Controlling access to objects with rules for a work management environment
AssigneeMicrosoft Corporation
InventorsTao Zhu, Chih Jenh Huang, Dieter Zirkler
Life of this patent
Estimating the term…
Abstract
A security system uses rules to restrict access to objects of a database. These security rules are dynamic because they can adjust when the number of objects in the database is changing. In other words, the security rules can permit access to new objects when new objects are added to, modified, or deleted from the database. With this system, objects can be added to a container by a security administrator or they can be added based upon the triggering or activation of one or more rules. With this system, access to objects in a database is usually determined after each request for access instead of relying on a static permanent list.
Claims18
A computer-implemented method for accessing objects using security rules, comprising:
- receiving from a user a request to perform an action with respect to an object;
- identifying groups to which the user is a member;
- identifying containers associated with the identified groups;
- from the containers identified as being associated with the identified groups,
- identifying the containers that allow the requested action, and, for each of the containers identified as allowing the requested action,
- identifying the security rules associated with each of these containers;
- and
- translating the identified security rules to identify a first set of objects that have an allowed status;
- and
- identifying the containers that deny the requested action, and, for each of the containers identified as denying the requested action,
- identifying the security rules associated with each of these containers;
- and
- translating the identified security rules to identify a second set of objects that have a deny status;
- and
- subtracting the second set of objects from the first set of objects to produce a resultant set of objects;
- and
- providing access to the object for the requested action if the object is contained in the resultant set of objects.
A system comprising at least one central processing unit, the system for controlling access to objects using security rules, comprising:
- a component that receives from a user a request to perform an action with respect to an object;
- a component that identifies containers associated with the user;
- a component that, from the containers identified as being associated with the user,
- identifies the containers that allow the requested action, and, for each of the containers identified as allowing the requested action, translates security rules associated with the container identified as allowing the requested action to identify a first set of objects;
- and
- identifies the containers that deny the requested action, and, for each of the containers identified as denying the requested action, translates security rules associated with the container identified as denying the requested action to identify a second set of objects;
- and
- a component that subtracts the second set of objects from the first set of objects to produce a resultant set of objects;
- and
- a component that provides access to the object for the requested action if the object is contained in the resultant set of objects.
A computer-readable medium containing instructions for controlling a computer system to provide access to objects using security rules, by a method comprising:
- receiving from a user a request to perform an action with respect to an object;
- identifying containers associated with the user;
- for each of the identified containers that will allow the requested action, translating security rules associated with the container to identify a first set of objects;
- and
- for each of the identified containers that will deny the requested action, translating security rules associated with the container to identify a second set of objects;
- and
- subtracting the second set of objects from the first set of objects to produce a resultant set of objects;
- and
- providing access to the object for the requested action if the object is contained in the resultant set of objects.
Dependencies are inferred from the claim text.