METHOD AND APPARATUS FOR DELIVERING APPLICATION SERVICE USING PRE-CONFIGURED ACCESS CONTROL CORRESPONDING TO ORGANIZATIONAL HIERARCHY

• US 20130111562A1
• Filed: 05/22/2012
• Published: 05/02/2013
• Est. Priority Date: 10/31/2011
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: LEE, Jihyun, WON, Hee Sun, Hur, Sung Jin
• Application Number:
  US13/477,648
• Publication Number:
  US 20130111562A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for delivering an application service defines an organizational hierarchy, defines an expanded role graph by mapping the organizational hierarchy to an authority structure in the form of a role graph, and defines a service creation policy based on authority information of each role depending on the expanded role graph. The method then creates a software service based on the defined authority information of each role.

Claims

1. A method for delivering an application service, the method comprising:

defining an organizational hierarchy;

defining an expanded role graph by mapping the organizational hierarchy to an authority structure in the form of a role graph;

defining a service creation policy based on authority of each role depending on the expanded role graph; and

creating a software service based on the defined authority information of each role.

2. The method of claim 1, wherein said defining an organizational hierarchy comprises:

defining the organizational hierarchy as departments and teams, and

wherein the departments are presented by the names of major categories and subsequent categories, and the subsequent categories are included in the departments of the major categories.

3. The method of claim 1, wherein said defining an expanded role graph comprises:

defining the role graph, the role graph including information about a department to which a user of the organization belongs and information about authority that can use the application service.

4. The method of claim 1, wherein said defining a service creation policy comprises:

defining UI components of the application service and detailed UI attribute of the components.

5. The method of claim 1, wherein said defining a service creation policy comprises:

defining business logic to execute an operation as requested when a specific component is selected from a created web page.

6. The method of claim 1, wherein said creating a software service comprises:

creating the software service, wherein the software service includes at least one of accessible menu, a UI page, a UI page component or business logic for each role.

7. The method of claim 1, wherein said creating a software service comprises:

offering menus to operate accessible functions.

8. The method of claim 7, wherein said creating a software service comprises:

searching components of a web page for each role to create a UI page and links the UI page to the menus.

9. The method of claim 1, wherein said creating a software service comprises:

allowing UI of an application service to be shown to a web browser; and

operating pre-configured business logic as requested from a specific UI component.

10. An apparatus for delivering an application service, the apparatus comprising:

an access control framework configured to define an organizational hierarchy, create an authority structure in the form of a role graph, mapping the organizational hierarchy to an authority structure in the form of a role graph to define an expanded role graph, and define a service creation policy based on authority of each role depending on the expanded role graph; and

a software service delivery framework configured to create a software service based on the authority information of each role defined in the service creation policy.

11. The apparatus of claim 10, wherein the access control framework comprises:

a service creation policy modeler configured to define and control access authority to an application;

a service creation policy checker configured to check whether or not there exists inconsistency with an application service creation policy defined for the organizational hierarchy and each role; and

a service policy repository configured to store the service creation policy.

12. The apparatus of claim 11, wherein the service creation policy checker is configured to check a role-based authority prior to the creation of the software service so as to create the software service as defined in the service creation policy.

13. The apparatus of claim 11, wherein the service creation policy modeler comprises:

a role-access control definer configured to define the access authority for each role;

a rule-function definer configured to create, functions of an application service and rules of the roles having the functions;

an organizational hierarchy definer configured to define information about departments and teams of the organizational hierarchy;

a user-role assigner configured to assign roles to users of the application service;

a rule-constraint definer configured to define constraints on the roles and organizational hierarchy when creating the application service; and

a user-department assigner configured to assign users to the defined organizational hierarchy.

14. The apparatus of claim 10, wherein the software service delivery framework includes:

a meta data repository configured to store UI page configuration information for creating UI pages and structural information of business data related to an application service that operates on a UI page;

a UI meta handler configured to extract the UI page configuration information based on the users and roles from the meta data repository;

a data schema handler configured to extract structural information of business data related to the application service that operates on the UI page from the meta data repository;

a service data repository configured to store the business logic;

a business logic meta handler configured to extract, from the service data repository, a script code, a service implementation code, and workflow description information that are required to perform work-related tasks in the application service; and

a real-time execution engine configured to identify, in response to a request for the application service from a service user, role for the service user to create a service that offers the functions and UI based on the identified role in real time.

15. The apparatus of claim 14, wherein the real-time execution engine is configured to:

combine the UI configuration information, extracted from the UI meta handler, the data schema handler and the business logic meta handler, a data object for making a query and changing the application service, and business logic to create a structured service in the form of web pages; and

execute an operation as requested from a UI-specific component to show an execution result thereof.