 100 or 200 NG a user group, where a ∈ {1, 2, ... j} OG a object group, where a ∈ {1, 2, ... s} Z a access right, where a ∈ {1, 2, ... k} cited literature cited patent literature

[0075] WO 02 / 097591 A2 US 8,458,337 B2 US 2012 / 0137213 A1 US 8,032,558 B2 US 2008 / 0127354 A1 US 2013 / 0332984 A1 WO 2015 / 092341 A1 WO 2012 / 151132 A1 WO 2004 / 001555 A2 US 2011 / 0167479 A1 WO 2013 / 048154 A2 WO 2015 / 047338 A1 WO 2017 / 095741 A1 US 2018 / 204022 A1 DE 10 2004 004 101 A1

Claims

1. Method for controlling access rights (Z1, ..., Zk) of at least one user (N1, ..., Ni) to objects (O1, ..., Ot) in a networked system with data processing (100; 200); 1.1 controlling the access rights (Z1, ..., Zk) being computer-aided; 1.2 the at least one user (N1, ..., Ni) being granted or denied at least one access right (Z1, .... Zk) to at least one of the objects (O1, ..., Ot); 1.3 the objects (O1, ..., Ot) being subdivided into at least one object group (OG1, ..., OGs); 1.4 the membership of the objects (O1, ..., Ot) to the at least one object group (OG1, ..., OGs) being used to decide whether the at least one user (N1, ..., Ni) is granted or denied the at least one access right (Z1, ..., Zk) to at least one of the objects (O1, ..., Ot); 1.5 the objects (O1, ..., Ot)being subdivided into the at least one object group (OG1, ..., OGs) using at least one rule (150); 1.5.1 characterized in that the at least one rule represents a logical query used by the networked system with data processing to subdivide the objects into groups; 1.6 the at least one rule (150) relating to at least one property of the objects (O1, ..., Ot); 1.7 the at least one property of the objects (O1, ..., Ot) used for the grouping being a time-varying property; and 1.8 the at least one rule (150) being based on threshold values for the properties of the objects (O1, ..., Ot).

2. Method according to the preceding claim, characterized in that the at least one rule (150) for grouping the objects (O1, ..., Ot) is obtained using simulations and / or data analysis methods.

3. Method according to either of the preceding claims, characterized in that at least one static property of the objects is also used for grouping the objects.

4. Method according to any of the preceding claims, characterized in that the objects (O1, ..., Ot) are subdivided into the at least one object group (OG1, ..., OGs) on the basis of the value of the at least one property of the objects (O1, ..., Ot) that was last determined and / or stored by the computer system.

5. Method according to any of the preceding claims, characterized in that the grouping of the objects (O1, ..., Ot) into the at least one object group (OG1, ..., OGs) is reviewed and adjusted at a specified interval.

6. Method according to any of the preceding claims, characterized in that the objects (O1, ..., Ot) are grouped into the at least one object group (OG1, ..., OGs) with a temporal damping or artificial hysteresis.

7. Method according to any of the preceding claims, characterized in that the assignment of an object (O1, ..., Ot) to an object group (OG1, ..., OGs) is re-evaluated if the at least one property of the object (O1, ..., Ot) has changed by a specified value.

8. Method according to the immediately preceding claim, characterized in that the specified value indicates a relative and / or percentage change in the at least one property of the objects (O1, ..., Ot).

9. Method according to any of the preceding claims, characterized in that 9.1 a plurality of users (N1, ..., Ni) require at least one access right (Z1, ..., Zk) to at least one of the objects (O1, ..., Ot); 9.2 in that the users (N1, ..., Ni) are subdivided into a plurality of user groups (NG1, ..., NGj); 9.3 in that the users (N1, ..., Ni) are subdivided into the user groups (NG1, ..., NGj) using at least one rule (150); 9.4 in that the at least one rule (150) relates to at least one property of the users (N1, ..., Ni); 9.5 in that the membership of a user (N1, ..., Ni) to a user group (NG1, ..., NGj) is used to decide whether this user (N1, ..., Ni) is granted or denied the at least one access right (Z1, ..., Zk) to at least one of the objects (O1, ..., Ot).

10. Networked system with data processing (100; 200) 10.1 comprising a plurality of objects (O1, ..., Ot); 10.2 comprising a controller coupled to the objects, which controller can grant or deny at least one user (N1, ..., Ni) at least one access right (Z1, ..., Zk) to at least one of the objects (O1, ..., Ot) of the networked system; 10.3 the controller having means by means of which the objects (O1, ..., Ot) can be subdivided into at least one object group (OG1, ..., OGs); 10.4 the controller having means by means of which the membership of the objects (O1, ..., Ot) to the at least one object group (OG1, ..., OGs) can be used to decide whether the at least one user (N1, ..., Ni) is granted or denied the at least one access right (Z1, ..., Zk) to at least one of the objects (O1, ..., Ot); 10.5 the controller having means by means of which the objects (O1, ..., Ot) can be subdivided into the at least one object group (OG1, ..., OGs) using at least one rule (150); 10.5.1 characterized in that the at least one rule represents a logical query used by the networked system with data processing to subdivide the objects into groups; 10.6 the at least one rule (150) relating to at least one property of the objects (O1, ..., Ot); 10.7 the at least one property of the objects (O1, ..., Ot) used for the grouping being a time-varying property; and 10.8 the at least one rule (150) being based on threshold values for the properties of the objects (O1, ..., Ot).

11. Computer program comprising instructions causing the controller of claim 10 to carry out the method steps according to any of claims 1 to 9.

12. Data carrier on which the computer program according to claim 11 is stored.