System and Method for Negotiating the Access Control List of Data Items in an Ad-Hoc Network with Designated Owner Override Ability

• US 20100036845A1
• Filed: 08/07/2008
• Published: 02/11/2010
• Est. Priority Date: 08/07/2008
• Status: Abandoned Application

• Current Assignee: Research In Motion Limited (Blackberry Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: ALFANO, Nicholas P., GODFREY, James Andrew, FERRAZZINI, Axel
• Application Number:
  US12/188,019
• Publication Number:
  US 20100036845A1
• Time in Patent Office: Days
• US Class Current: N/A
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method is disclosed for managing an access control list for a data item. The method includes designating an owner for the access control list, wherein the owner is a member of the access control list, and wherein only the owner of the access control list is allowed to manage the access control list.

Claims

1. A method for managing an access control list for a data item, comprising:

designating an owner for the access control list, wherein the owner is a member of the access control list, and wherein only the owner of the access control list is allowed to manage the access control list.

2. The method of claim 1, wherein managing the access control list comprises at least one of:

modifying an access privilege of the owner with respect to the data item;

modifying an access privilege of another member of the access control list with respect to the data item;

establishing a candidate access control list as the access control list that is applied to the data item; and

overriding an existing access control list for the data item.

3. The method of claim 2, wherein a first endpoint to propose the candidate access control list becomes a temporary owner of the access control list, and the candidate access control list becomes the access control list for the data item.

4. The method of claim 3, wherein, if the first endpoint did not declare an intention to be the owner of the access control list, the first endpoint'"'"'s status as a temporary owner is revoked after the candidate access control list becomes the access control list for the data item, the access control list has no owner, and a second endpoint can replace the access control list with another access control list and can specify another owner of the other access control list.

5. The method of claim 4, wherein specifying another owner of the other access control list comprises one of:

the second endpoint specifying itself as owner of the other access control list; and

the second endpoint specifying a third endpoint as owner of the other access control list.

6. The method of claim 3, wherein, if the first endpoint declared an intention to be the owner of the access control list, the first endpoint remains the owner of the access control list, and another endpoint cannot replace the access control list and cannot become the owner of the access control list.

7. A device configured to manage an access control list for a data item, comprising:

a processor configured to designate an owner for the access control list, wherein the owner is a member of the access control list, and wherein only the owner of the access control list is allowed to manage the access control list.

8. The device of claim 7, wherein managing the access control list comprises at least one of:

modifying an access privilege of the owner with respect to the data item;

modifying an access privilege of another member of the access control list with respect to the data item;

establishing a candidate access control list as the access control list that is applied to the data item; and

overriding an existing access control list for the data item.

9. The device of claim 8, wherein a first endpoint to propose the candidate access control list becomes the owner of the access control list, and the candidate access control list becomes the access control list for the data item.

10. The device of claim 9, wherein, if the first endpoint did not declare an intention to be the owner of the access control list, the first endpoint'"'"'s status as a temporary owner is revoked after the candidate access control list becomes the access control list for the data item, the access control list has no owner, and a second endpoint can replace the access control list with another access control list and can specify another owner of the other access control list.

11. The device of claim 10, wherein specifying another owner of the other access control list comprises one of:

the second endpoint specifying itself as owner of the other access control list; and

the second endpoint specifying a third endpoint as owner of the other access control list.

12. The device of claim 9, wherein, if the first endpoint declared an intention to be the owner of the access control list, the first endpoint remains the owner of the access control list, and another endpoint cannot replace the access control list and cannot become the owner of the access control list.