Facilitating ownership of access control lists by users or groups

Patent metadata

Field	Value
Publication number	US-9697373-B2
Application number	US-98237604-A
Country	US
Kind code	B2
Filing date	Nov 5, 2004
Priority date	Nov 5, 2004
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

Embodiments of the present invention support a flexible access control design that includes flexible ownership and assignment of access control lists (ACLs). The ACLs can be assigned to one or more resources, or items, or types of resources or items. A creator or owner of an ACL can grant privileges to others such that they may modify or assign the ACL. Each ACL can have one or more owners, i.e., users that can exercise control over the ACL. Any owner of an ACL can designate certain privileges to other users. These other users may then use the ACL based on the privileges granted to them.

First claim

What is claimed is:

1. A computer-implemented method to facilitate applying existing access control lists (ACLs) to new resources while restricting ACL modification, the computer-implemented method comprising:
storing first and second resources by a content management system (CMS) having an associated graphical user interface and configured to enforce each access control list (ACL) type selected from a system ACL and a custom ACL, each ACL type identifiable via a respective flag;
responsive to a request received from a first user via the user interface, creating an ACL having a name and an associated set of privileges and designating the first user as an owner of the ACL, the set of privileges including at least two distinct privileges selected from a read privilege, a list privilege, an assignment privilege, a modification privilege, a delete privilege, and a grant privilege, wherein the ACL defines access rights applicable to at least two resource types selected from a document, an application, an image file, a text file, an audio file, and a video file;
upon receiving, from the owner of the ACL, a request to assign the ACL to the first resource, assigning the ACL to the first resource;
subsequent to the assigning of the ACL to the first resource, enforcing, by the CMS and based on the ACL, access rights for the first resource;
upon receiving, from the owner of the ACL, a request to grant a second user a specified privilege consisting of the assignment privilege for the ACL, granting the specified privilege to the second user;
subsequent to the granting of the specified privilege, and responsive to receiving, from the second user, a request to assign the ACL to the second resource, determining whether the second user has the assignment privilege for the ACL;
upon determining that the second user has the assignment privilege for the ACL, assigning the ACL to the second resource by the CMS when executed by one or more computer processors, and restricting the second user from modifying the ACL;
subsequent to the assigning of the ACL to the second resource, enforcing, by the CMS and based on the ACL, access rights for the first and second resources; and responsive to a search request specifying a search criterion selected from the ACL name, an ACL owner, and an ACL keyword, generating, by the CMS, a set of search results including at least one ACL matching the search criterion, wherein the set of search results is output via the user interface.

2. The computer-implemented method of claim 1 , wherein the set of privileges includes the read privilege, the list privilege, the assignment privilege, the modification privilege, the delete privilege, and the grant privilege.

3. The computer-implemented method of claim 1 , wherein creating the ACL includes automatically generating a unique name for the ACL, the unique name comprising the name, wherein the list privilege comprises a privilege to list available ACLs, wherein the grant privilege comprises a privilege to grant, to other users, privileges to the ACL, wherein the access rights defined by the ACL are defined for one or more users and pertain to each resource type selected from a document, an application, an image file, a text file, an audio file, and a video file, wherein the access rights defined by the ACL for the one or more users are separate from the set of privileges and include rights to view, print, modify, forward, and delete a given resource governed by the ACL,
wherein restricting the second user from modifying the ACL comprises:
permitting modification of the ACL by the second user only upon determining that the second user has the modification privilege for the ACL.

4. The computer-implemented method of claim 3 , wherein the computer-implemented method further comprises:
representing the granted privilege via a data structure containing a reference to the second user, a reference to the assignment privilege, and a reference to the ACL; and
storing third resources by the CMS, wherein the CMS comprises a plurality of components including:
a client component operable to provide the user interface for the CMS, the user interface accepting parameters for creating and modifying the ACL, respectively;
a resource manager component operable to store objects corresponding to resources in the CMS; and
a library server component.

5. The computer-implemented method of claim 4 , wherein the library server component is operable to:
(i) store, manage, and provide access control to resources stored by the CMS;
(ii) maintain data integrity between the plurality of components of the CMS; and
(iii) enforce access controls to protect the resources stored by the resource manager component, the access controls including the ACL;
wherein the library server component includes:
(i) an access control module implementing the access controls enforced by the library server;
(ii) an application program implementing functionality of the library server; and
(iii) a library server database serving as a catalog for resources stored by the resource manager component, wherein the library server database comprises a plurality of tables used in enforcing the access controls.

6. The computer-implemented method of claim 5 , wherein the plurality of tables includes:
(i) an ACL table specifying, for each resource of a plurality of resources restored in the CMS, security protections that apply to the respective resource; and
(ii) a user profile table specifying, for each user of a plurality of users supported by the CMS, privileges granted to respective user.

7. The computer-implemented method of claim 6 , wherein the ACL table includes an ACL identifier field, a resource identifier field, a user identifier field, and a privilege set field, wherein the user profile table includes a user identifier field and a privilege set field, wherein the library server component independently enforces each individual ACL type selected from system ACLs and custom ACLs, wherein the system ACLs are identified by virtue of a first flag set by the library server component, wherein the custom ACLs are identified by virtue of a second flag set by the library server component, different from the first flag.

8. The computer-implemented method of claim 7 , further comprising:
upon receiving, from the first user, a request to grant a first group of users the assignment privilege to the ACL, granting the first group of users the assignment privilege to the ACL, wherein the granted privilege to the first group of users is represented by a second data structure containing a reference to the first group of users, a reference to the assignment privilege, and a reference to the ACL.

9. The computer-implemented method of claim 8 , whereby the ACL is assigned to the second resource and restricting the second user from unauthorized modification of the ACL, wherein the assignment privilege is not granted to a third user, wherein the computer-implemented method further comprises:
restricting the third user from causing the ACL to be assigned to the third resource.

10. The computer-implemented method of claim 9 , further comprising:
upon receiving, in respective instances and from each user of the first group of users, a respective request to assign the ACL to a respective resource, assigning the ACL to the respective resource.

11. The computer-implemented method of claim 10 , wherein the application program restricts user privileges based on: (i) user roles; (ii) user domains; and (ii) contexts of requested user actions.

12. The computer-implemented method of claim 1 , further comprising automatically generating a unique name for the ACL, the unique name compris

Assignees

• Nelson Kenneth Carlin
• Noronha Marilene A
• IBM

Inventors

• Nelson Kenneth Carlin
• Noronha Marilene A

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title