Scoped access control metadata element

• US 20030074356A1
• Filed: 10/15/2002
• Published: 04/17/2003
• Est. Priority Date: 10/16/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kaler, Christopher G., Della-Libera, Giovanni M., Waingold, Elliot
• Granted Patent: US 8,015,204 B2
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 45/34 Source routing
• CPC Class Codes: H04L 45/566 Routing instructions carried by the data packet, e.g. active networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Methods, systems, and data structures for communicating object metadata are provided. A generic metadata container is presented that allows object metadata to be described in an extensible manner using protocol-neutral and platform-independent methodologies. A metadata scope refers to a dynamic universe of targets to which the included metadata statements correspond. Metadata properties provide a mechanism to describe the metadata itself, and metadata security can be used to ensure authentic metadata is sent and received. Mechanisms are also provided to allow refinement and replacement of metadata statements. The generic metadata container can be adapted to dynamically define access control rights to a range of objects by a range of users, including granted and denied access rights.

Claims

1. A data structure for describing access control metadata, stored on a computer readable medium, comprising:

a first data field containing at least one rule statement defining access rights; and

a second data field containing a metadata scope that defines a range of objects to which the at least one rule statement corresponds.

2. The data structure of claim 1, further comprising a third data field containing a statement scope defining a range of users subject to the access rights defined in the first data field.

3. The data structure of claim 1, further comprising a third data field containing at least one metadata property corresponding to the metadata structure.

4. The data structure of claim 1, further comprising a third data field containing security data corresponding to the metadata structure.

5. The data structure of claim 1, wherein the metadata scope encompasses a plurality of objects.

6. The data structure of claim 1, wherein the metadata scope encompasses a stored file.

7. The data structure of claim 1, wherein the metadata scope encompasses a web service.

8. The data structure of claim 1, wherein the metadata scope encompasses a network service.

9. The data structure of claim 2, wherein the statement scope encompasses a plurality of users.

10. The data structure of claim 2, wherein the statement scope encompasses a human user.

11. The data structure of claim 2, wherein the statement scope encompasses an automated user.

12. The data structure of claim 11, wherein the statement scope encompasses an application program.

13. The data structure of claim 10, wherein the statement scope comprises biometric information corresponding to the user.

14. The data structure of claim 2, wherein the statement scope encompasses messages having predetermined content.

15. The data structure of claim 1, wherein the metadata scope comprises a uniform resource identifier (URI).

16. The data structure of claim 1, further comprising a third data field functioning to indicate that the data structure relates to a separately communicated rule statement.

17. The data structure of claim 16, wherein the third data field indicates that access rights in the separately communicated rule statement should be used.

18. The data structure of claim 16, wherein the third data field indicates that, upon updating access rights in the separately communicated rule statement, the updated access rights in the separately communicated rule statement should be used.

19. The data structure of claim 1, wherein the rule statement comprises granted access rights.

20. The data structure of claim 1, wherein the rule statement comprises denied access rights.

21. The data structure of claim 1, wherein the statement scope encompasses a smart card.

22. A method for determining access rights to a range of objects by a range of users, comprising:

(a) receiving identifying information corresponding to a user attempting to access a resource;

(b) determining whether the resource is encompassed by a first range defined in an access control metadata element;

(c) based on the identifying information, determining whether the user is encompassed by a second range defined in the access control metadata element; and

(d) when steps (b) and (c) are answered in the affirmative, applying access rights defined in the access control metadata element.

23. The method of claim 22, wherein in step (d) the access rights comprise granted access rights.

24. The method of claim 22, wherein in step (d) the access rights comprise denied access rights.

25. The method of claim 22, wherein in step (a) the resource comprises a file stored on a storage device.

26. The method of claim 22, wherein in step (a) the resource comprises a web service.

27. The method of claim 22, wherein in step (a) the identifying information corresponds to a human user.

28. The method of claim 22, wherein in step (a) the identifying information corresponds to an application program.

29. The method of claim 22, wherein in step (a) the identifying information comprises an authentication token.

30. The method of claim 27, wherein in step (a) the identifying information comprises biometric information corresponding to the user.

31. A computer comprising a processor controlling operation of the computer according to computer readable instructions stored in a memory, wherein, upon execution of the computer readable instructions by the processor, the computer performs a method comprising:

(a) receiving identifying information corresponding to a user attempting to access the resource;

(b) determining whether the resource is encompassed by a first range defined in an access control metadata element;

(c) based on the identifying information, determining whether the user is encompassed by a second range defined in the access control metadata element; and

(d) when steps (b) and (c) are answered in the affirmative, applying access rights defined in the access control metadata element.