Data processing: database and file management or data structures – Database design – Data structure types
Reexamination Certificate
2001-10-16
2003-11-25
Homere, Jean R. (Department: 2177)
Data processing: database and file management or data structures
Database design
Data structure types
C707S793000, C707S793000, C707S793000, C709S203000, C709S219000, C709S225000, C709S229000
Reexamination Certificate
active
06654745
ABSTRACT:
STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH
Not Applicable.
FIELD OF THE INVENTION
The invention relates generally to a method and system for managing access to resources over a computer network. More particularly, the method and system for managing access utilizes entitlement expressions that refer to membership maps and unique accessor identification indices into the membership maps to determine a user's entitlement to a resource.
BACKGROUND OF THE INVENTION
As more business is done on computers, and particularly as more business is done and information is exchanged across computer networks, access controls for determining which computer users and software applications may obtain access to which data or other computerized resources across these computer networks becomes increasingly important. Access controls, for example, can control access to pages on the World Wide Web, allowing differential content to be provided to different groups of people, whether they are paying customers who pay for differing levels of access, or to different groups of people who may have rights to differing levels of confidential information. Access controls can also provide differing levels of database access and transaction authorization as well as controlling the flow of information that is broadcast or “pushed” over a computer network such as in electronic publishing and message forwarding.
Traditional systems for managing access to system resources typically use archaic syntax to specify recipients who are entitled to use of or access to information or other resources in a computer system. Reprogramming these systems to adapt to new conditions, such as new levels of access or new groups to whom access is granted, is cumbersome. The need to learn a particular syntax also results in time consuming training and “trial and error” periods for new users of these systems to learn how to use the systems efficiently.
Other systems utilize access control lists (ACLs). In general, ACLs associate names and lists of names with objects for access purposes. In general, inclusion on a list or a list specified in some other list constitutes entitlement. This style of entitlement requires complex list administration in order to represent complex conditions of entitlement, conditions, for instance, where a user characteristic is superceded by some other characteristic.
One problem with access control lists is that they can only represent simple entitlement rules and the ACL approach typically does not allow use of arbitrary functions or conditions when specifying access to or control of a resource. Accordingly, ACLs are not rich enough for sophisticated applications. Access control list systems also cause server performance to degrade when the numbers of users or objects or lists become large, requiring multiple time consuming database select and join operations to be performed serially in order to determine access entitlements. As sites on the World Wide Web become more complex and attract more users, all expecting prompt service from the Web site, the problem of determining user entitlement to an object becomes more acute.
In addition, ACLs generally are not available in encapsulated (object-oriented) implementations, making implementation and maintenance of the ACL software difficult. For these and other reasons, ACL implementations are typically specific to platform operating system or web server implementations.
It would, therefore, be desirable to provide a system that can arbitrate access to particular resources in a system while avoiding or mitigating the problems of prior art systems. Such a system would preferably improve performance where the number of users is large, possibly by requiring only simple database operations that can be performed in parallel. The system should also allow for simple maintenance and update of databases containing access information while at the same time utilizing plain text message entitlement rules and allowing arbitrary functions or conditions to specify access to or control of a resource. The system should also be available in an encapsulated format that is readily deployable on any of a single computer, special purpose embedded applications, a wide or local area network, intranets, the Internet or other networks or systems where user entitlement to resources must be determined.
SUMMARY OF THE INVENTION
The invention described herein provides a platform independent, fast, scalable and standards compliant entitlement manager that enables the practical implementation of sophisticated, personalized access control. With the entitlement management system of the invention, simple expressive representations of complex entitlement rules are provided in an easy to administer format. The efficient data structures and techniques used result in high performance even with large numbers of objects, users and lists and the scalable algorithms and techniques of the system provide built-in support for growth. The invention also provides accessor, accessor group and object registry builder tools that are easy to set up and allow for ongoing maintenance.
A method according to the invention, applied in a system having a plurality of accessors desiring access to one or more resources and at least one resource, determines accessor entitlement to a resource in response to an accessor request for access to that resource. The method includes associating an entitlement expression with the resource, and associating a unique identifier with the accessor. The entitlement expression includes a reference to at least one membership map having membership information for the accessor, and the accessor's unique identifier acts as an index into the membership maps. The method includes evaluating the entitlement expression for the resource to determine the entitlement of the requesting accessor to the resource where the evaluation includes looking up the accessor's membership information in the at least one membership map referred to in the entitlement expression using the accessor's unique identifier.
The system may further include at least one accessor group where each group has a name, zero or more accessors that are members of the group, and a membership map for determining whether a particular accessor is a member of the group. The entitlement expression then references at least one membership map by including at least one group name corresponding to a group having a membership map in the entitlement expression. The entitlement expression may also include more than one group name, and may include operators such as boolean operators, for example, for operating on the group names to evaluate an entitlement request. For example, such an entitlement expression might be “all U.S. citizens minus males under the age of 25” where “all U.S. citizens” and “males under the age of 25” are groups of accessors and “minus” is an operator. In evaluating this entitlement expression for an accessor, the system uses the accessor's identifier as an index into membership maps to determine whether the accessor is a member of either of the two groups, then evaluates the expression to determine whether the accessor meets the entitlement requirements.
In one embodiment, each membership map is a bit map and the accessor's unique identifier is an index to a position in each bit map wherein the bit at that position indicates whether the accessor is a member of the group corresponding to the bit map. The membership bit maps can be conveniently stored in paged data structures.
The invention also includes a system for determining accessor entitlement to a resource having a first means for storing a plurality of accessors and a unique identifier associated with each accessor and a second means for storing a plurality of unique accessor group names. Each of the plurality of accessor group names has an associated membership map with the accessor identifier acting as an index into the accessor group membership maps for determining whether an accessor is a member of an accessor group. The system furt
BEA Systems Inc.
Homere Jean R.
LandOfFree
System and method for control of access to resources does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System and method for control of access to resources, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System and method for control of access to resources will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3172047