System and method for managing application specific privileges in a content management system

• US 20050262551A1
• Filed: 07/15/2005
• Published: 11/24/2005
• Est. Priority Date: 04/23/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Yang, Alan Tsu-I, Wang, Yuping, Nelson, Kenneth Carlin, Hu, Tawei, Choy, David Mun-Hien, Chen, An Feng-I, Lin, Jy-Jine James
• Granted Patent: US 7,761,404 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

Access to system and user defined entities (objects, data items, or the like) is managed by a content manager. A privilege grants a user an ability to access system such controlled entities. An item is an atomic user data entity stored in the CM library server. A privileges table is used to store system and user defined privileges. A privilege is represented by a row in the table. Each privilege has a unique privilege code, with codes 0 to 999 reserved to store system-defined privileges and codes beyond 999 open for user-defined privileges thus allowing application specific privileges to be added without limit.

Claims

1. Method for managing privileges, comprising:

storing system defined and user defined privilege definition codes in a database table, with a plurality of said codes reserved to said system defined privilege definition codes, and codes beyond said plurality reserved to said user defined privilege definition codes; and

executing a database stored procedure for modifying a user defined privilege.

2. The method of claim 1, further comprising:

responsive to a user request to add a new user defined privilege, determining a new definition code and inserting said new definition code into said database table.

3. The method of claim 1, further comprising:

responsive to a user request to delete an existing privilege, deleting from said database table a row containing said user defined privilege code.

4. The method of claim 1, further comprising:

responsive to a user request to update an existing user defined privilege, updating a privilege definition name and privilege definition description.

5. The method of claim 1, further comprising:

establishing for said user a user privilege code;

collecting into a privilege set at least one said privilege definition code;

coupling an access control list to a controlled entity, said access control list including for a user authorized to access said controlled entity a reference to said privilege set;

responsive to a request from said user to access said controlled entity for a specific function, allowing said user to access said controlled entity provided that said user privilege code and said privilege set for said user both authorize said specific function.

6. System for managing privileges, comprising:

a data base table for storing system defined and user defined privilege definition codes, with a plurality of said codes reserved to said system defined privilege definition codes, and codes beyond said plurality reserved to said user defined privilege definition codes; and

a database stored procedure for modifying a user defined privilege.

7. The system of claim 6, further comprising:

a content manager responsive to a user request to add a new user defined privilege for determining a new definition code and inserting said new definition code into said database table.

8. The system of claim 6, further comprising:

a content manager further responsive to a user request to update an existing user defined privilege for selectively updating a privilege definition name and privilege definition description.

9. The system of claim 6, comprising

a content manager further responsive to a user request to delete an existing privilege for verifying that said existing privilege is a user defined privilege code and deleting from said database table a row containing said user defined privilege code.

10. The system of claim 6, further comprising:

a user table for storing for said user a user privilege code;

a privilege set table for collecting into a privilege set at least one said privilege definition code;

an access control list coupled to a controlled entity, said access control list including for a user authorized to access said controlled entity a reference to said privilege set;

said content manager further responsive to a request from said user to access said controlled entity for a specific function for allowing said user to access said controlled entity provided that said user privilege code and said privilege set for said user both authorize said specific function.

11. A program storage device readable by a machine, tangibly embodying a program of instructions executable by a machine to perform a method for managing privileges, said method comprising:

storing system defined and user defined privilege definition codes in a database table, with a first plurality of said codes reserved to said system defined privilege definition codes, and codes beyond said first plurality reserved to said user defined privilege definition codes; and

executing a database stored procedure for modifying a user defined privilege.

12. The program storage device of claim 11, said method further comprising:

responsive to a user request to add a new user defined privilege, determining a new definition code and inserting said new definition code into said database table.

13. The program storage device of claim 11, said method further comprising:

responsive to a user request to update an existing user defined privilege, selectively updating a privilege definition name and privilege definition description.

14. The program storage device of claim 11, said method further comprising:

responsive to a user request to delete an existing privilege, verifying that said existing privilege is a user defined privilege code and deleting from said database table a row containing said user defined privilege code.

15. The program storage device of claim 11, said method further comprising:

establishing for said user a user privilege code;

collecting into a privilege set at least one said privilege definition code;

coupling an access control list to a controlled entity, said access control list including for a user authorized to access said controlled entity a reference to said privilege set;

responsive to a request from said user to access said controlled entity for a specific function, allowing said user to access said controlled entity provided that said user privilege code and said privilege set for said user both authorize said specific function.