Access control list inheritance thru object(s)

• US 20070136578A1
• Filed: 12/13/2005
• Published: 06/14/2007
• Est. Priority Date: 12/13/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Krishnan, Prasanna, Dubhashi, Kedarnath, Raman, Balan, Leach, Paul
• Granted Patent: US 7,779,265 B2
• Time in Patent Office: Days
• US Class Current: 713/167
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

An item inheritance system and method are provided. The item inheritance system can be employed to propagate access control information (e.g., an access control list) to one or more item(s), thus facilitating security of item(s). At least one of the item(s) is a compound item. The item inheritance system includes an input component that receives information associated with one or more items. The items can include container(s), object(s) and/or compound item(s). The system can be triggered by a change in security policy to the item(s), for example, adding and/or deleting a user'"'"'s access to the item(s). Additionally, moving and/or copying a collection of items can further trigger the system. The system further includes a propagation component that propagates access control information to the item(s). For example, the propagation component can enforce the ACL propagation policies when a change to the security descriptor takes place at the root of a hierarchy.

Claims

1. An item inheritance system comprising:

an input component that receives information associated with one or more items, at least one of the items comprising a compound item; and

,

a propagation component that propagates access control information to the items.

2. The system of claim 1, the access control information comprising at least one access control list comprising at least one access control entry.

3. The system of claim 2, when an item inherits an access control entry from more than one ancestor, the order of precedence is that access control entries from the immediate parent precede the ones from a distant ancestor.

4. The system of claim 2, the access control entry comprising a principal, an access right and at least one inheritance flag.

5. The system of claim 4, the inheritance flag comprising at least one of container inherit, object inherit, do not propagate, inherit only and inherited.

6. The system of claim 5, the propagation component propagates an object inherit access control entry for the compound item and allows propagation of the object inherit access control entry through the compound item as object inherit.

7. The system of claim 6, for the compound item, the propagation component propagates a container inherit access control entry as container inherit, inherit only.

8. The system of claim 1, propagation of the propagation component triggered by setting security on item or moving an item.

9. The system of claim 1, the propagation component enforces access control list propagation policy based, at least in part, upon a change to a security descriptor at the root of a hierarchy.

10. The system of claim 1 employed as a component of a hierarchical system.

11. The system of claim 1, propagation of the propagation component triggered by a change in security policy to an item.

12. The system of claim 1, propagation of the propagation component triggered by adding and/or deleting a particular user'"'"'s access to the item(s).

13. The system of claim 1, the compound item comprising a logical container with item(s) in it.

14. The system of claim 1, the compound item can be instantiated as a schematized set of data.

15. The system of claim 1, the compound item can be instantiated as a file-backed item.

16. The system of claim 1, propagation by the propagation component to a child item is based, at least in part, upon a security policy on a parent item, a specified security policy on the child item and the type of child item.

17. A method for propagating access control information, comprising:

receiving information associated with one or more items, at least one of the items is a compound item;

propagating an access control list to the item; and

,

storing the propagated access control list.

18. The method of claim 17, propagating an access control list for the compound item comprising:

propagating an object inherit access control entry for the compound item and allowing propagation of the object inherit access control entry through the compound item; and

,

propagating a container inherit access control entry as container inherit, inherit only.

19. An item inheritance system, comprising:

means for receiving information associated with one or more items, at least one of the items comprising a compound item; and

,

means for propagating access control information to the items.

20. The system of claim 19, further comprising:

means for propagating an object inherit access control entry for the compound item and allowing propagation of the object inherit access control entry through the compound item; and

,

means for propagating a container inherit access control entry as container inherit, inherit only.