Delegated administration of information in a database directory

• US 20020095414A1
• Filed: 01/16/2001
• Published: 07/18/2002
• Est. Priority Date: 10/19/2000
• Status: Active Grant

• Current Assignee: General Electric Company
• Original Assignee: General Electric Company
• Inventors: Aggour, Kareem Sherif, Kornfein, Mark Mitchell, Barnett, Janet Arlie, Vivier, Barbara Jean
• Granted Patent: US 6,772,157 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16H 40/20 for the management or administration of healthcare resources or facilities, e.g. managing hospital staff or surgery rooms
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A delegated administration tool for administrating information in a database directory. The delegated administration tool enables an administrator to delegate administration and various types of administrative authority to other users within a community of users. In particular, an administrator with proper authority may create new administrative domains and assign authority referred to as delegation authority and edit authority to other users. The creation of additional administrative domains and the assignment of the delegation authority and edit authority can continue to an arbitrary level within the community.

Claims

1. A method for managing information associated with a user community, comprising:

specifying the user community into at least one administrative domain; and

granting administrative privileges for managing the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority.

2. The method according to claim 1, further comprising specifying the at least one administrative domain into an administrative sub-domain.

3. The method according to claim 2, further comprising granting administrative privileges for managing the administrative sub-domain, wherein the administrative privileges include at least one of delegation authority and edit authority.

4. The method according to claim 3, further comprising specifying the administrative sub-domain into more administrative sub-domains and granting administrative privileges for managing each sub-domain, wherein the administrative privileges include at least one of delegation authority and edit authority.

5. The method according to claim 1, further comprising delegating the granted administrative privileges for the at least one administrative domain.

6. The method according to claim 1, further comprising specifying the at least one administrative domain into administrative sub-domains and granting administrative privileges for each sub-domain, wherein the specifying and granting continue to an arbitrary level with respect to the at least one administrative domain.

7. A method for providing delegated administration of a user community, comprising:

dividing the user community into at least one administrative domain;

granting administrative privileges to an administrator for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

delegating the granted administrative privileges from the administrator to another administrator for the at least one administrative domain.

8. The method according to claim 7, further comprising dividing the at least one administrative domain into administrative sub-domains.

9. The method according to claim 8, further comprising delegating the granted administrative privileges to other administrators for the administrative sub-domains.

10. The method according to claim 7, further comprising delegating the granted administrative privileges to additional administrators for the at least one administrative domain.

11. The method according to claim 7, further comprising dividing the at least one administrative domain into administrative sub-domains and delegating administrative privileges for each domain, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

12. The method according to claim 7, further comprising managing information associated with the at least one administrative domain according to the delegated administrative privileges.

14. The method according to claim 13, further comprising dividing the administrative sub-domains into more domains and delegating administrative privileges for each of these domains, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

15. The method according to claim 13, wherein the delegating of granted administrative privileges comprises having an administrator with delegation authority delegating at least one of delegation authority and edit authority and an administrator with edit authority delegating edit authority.

17. The method according to claim 16, further comprising prompting the administrator to divide the at least one administrative domain into administrative sub-domains.

18. The method according to claim 17, further comprising prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for the administrative sub-domains.

19. The method according to claim 18, further comprising prompting the administrator to divide the administrative sub-domains into more domains and delegate administrative privileges for each of these domains, wherein the prompting to divide and delegate continues to an arbitrary level with respect to the at least one administrative domain.

13. A method for providing delegated administration of a user community with a client system, comprising:

dividing the user community into at least one administrative domain;

granting administrative privileges to an administrator for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

dividing the at least one administrative domain into administrative sub-domains; and

delegating the granted administrative privileges from the administrator to other administrators for the administrative sub-domains.

16. A method for enabling an administrator to control administration of a user community, comprising:

providing information associated with the user community to the administrator;

prompting the administrator to define at least one administrative domain for the user community;

prompting the administrator to define administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

using the at least one administrative domain and administrative privileges defined by the administrator to control administration of the user community.

20. A method for enabling an administrator to delegate administrative control of a user community, comprising:

providing information associated with the user community;

prompting the administrator to define at least one administrative domain for the user community;

prompting the administrator to define administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

prompting the administrator to divide the at least one administrative domain into administrative sub-domains;

prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for the administrative sub-domains; and

using the administrative domains and administrative privileges to control administration of the user community.

21. A user community administration tool for managing information associated with a user community, comprising:

a domain definition component that defines the user community into at least one administrative domain;

an administrative privileges component that grants administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component that manages information associated with the at least one administrative domain in accordance with the granted administrative privileges.

22. The tool according to claim 21, wherein the domain definition component defines attributes for users in the at least one administrative domain and acceptable values for the attributes.

23. The tool according to claim 21, wherein the domain definition component specifies the at least one administrative domain into administrative sub-domains.

24. The tool according to claim 23, wherein the administrative privileges component delegates the administrative privileges for the administrative sub-domains.

25. The tool according to claim 21, wherein the administrative privileges component delegates the granted administrative privileges for the at least one administrative domain.

26. The tool according to claim 21, wherein the domain definition component specifies administrative sub-domains and the administrative privileges component delegates the administrative privileges for the domains to an arbitrary level with respect to the at least one administrative domain.

28. The system according to claim 27, wherein the domain definition component defines attributes for users in the at least one administrative domain and acceptable values for the attributes.

29. The system according to claim 27, wherein the domain definition component specifies the at least one administrative domain into administrative sub-domains.

30. The system according to claim 29, wherein the administrative privileges component delegates the administrative privileges for the administrative sub-domains.

31. The system according to claim 27, wherein the administrative privileges component delegates the granted administrative privileges for the at least one administrative domain.

32. The system according to claim 27, further comprising a second computing unit configured to execute the user community administration tool served from the first computing unit over a network.

27. A system for managing information associated with a user community, comprising:

a database directory containing a plurality of user information;

a user community administration tool to manage the plurality of user information in the database directory;

the user community administration tool comprising a domain definition component to define the user community into at least one administrative domain;

an administrative privileges component to grant administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component to manage user information associated with the at least one administrative domain in accordance with the granted administrative privileges; and

a first computing unit configured to serve the user community administration tool and the database directory.

33. A system for managing information associated with a user community, comprising:

a database directory containing a plurality of user information;

a user community administration tool to manage the plurality of user information in the database directory;

the user community administration tool comprising a domain definition component to define the user community into at least one administrative domain;

an administrative privileges component to grant administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component to manage user information associated with the at least one administrative domain in accordance with the granted administrative privileges;

a first computing unit configured to execute the user community administration tool;

a network; and

a second computing unit configured to serve the database directory and the user community administration tool to the first computing unit over the network.

35. The tool according to claim 34, further comprising means for dividing the at least one administrative domain into administrative sub-domains.

36. The tool according to claim 35, further comprising means for delegating the granted administrative privileges to other administrators for the administrative sub-domains, wherein an administrator with delegation authority delegates at least one of delegation authority and edit authority, while an administrator with edit authority delegates edit authority.

37. The tool according to claim 34, further comprising means for delegating the granted administrative privileges to additional administrators for the at least one administrative domain.

39. The system according to claim 38, wherein the domain definition component defines attributes for users in the at least one administrative domain and acceptable values for the attributes.

40. The system according to claim 38, wherein the domain definition component divides the at least one administrative domain into administrative sub-domains.

41. The system according to claim 40, wherein the administrative privileges component delegates the administrative privileges to an arbitrary level of administrators for the administrative sub-domains.

42. The system according to claim 38, wherein the administrative privileges component delegates the granted administrative privileges from the administrator to other administrators for the at least one administrative domain.

34. A user community administration tool for providing delegated administration of a user community, comprising:

means for dividing the user community into at least one administrative domain;

means for granting administrative privileges to an administrator for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

means for delegating the granted administrative privileges to another administrator for the at least one administrative domain.

38. A system for providing delegated administrative control of a user community, comprising:

a database directory containing a plurality of user information associated with the user community; and

a user community administration tool to facilitate administrative control of the user information in the database directory;

the user community administration tool comprising a domain definition component to define the user community into at least one administrative domain;

an administrative privileges component to grant administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component to manage user information associated with the at least one administrative domain in accordance with the granted administrative privileges.

43. A computer-readable medium storing computer instructions for instructing a computer system to provide delegated administration of a user community, the computer instructions comprising:

dividing the user community into at least one administrative domain;

granting administrative privileges to an administrator for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

delegating the granted administrative privileges to another administrator for the at least one administrative domain.

44. The computer-readable medium according to claim 43, further comprising instructions for dividing the at least one administrative domain into administrative sub-domains.

45. The computer-readable medium according to claim 44, further comprising instructions for delegating the granted administrative privileges to other administrators for the administrative sub-domains.

46. The computer-readable medium according to claim 43, further comprising instructions for delegating the granted administrative privileges to additional administrators for the at least one administrative domain.

47. The computer-readable medium according to claim 43, further comprising instructions for dividing the at least one administrative domain into administrative sub-domains and delegating administrative privileges for each domain, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

48. The computer-readable medium according to claim 43, further comprising instructions for managing information associated with the at least one administrative domain according to the delegated administrative privileges.

50. The computer-readable medium according to claim 49, further comprising instructions for dividing the administrative sub-domains into more domains and delegating administrative privileges for each of these domains, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

49. A computer-readable medium storing computer instructions for instructing a computer system to provide delegated administration of a user community, the computer instructions comprising:

dividing the user community into at least one administrative domain;

granting administrative privileges to an administrator for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

dividing the at least one administrative domain into administrative sub-domains; and

delegating the granted administrative privileges from the administrator to other administrators for the administrative sub-domains.

51. A computer-readable medium storing computer instructions for instructing a computer system to enable an administrator to control administration of a user community, the computer instructions comprising:

providing information associated with the user community to the administrator;

prompting the administrator to define at least one administrative domain for the user community;

prompting the administrator to define administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

using the at least one administrative domain and administrative privileges defined by the administrator to control administration of the user community.

52. The computer-readable medium according to claim 51, further comprising instructions for prompting the administrator to divide the at least one administrative domain into administrative sub-domains.

53. The computer-readable medium according to claim 52, further comprising instructions for prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for the administrative sub-domains.

54. The computer-readable medium according to claim 53, further comprising instructions for prompting the administrator to divide the administrative sub-domains into more domains and delegate administrative privileges for each of these domains, wherein the prompting to divide and delegate continues to an arbitrary level with respect to the at least one administrative domain.

55. A computer-readable medium containing computer instructions for instructing a computer system to enable an administrator to delegate administration control of a user community, the computer instructions comprising:

providing information associated with the user community;

prompting the administrator to define at least one administrative domain for the user community;

prompting the administrator to define administrative privileges for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

prompting the administrator to divide the at least one administrative domain into administrative sub-domains;

prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for the administrative sub-domains; and

using the at least one administrative domain and administrative sub-domains and administrative privileges and delegated privileges defined by the administrator to control administration of the user community.