Security aspects of computer resource repositories

• US 5,991,791 A
• Filed: 01/10/1997
• Issued: 11/23/1999
• Est. Priority Date: 03/24/1994
• Status: Expired due to Term

• Current Assignee: NCR Corporation
• Original Assignee: NCR Corporation
• Inventors: Siefert, David M.
• Primary Examiner(s): Banankhah, Majid A.
• Application Number:
  US08/798,446
• Time in Patent Office: 1,047 Days
• Field of Search: 709/100, 709/101, 709/106, 709/303, 707/9, 707/103, 705/27
• US Class Current: 718/100
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

The invention concerns a system for managing resources, which can take the form of (a) computer-compatible information, such as data files and programs, and (b) non-computer-compatible information, such as data contained on microfiche, and (c) physical objects. The resources are located at geographically diverse sites.

The invention contains a descriptive profile for each resource, and allows any user to search all profiles, and to search the profiles according to "fields" (a database term), such as by location of the resources, or by category of the resources. The user can order delivery of a selected resource, and the system causes delivery of the resource to be executed, irrespective of the form (eg, physical object) of the resource.

The invention allows a provider of a new resource to limit access to the resource, by identifying users who are authorized to obtain access to the resource. Non-authorized users cannot obtain access to the profiles of these resources.

Claims

1. A RESOURCE management system, comprising:

(a) multiple SERVERs, the SERVERs being grouped into LOCAL SERVERs and REGIONAL SERVERs, each of the LOCAL SERVERs comprising means for storing RESOURCEs therein, each of the REGIONAL SERVERs comprising means for storing PROFILEs of RESOURCEs associated with one or more of the LOCAL SERVERs therein, each of the PROFILEs containing descriptive information about one or more of the RESOURCEs, wherein the LOCAL and REGIONAL SERVERs are linked together for electronically transferring the PROFILEs and RESOURCEs therebetween;

(b) means for allowing a user to add a PROFILE to one of the REGIONAL SERVERs; and

(c) means for allowing a user to specify which users are authorized to gain access to the added PROFILE.

2. A system according to claim 1, further comprising:

(c) means for allowing a user to gain access to all of the PROFILEs stored on all of the REGIONAL SERVERs to which the user is authorized to gain such access.

7. A system according to claim 1 in which the RESOURCEs include downloadable data and physical objects.

8. A system according to claim 2 in which the RESOURCEs include downloadable data and physical objects.

3. A RESOURCE management system, comprising:

(a) multiple SERVERs, the SERVERs being grouped into LOCAL SERVERs and REGIONAL SERVERs, each of the LOCAL SERVERs comprising means for storing RESOURCEs therein, each of the REGIONAL SERVERs comprising means for storing PROFILEs of RESOURCEs associated with one or more of the LOCAL SERVERs therein, each of the PROFILEs containing descriptive information about one or more of the RESOURCEs, wherein the LOCAL and REGIONAL SERVERs are linked together for electronically transferring the PROFILEs and RESOURCEs therebetween;

(b) means for allowing a user to gain access to all of the PROFILEs stored on all of the REGIONAL SERVERs; and

(c) means for allowing an ADMINISTRATOR to prohibit selected users from gaining access to selected ones of the PROFILEs.

14. A system according to claim 3, in which each user communicates with a LOCAL or REGIONAL SERVER by means of a PC, and further comprising:

(d) means for allowing the ADMINISTRATOR to send a message to any selected PC.

4. A RESOURCE management system, comprising:

(a) multiple SERVERs, the SERVERs being grouped into LOCAL SERVERs and REGIONAL SERVERs, each of the LOCAL SERVERs comprising means for storing RESOURCEs therein, each of the REGIONAL SERVERs comprising means for storing PROFILEs of RESOURCEs associated with one or more of the LOCAL SERVERs therein, each of the PROFILEs containing descriptive information about one or more of the RESOURCEs, wherein the LOCAL and REGIONAL SERVERs are linked together for electronically transferring the PROFILEs and RESOURCEs therebetween;

(b) for each PROFILE,

(i) means for maintaining a list of users authorized to gain access to said PROFILE; and

(ii) means for preventing non-authorized users from gaining access to said PROFILE.

5. A RESOURCE management system, comprising:

(a) multiple SERVERs serving one or more PCs, the SERVERs being grouped into LOCAL SERVERs and REGIONAL SERVERs, each of the LOCAL SERVERs comprising means for storing RESOURCEs therein, each of the REGIONAL SERVERs comprising means for storing PROFILEs of RESOURCEs associated with one or more of the LOCAL SERVERs therein, wherein the LOCAL and REGIONAL SERVERs are linked together for electronically transferring the PROFILEs and RESOURCEs therebetween;

(b) means for allowing an OWNER of a RESOURCE to;

(i) store the RESOURCE in the LOCAL SERVER which serves the OWNER'"'"'s PC; and

(ii) limit access to the stored RESOURCE to users which are specified by the OWNER.

6. A RESOURCE management system, comprising:

(a) multiple SERVERs serving one or more PCs, the SERVERs being grouped into LOCAL SERVERs and REGIONAL SERVERs, each of the LOCAL SERVERs comprising means for storing RESOURCEs therein, each of the REGIONAL SERVERs comprising means for storing PROFILEs of RESOURCEs associated with one or more of the LOCAL SERVERs therein, wherein the LOCAL and REGIONAL SERVERs are linked together for electronically transferring the PROFILEs and RESOURCEs therebetween;

(b) means for allowing users of PCS to;

(i) store one or more downloadable RESOURCEs in their respective LOCAL SERVERs;

(ii) store a PROFILE for each of stored RESOURCE in their respective LOCAL SERVERs, wherein the PROFILEs contain information about RESOURCEs, including information about the location of non-downloadable RESOURCEs; and

(iii) specify users who are allowed to gain access to each of the stored RESOURCEs.

9. A method of managing a collection of RESOURCEs, located at different geographic sites, comprising the following steps:

(a) logically grouping a plurality of SERVERs into LOCAL SERVERs and REGIONAL SERVERs;

(b) storing the RESOURCEs at one or more of the LOCAL SERVERs;

(c) storing PROFILEs for the RESOURCEs at one or more of the REGIONAL SERVERs, each of the PROFILEs containing descriptive information about a RESOURCE;

(d) allowing a user to add a RESOURCE to one of the LOCAL SERVERs, to create a PROFILE for the added RESOURCE, and to add the created PROFILE to one of the REGIONAL SERVERs; and

(e) allowing the user to restrict access to the added RESOURCE to specified other users.

10. A method according to claim 9, in which the RESOURCEs comprise downloadable data and physical objects.

11. A method for managing RESOURCEs, which include downloadable data and physical objects, comprising:

(a) logically grouping a plurality of SERVERs into LOCAL SERVERs and REGIONAL SERVERs;

(b) storing the RESOURCEs at one or more of the LOCAL SERVERs;

(c) storing PROFILEs for the RESOURCEs at one or more of the REGIONAL SERVERs, each of the PROFILEs containing descriptive information about one or more of the RESOURCEs;

(d) for each PROFILE, storing a list of users who are authorized to gain access to the respective RESOURCE; and

(e) preventing users from gaining access to the RESOURCEs to which the users are not authorized.

12. The method of claim 11, further comprising the step of:

(f) preventing users from gaining access to the PROFILEs of the RESOURCEs to which the users are not authorized.

13. A management system for RESOURCEs, comprising:

(a) a plurality of storage means, the storage means being grouped into LOCAL SERVERs and REGIONAL SERVERs, each of the LOCAL SERVERs comprising means for storing RESOURCEs therein at different geographic locations, each of the REGIONAL SERVERs comprising means for storing PROFILEs of RESOURCEs associated with one or more of the LOCAL SERVERs therein, wherein the LOCAL and REGIONAL SERVERs are linked together for electronically transferring the PROFILEs and RESOURCEs therebetween, and the RESOURCEs include;

(i) downloadable data; and

(ii) physical objects;

(b) means for allowing an OWNER to;

(i) add a RESOURCE to the one or more of the LOCAL SERVERs; and

(ii) restrict access to the added RESOURCE to other users whom the OWNER specifies; and

(c) means for allowing an ADMINISTRATOR to modify the restrictions of paragraph (b)(ii).