Method and apparatus for providing controlled access to software objects and associated documents

• US 20040049294A1
• Filed: 09/10/2003
• Published: 03/11/2004
• Est. Priority Date: 09/23/1999
• Status: Active Grant

• Current Assignee: Agile Software Corporation (Oracle Corporation)
• Original Assignee: Agile Software Corporation (Oracle Corporation)
• Inventors: Sadhurredly, Rao, Lin, Raymond, Keene, Catherine M.
• Granted Patent: US 7,401,082 B2
• Time in Patent Office: Days
• US Class Current: 700/5
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control

Abstract

A method and device such as a database for storing and providing controlled access to objects and associated documents by multiple users according to predetermined privileges set by the owner, or host, of the stored information. Individual users, or guests, can be given access to the objects, its attributes and associated documents as determined by the host of the information. The host of the information can set up access privileges based on any type of relationship. This is particularly useful in complex business relationships between a host and a plurality of users, both of which may be sensitive about their trade secrets and other confidential information.

Claims

1. A system for providing controlled access to an object and other associated information a file by a plurality of users comprising:

a database for storing an object and associated information, the object comprising distinguishable groups of data, each group of data having associated access criteria for access to the groups of data;

a central processing unit (CPU) for controlling the access to the database;

a memory for storing software code for controlling the operation of the CPU; and

access application code stored in the memory and executable by the CPU, the application code being responsive to the access criteria associated with the groups of data contained within an object and to predetermined privileges for allowing controlled access to individual groups of data contained within the object by an individual user according to the user'"'"'s privileges.

2. A system according to claim 1, wherein access includes the ability of a user to read the contents of the requested object.

3. A system according to claim 2, wherein access includes the ability to modify the contents of the requested object.

4. A system according to claim 3, wherein the ability to modify includes the ability to delete information contained in the requested object.

5. A system according to claim 3, wherein the ability to modify includes the ability to add data to the requested object.

6. A system according to claim 1 wherein the access is determined by a business relationship to produce products and defined by the host according to the need of information in the product chain.

7. A method of controlling access to objects stored in electronic form, comprising:

storing an object, the object comprising distinguishable groups of data, each group of data having associated access criteria for access to the groups of data;

controlling the access to the database using a central processing unit (CPU) according to access criteria;

storing software code for controlling the operation of the CPU in memory; and

allowing controlled access to individual groups of data contained within the object by an individual user according to the user'"'"'s privileges in response to the access criteria associated with the groups of data contained within an object and to predetermined privileges.

8. A method according to claim 7 further comprising:

receiving an object request by a requester;

verifying the requestor'"'"'s user privilege access criteria; and

transmitting information according to the requestor'"'"'s user privilege access criteria.

9. A method according to claim 7, wherein establishing an object includes loading information into the object into separate groups having separate access privilege criteria.

10. A method according to claim 7, wherein establishing privilege access criteria includes identifying the separate groups of information to which the user may access.

11. A method according to claim 7, wherein verifying the requestor'"'"'s user privilege access criteria includes extracting the requestor'"'"'s user identification from the object request, verifying the requestor'"'"'s user identification and identifying the groups of data to which the requestor has access.

12. A method according to claim 7, wherein transmitting a redacted object includes sending an electronic object to the requester that contains the groups of information to which the requestor has access to and that excludes groups of information to which the requestor does not have access.

13. A computer program product for use with a computer system, a central processing unit and means coupled to the central processing unit for storing a database to automatically manage objects for viewing and marking an object having varying formats without the use of any originating application of a file to view the object, comprising:

computer readable code means for establishing an object in a storage location;

computer readable code means for identifying a user to have access to the object;

computer readable code means for establishing privilege access criteria that define the scope of access of the object for the user;

computer readable code means for receiving an object request by a requester;

computer readable code means for verifying the requestor'"'"'s user privilege access criteria; and

computer readable code means for transmitting a redacted document according to the requestor'"'"'s user privilege access criteria.

14. A computer program device, comprising:

a computer program storage device readable by a digital processing apparatus;

a program stored on the program storage device and including instructions executable by the digital processing apparatus for controlling the apparatus to perform a method of managing documents for viewing and marking an object having varying formats without the use of any originating application of a file to view the object stored in the file, comprising;

establishing an object in a storage location;

identifying a user to have access to the object;

establishing privilege access criteria that define the scope of access of the object for the user;

receiving a object request by a requestor;

verifying the requestor'"'"'s user privilege access criteria; and

transmitting a redacted object according to the requestor'"'"'s user privilege access criteria.

15. In a computer server having a data base for storing data pertaining to product information, a method of securely transferring data between a source and an access destination comprising:

establishing an object in a storage location;

identifying a user to have access to the object;

establishing privilege access criteria that define the scope of access of the object for the user;

receiving a object request by a requestor;

verifying the requestor'"'"'s user privilege access criteria; and

transmitting a redacted object according to the requestor'"'"'s user privilege access criteria.