Per property access control mechanism
AssigneeMicrosoft Corporation
InventorsPraerit Garg, Michael M. Swift, Clifford P. Van Dyke, Richard B. Ward, Peter T. Brundrett
Life of this patent
Estimating the term…
Abstract
Providing access control to individual properties of an object is described. In one embodiment, a computer system comprises an operating system operative to control applications and services running on the system. The service maintains a service object having at least one property. Also included in the system is an access control module within the operating system. The access control module includes an access control interface operative to control access to a property of the object.
Claims33
A computerized access control system, comprising:
- an operating system operative to control an application and a service running on a computer, the service maintaining a service object having at least a first property and a second property;
- and
- an access control module within the operating system, the access control module including an access control interface, and the access control module operative to provide a first permission to the first property and a second permission to the second property, wherein the first permission and the second permission include different access control rights.
A method for controlling access by a software application to a property identified by a first property identifier in an object, the method comprising:
- determining a user identifier associated with the software application;
- retrieving an access control entry associated with the object, said access control entry having a second property identifier, a security identifier, an access right definition and an access right type;
- and
- comparing the first property identifier to the second property identifier and if the property identifiers are equal, checking if the user identifier equals the security identifier and if so, providing the access right definition and the access right type to the software application.
A computer comprising:
- a processor;
- a computer-readable medium;
- an operating system operative to control an application and a service running on a computer, the service maintaining a service object having at least a first property and a second property;
- and
- an access control module within the operating system, the access control module including an access control interface, and the access control module operative to provide a first permission to the first property and a second permission to the second property, wherein the first permission and the second permission include different access control rights.
A computer readable medium having computer-executable instructions for performing a method comprising:
- determining a user identifier associated with a software application;
- retrieving an access control entry associated with an object, the object having a property identified by a first property identifier, and the access control entry having a second property identifier, a security identifier, an access right definition, and an access right type;
- and
- comparing the first property identifier to the second property identifier and if the property identifiers are equal, checking if the user identifier equals the security identifier and if so, providing the access right definition and the access right type to the software application.
A computer-readable medium having stored thereon a data structure comprising:
- a first data field containing data specifying an access right type;
- a second data field containing data specifying an access permission;
- a third data field containing a first property identifier;
- a fourth data field containing a security id, wherein during a predetermined data processing operation a data field in the column identified by the fourth data field is compared to a user identifier and if equal, data in the third field is compared to a second property identifier and if equal providing the data in the first and second fields to a software application.
A method of communicating between a software application process and an access control module, the method comprising:
- issuing, by the software application a function call to a function having parameters comprising an access token having a user identifier, a security descriptor, and a desired access;
- receiving by a validation module the function call and parsing the function call to retrieve the parameters;
- and
- issuing by the access control module an indicator signal indicating the status of the function call.
A computerized access control system, comprising:
- a component operative to control an application running on a computer, the application managing an object having at least a first property and a second property;
- and
- an access control module operative to provide a first permission to the first property and a second permission to the second property, wherein the first permission and the second permission allow different access control rights.
A computer comprising:
- a processor;
- a computer-readable medium;
- a component operative to control an application running on a computer, the application managing an object having at least a first property and a second property;
- and
- an access control module operative to provide a first permission to the first property and a second permission to the second property, wherein the first permission and the second permission allow different access control rights.
Dependencies are inferred from the claim text.