Method, system, and program product for managing access to data items in a database

• US 20040122792A1
• Filed: 12/20/2002
• Published: 06/24/2004
• Est. Priority Date: 12/20/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Salazar, Fernando J.
• Granted Patent: US 8,635,221 B2
• Time in Patent Office: Days
• US Class Current: 707/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy

Abstract

The invention manages access to data items in a database that are arranged into a hierarchy of nodes. One or more access entries are associated with the hierarchy of nodes to associate a user property with an access level. Access to the data items is managed by matching one or more particular user properties associated with a user requesting the access to a user property in an access entry.

Claims

1. A method for managing access to data items, comprising:

providing a relational database having data items arranged into a hierarchy of nodes;

associating at least one access entry with the hierarchy of nodes, wherein each of the at least one access entry associates a user property with an access level; and

managing access to the data items based on the at least one access entry and a user property associated with a user requesting the access.

2. The method of claim 1, further comprising caching the access entries for subsequent access management.

3. The method of claim 1, further comprising receiving a request to access at least one of the data items.

4. The method of claim 3, wherein the managing step comprises:

obtaining a set of the data items based on the request; and

processing the obtained data items based on the access entries.

5. The method of claim 3, further comprising:

identifying a user making the request; and

associating the user with a particular user property, wherein managing access to the data items is further based on matching the particular user property with a user property in one of the at least one access entry.

6. The method of claim 5, wherein the particular user property is based on at least one of:

a directory expression, a group designation, and a user attribute.

7. The method of claim 5, wherein the particular user property is provided from at least one of:

a system directory and a user registry.

8. The method of claim 1, wherein the user property for the at least one access entry is based on least one of:

a directory expression, a group designation, and a user attribute.

9. The method of claim 1, further comprising authenticating the user when access to the data items is first requested.

10. The method of claim 1, further comprising:

defining a property string for an access entry, wherein the property string is based on a user property;

defining an access level for the access entry; and

storing the access entry in the relational database.

11. A method for managing access to data items, comprising:

providing a relational database having data items arranged into a hierarchy of nodes;

associating access entries with the hierarchy of nodes, wherein each of the access entries is based on a user property and an access level;

receiving a request to access at least one of the data items from a requesting user;

generating a query to return only data items that the requesting user has been granted access; and

processing the query using the access entries and a user property associated with the requesting user.

12. The method of claim 11, further comprising caching the access entries for subsequent processing.

13. The method of claim 11, wherein the processing step comprises:

obtaining a set of the data items based on the request; and

processing the obtained data items based on the access entries and the user property associated with the user.

14. The method of claim 11, further comprising:

identifying a user; and

associating the user with a particular user property, wherein processing the request is further based on matching the particular user property with a user property in one of the access entries.

15. The method of claim 14, wherein the particular user property is based on at least one of:

a directory expression, a group designation, and a user attribute.

16. The method of claim 14, wherein the particular user property is provided from at least one of:

a system directory and a user registry.

17. The method of claim 11, wherein the user property for each of the access entries is based on least one of:

a directory expression, a group designation, and a user attribute.

18. The method of claim 11, further comprising authenticating the requesting user when access to the data items is first requested.

19. The method of claim 11, further comprising:

defining a property string for an access entry, wherein the property string is based on a user property;

defining an access level for the access entry; and

storing the access entry in the relational database.

20. A system for managing access to data items, comprising an access system for processing a request to access the data items, wherein the data items are arranged into a hierarchy of nodes within a relational database, wherein access entries are associated with the hierarchy of nodes, wherein each of the access entries associates a user property with an access level, and wherein the request is filtered by matching a user property associated with a user making the request with a user property in one of the access entries.

21. The system of claim 20, further comprising a definition system for defining the access entries and associating the access entries with the hierarchy of nodes.

22. The system of claim 20, further comprising an authentication system for authenticating a user when the user requests access to the data items.

23. The system of claim 20, further comprising an evaluation system for matching at least one of the access entries with the user based on a particular user property of the user.

24. The system of claim 23, wherein the particular user property is based on at least one of:

a directory expression, a group designation, and a user attribute.

25. The system of claim 20, wherein the user property of each of the access entries is based on at least one of:

a path, a group designation, and a user attribute.

26. The system of claim 20, wherein the access system further receives a request to access at least one of the data items, obtains a set of the data items based on the request, and filters access to the obtained data items based on the access entries and the user property associated with the user.

27. A program product stored on a recordable medium for managing access to data items, which when executed, comprises program code for processing a request to access the data items, wherein the data items are arranged into a hierarchy of nodes within a relational database, wherein access entries are associated with the hierarchy of nodes, wherein each of the access entries associates a user property with an access level, and wherein the request is filtered by matching a user property associated with a user making the request with a user property in one of the access entries.

28. The program product of claim 27, further comprising program code for defining the access entries and associating the access entries with the hierarchy of nodes.

29. The program product of claim 27, further comprising program code for authenticating the user when the user requests access to the data items.

30. The program product of claim 27, further comprising program code for matching at least one of the access entries with the user based on a particular user property of the user.

31. The program product of claim 30, wherein the particular user property is based on at least one of:

a directory expression, a group designation, and a user attribute.

32. The program product of claim 27, wherein the user property of each of the access entries is based on at least one of:

a path, a group designation, and a user attribute.

33. The program product of claim 27, wherein the program code for processing further receives a request to access at least one of the data items, obtains a set of the data items based on the request, and filters access to the obtained data items based on the access entries and the user property associated with the user.