Digital management system and method for managing access rights in such a management system

• US 20060168216A1
• Filed: 12/09/2004
• Published: 07/27/2006
• Est. Priority Date: 12/09/2004
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wolf-Reber, Alexander
• Application Number:
  US11/008,385
• Publication Number:
  US 20060168216A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

An apparatus, system, and method are disclosed for managing access rights in a digital management system. The apparatus includes a device manager module configured to communicate with a client module, and an authorization layer configured to manage client module requests and accounts. The system includes a network, a plurality of client modules, and the apparatus. The method includes communicating with a client module, maintaining a user account data structure and authenticating client modules, managing client module requests and accounts, and maintaining authorization levels for specified devices.

Claims

1. An apparatus for managing access rights in a network environment, the apparatus comprising:

a device manager module configured to communicate with a client module;

wherein the device manager module is configured to maintain a user account data structure and authenticate client modules;

an authorization layer configured to manage client module requests and accounts; and

wherein the user account data structure is configured to maintain authorization levels for specified devices.

2. The apparatus of claim 1, further comprising a plurality of devices, each device configured to manage objects and retrieve a scoping system identifier of the objects.

3. The apparatus of claim 1, further comprising an account provider coupled to the device manager module and configured to provide information about access rights and authorization levels of client modules to the device manager module.

4. The apparatus of claim 1, wherein each device is further configured to generate a system scope string for each controlled object and communicate the system scope string with the account provider.

5. The apparatus of claim 1, wherein the authorization layer is further configured to retrieve the system scope string from the account provider in order to grant or deny an object request.

6. The apparatus of claim 1, wherein the system scope string uniquely identifies the plurality of objects.

7. The apparatus of claim 1, wherein the system scope string uniquely identifies individual objects.

8. The apparatus of claim 1, wherein the device manager module is further configured to check authorization levels in response to a client module request.

9. A system to manage access rights in a network environment, the system comprising:

a network;

a plurality of client modules coupled to the network;

a device manager module configured to communicate with the client modules;

wherein the device manager module is configured to maintain a user account data structure and authenticate client modules;

an authorization layer configured to manage client module requests and accounts; and

wherein the user account data structure is configured to maintain authorization levels for specified devices.

10. The system of claim 9, further comprising a plurality of devices, each device configured to manage objects and retrieve a scoping system identifier of the objects.

11. The system of claim 9, further comprising an account provider coupled to the device manager module and configured to provide information about access rights and authorization levels of client modules to the device manager module.

12. The system of claim 9, wherein each device is further configured to generate a system scope string for each controlled object and communicate the system scope string with the account provider.

13. The system of claim 9, wherein the authorization layer is further configured to retrieve the system scope string from the account provider in order to grant or deny an object request.

14. The system of claim 9, wherein the system scope string uniquely identifies the plurality of objects.

15. The system of claim 9, wherein the system scope string uniquely identifies individual objects.

16. The system of claim 9, wherein the device manager module is further configured to check authorization levels in response to a client module request.

17. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform an operation to manage access rights in a network environment, the operation comprising:

communicating with a client module;

maintaining a user account data structure and authenticating client modules;

managing client module requests and accounts; and

maintaining authorization levels for specified devices.

18. The signal bearing medium of claim 17, wherein the instructions further comprise an operation to manage objects and retrieve a scoping system identifier of the objects.

19. The signal bearing medium of claim 17, wherein the instructions further comprise an operation to provide information about access rights and authorization levels of client modules to a device manager module.

20. The signal bearing medium of claim 17, wherein the instructions further comprise an operation to generate a system scope string for each controlled object and communicate the system scope string with an account provider.

21. A method for managing access rights in a network environment, the method comprising:

communicating with a client module;

maintaining a user account data structure and authenticating client modules;

managing client module requests and accounts; and

maintaining authorization levels for specified devices.

22. The method of claim 21, further comprising managing objects and retrieving a scoping system identifier of the objects.

23. The method of claim 21, further comprising providing information about access rights and authorization levels of client modules to a device manager module.

24. The method of claim 21, further comprising generating a system scope string for each controlled object and communicate the system scope string with an account provider.

25. A method for deploying a computing infrastructure, comprising integrating computer-readable code into a computing system, wherein the code in combination with the computing system is capable managing access rights in a network environment, the method comprising:

communicating with a client module;

maintaining a user account data structure and authenticating client modules;

managing client module requests and accounts; and

maintaining authorization levels for specified devices.

26. The method of claim 25, further comprising managing objects and retrieving a scoping system identifier of the objects.

27. The method of claim 25, further comprising providing information about access rights and authorization levels of client modules to a device manager module.

28. The method of claim 25, further comprising generating a system scope string for each controlled object and communicate the system scope string with an account provider.

29. The method of claim 25, further comprising checking authorization levels in response to a client module request

30. An apparatus to manage access rights in a network environment, the apparatus comprising:

means for communicating with a client module;

means for maintaining a user account data structure and authenticating client modules;

means for managing client module requests and accounts; and

means for maintaining authorization levels for specified devices.