System and method for managing objects and resources with access rights embedded in nodes within a hierarchical tree structure
OwnerFrederick Mosesinventor
Life of this patent
Estimating the term…
Abstract
A system and method for controlling access to data within a hierarchically organized document, such as an XML document. Elements may have their access rights specified, for example as a variable in an XML tag. If not specified within an element of the document, access rights are inherited from its nearest ancestor. Specified access rights may refer to a collection of entitlement expressions, which describe with arbitrarily fine granularity which users and user types may access the data.
Claims15
A method of controlling access to a hierarchically organized collection of data elements, comprising:
- receiving a document used in defining said data elements, said document including an entitlement ID as an attribute within a definition of a data element or optionally an attribute within a definition of one or more ancestor elements of the data element;
- examining in succession said data element and optionally said one or more ancestor elements of the data element to determine an entitlement status for the element;
- consulting said entitlement ID to determine an entitlement group corresponding to the entitlement status;
- consulting a membership map to determine whether a selected user is a member of the entitlement group, wherein the membership map comprises a matrix of users and group memberships;
- and
- allowing the user to access the data element only if the user is a member of the entitlement group.
A method of describing access restrictions on individual elements of a document having a hierarchical structure, comprising:
- placing entitlement ID's in definitions for one or more elements of the document, said entitlement ID's referring to entitlement expressions describing classes of users allowed to access the elements, where the entitlement ID applicable to an element is the ID placed in the element or in the first ancestor of the element having an entitlement ID.
Dependencies are inferred from the claim text.