Method for delegated adminstration

• US 20050229236A1
• Filed: 04/06/2004
• Published: 10/13/2005
• Est. Priority Date: 04/06/2004
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Devgan, Manish, McCauley, Rodney
• Granted Patent: US 7,774,601 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A system and method for providing a containment model of role capabilities wherein a parent role can obtain the capabilities of its child role(s).

Claims

1. A method for determining at least one capability of a principal in a role with respect to a resource, said method comprising:

determining a set of capabilities for at least one child role for the resource;

associating the set of capabilities with the role;

wherein the set of capabilities was delegated to the at least one child role by a parent role;

wherein the at least one child role is hierarchically inferior to the role; and

wherein the parent role is hierarchically superior to the role.

2. The method of claim 1 wherein:

the principal can remove one or more members from the set of capabilities.

3. The method of claim 1 wherein:

a principal in the role can delegate a first capability in the set of capabilities; and

a principal in the at least one child role cannot delegate the first capability.

4. The method of claim 1 wherein:

the principal is an authenticated user, group or process.

5. The method of claim 1, further comprising:

evaluating the role to true or false for the principal in a context.

6. The method of claim 1 wherein:

a role is a Boolean expression that can include at least one of;

     1) another Boolean expression; and

     2) a predicate.

7. The method of claim 6 wherein:

the predicate is one of;

     1) user;

     2) group;

     3) time; and

     4) segment.

8. The method of claim 1 wherein:

the capability can be a resource.

9. The method of claim 1, further comprising:

granting access to the set of capabilities for the principal.

10. A method for determining at least one capability of a principal in a role with respect to a resource, said method comprising:

determining a set of capabilities for at least one child role for the resource;

associating the set of capabilities with the role;

wherein the set of capabilities was delegated to the at least one child role by a parent role;

wherein the at least one child role is hierarchically inferior to the role;

wherein the parent role is hierarchically superior to the role; and

wherein the role is a Boolean expression.

11. The method of claim 10 wherein:

the principal can remove one or more members from the set of capabilities.

12. The method of claim 10 wherein:

a principal in the role can delegate a first capability in the set of capabilities; and

a principal in the at least one child role cannot delegate the first capability.

13. The method of claim 10 wherein:

the principal is an authenticated user, group or process.

14. The method of claim 10, further comprising:

evaluating the role to true or false for the principal in a context.

15. The method of claim 10 wherein:

the can include at least one of;

     1) another Boolean expression; and

     2) a predicate.

16. The method of claim 15 wherein:

the predicate is one of;

     1) user;

     2) group;

     3) time; and

     4) segment.

17. The method of claim 10 wherein:

the capability can be a resource.

18. The method of claim 10, further comprising:

granting access to the set of capabilities for the principal.

19. A machine readable medium having instructions stored thereon that when executed by a processor cause a system to:

determine a set of capabilities for at least one child role for a resource;

associate the set of capabilities with a role;

wherein the set of capabilities was delegated to the at least one child role by a parent role;

wherein the at least one child role is hierarchically inferior to the role; and

wherein the parent role is hierarchically superior to the role.

20. The machine readable medium of claim 19 wherein:

the principal can remove one or more members from the set of capabilities.

21. The machine readable medium of claim 19 wherein:

a principal in the role can delegate a first capability in the set of capabilities; and

a principal in the at least one child role cannot delegate the first capability.

22. The machine readable medium of claim 19 wherein:

the principal is an authenticated user, group or process.

23. The machine readable medium of claim 19, further comprising instructions that when executed cause the system to:

evaluate the role to true or false for the principal in a context.

24. The machine readable medium of claim 19 wherein:

a role is a Boolean expression that can include at least one of;

     1) another Boolean expression; and

     2) a predicate.

25. The method of claim 24 wherein:

the predicate is one of;

     1) user;

     2) group;

     3) time; and

     4) segment.

26. The machine readable medium of claim 19 wherein:

the capability can be a resource.

27. The machine readable medium of claim 19, further comprising instructions that when executed cause the system to:

grant access to the set of capabilities for the principal.

28. A computer data signal embodied in a transmission medium, comprising:

a code segment including instructions to determine a set of capabilities for at least one child role for a resource;

a code segment including instructions to associate the set of capabilities with a role;

wherein the set of capabilities was delegated to the at least one child role by a parent role;

wherein the at least one child role is hierarchically inferior to the role; and

wherein the parent role is hierarchically superior to the role.