Access control system for a multimedia datastore

• US 6,446,069 B1
• Filed: 09/17/1999
• Issued: 09/03/2002
• Est. Priority Date: 09/17/1999
• Status: Expired due to Term

• Current Assignee: Uniloc 2017 LLC (FIG LLC (d/b/a Fortress Investment Group LLC))
• Original Assignee: International Business Machines Corporation
• Inventors: Yaung, Alan Tsu-I, Lin, Jy-Jine James
• Primary Examiner(s): Mizrahi, Diane D.
• Application Number:
  US09/398,374
• Time in Patent Office: 1,082 Days
• Field of Search: 707/2, 707/4, 707/10, 707/9, 707/104, 709/225, 709/226, 713/150, 713/165, 713/167, 713/200, 713/201
• US Class Current: 707/600
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing

Abstract

A method, apparatus, and article of manufacture for a computer-implemented access control system. The access control system controls access by users to functions of an application program executed by a computer and connected to a multimedia datastore. Application privileges are defined to control access to functions of the application program which operate upon data items of the multimedia datastore. For the application program, one or more users are associated with one or more application privileges. Access by users to functions of the application program is restricted depending upon whether the user has been associated with the application privilege for the function. If the user has been associated with the application privilege, access to the function is granted, if not, access to the function is denied.

Claims

1. A method of controlling access by users to functions of an application executed by a computer connected to a datastore, the method comprising the steps of:

for the application,

associating one or more users with one or more application privileges wherein each application privilege is associated with a function; and

restricting access by users to functions of the application dependent upon whether the user has been associated with the application privilege for the function.

2. The method of claim 1 above, further comprising the step of defining application privileges to control access to functions.

3. The method of claim 2 above, wherein the step of defining application privileges further comprises the step of building a definition vector.

4. The method of claim 3 above, further comprising the step of receiving a request to build the definition vector.

5. The method of claim 3 above, wherein the step of associating further comprises the step of associating an access control list with the definition vector.

6. The method of claim 5 above, further comprising the step of receiving a request to associate an access control list with the definition vector.

7. The method of claim 1 above, further comprising the step of checking the application privileges of the user utilizing a definition vector and an associated access control list.

8. The method of claim 7 above, wherein the step of checking further comprises the step of building a privilege vector.

9. The method of claim 8 above, wherein the privilege vector further comprises a plurality of privilege bits.

10. The method of claim 9 above, wherein the step of building a privilege vector further comprises setting a privilege bit if the application privilege for the user is identified in the associated access control list.

11. The method of claim 9 above, wherein the step of building a privilege vector further comprises not setting a privilege bit if the application privilege for the user is not identified in the associated access control list.

12. The method of claim 1 above, further comprising the step of building an access control table that defines the application privileges for a user.

13. The method of claim 12 above, further comprising the step of restricting the access of a user to a function based upon the access control table.

14. The method of claim 1 above, wherein one or more users comprises a group and wherein one or more application privileges are associated with a group.

43. The method of claim 1, wherein said access is restricted by dynamically binding the application to said one or more application privileges.

44. The method of claim 2, wherein a developer of the application defines said application privileges.

45. The method of claim 2, wherein a system manager of the application defines said application privileges.

46. The method of claim 2, wherein a user of the application defines said application privileges.

47. The method of claim 3, wherein said definition vector includes indicators associated with the application privileges, wherein the number of indicators is not limited by an access control system of the datastore.

48. The method of claim 4, wherein the definition vector includes at least one application-specific privilege.

15. An apparatus for controlling access by users to functions of an application, comprising:

a computer having a datastore connected thereto;

one or more computer programs, performed by the computer, and for the application, associating one or more users with one or more application privileges wherein each application privilege is associated with a function, and restricting access by users to functions of the application dependent upon whether the user has been associated with the application privilege for the function.

16. The apparatus of claim 15 above, further comprising means for defining application privileges to control access to functions.

17. The apparatus of claim 16 above, wherein the means for defining application privileges further comprises means for building a definition vector.

18. The apparatus of claim 17 above, further comprising means for receiving a request to build the definition vector.

19. The apparatus of claim 17 above, wherein the means for associating further comprises means for associating an access control list with the definition vector.

20. The apparatus of claim 19 above, further comprising means for receiving a request to associate an access control list with the definition vector.

21. The apparatus of claim 15 above, further comprising means for checking the application privileges of the user utilizing a definition vector and an associated access control list.

22. The apparatus of claim 21 above, wherein the means for checking further comprises means for building a privilege vector.

23. The apparatus of claim 22 above, wherein the privilege vector further comprises a plurality of privilege bits.

24. The apparatus of claim 23 above, wherein the means for building a privilege vector further comprises setting a privilege bit if the application privilege for the user is identified in the associated access control list.

25. The apparatus of claim 23 above, wherein the means for building a privilege vector further comprises not setting a privilege bit if the application privilege for the user is not identified in the associated access control list.

26. The apparatus of claim 15 above, further comprising means for building an access control table that defines the application privileges for a user.

27. The apparatus of claim 26 above, further comprising means for restricting the access of a user to a function based upon the access control table.

28. The apparatus of claim 15 above, wherein one or more users comprises a group and wherein one or more application privileges are associated with a group.

49. The apparatus of claim 18, wherein the definition vector includes at least one application-specific privilege.

29. An article of manufacture comprising a computer program carrier readable by a computer and embodying one or more instructions executable by the computer to perform method steps for controlling access by users to functions of an application executed by the computer connected to a datastore, the method comprising the steps of:

for the application,

associating one or more users with one or more application privileges wherein each application privilege is associated with a function; and

restricting access by users to functions of the application dependent upon whether the user has been associated with the application privilege for the function.

30. The article of manufacture of claim 29 above, further comprising the step of defining application privileges to control access to functions.

31. The article of manufacture of claim 30 above, wherein the step of defining application privileges further comprises the step of building a definition vector.

32. The article of manufacture of claim 31 above, further comprising the step of receiving a request to build the definition vector.

33. The article of manufacture of claim 31 above, wherein the step of associating further comprises the step of associating an access control list with the definition vector.

34. The article of manufacture of claim 33 above, further comprising the step of receiving a request to associate an access control list with the definition vector.

35. The article of manufacture of claim 29 above, further comprising the step of checking the application privileges of the user utilizing a definition vector and an associated access control list.

36. The article of manufacture of claim 35 above, wherein the step of checking further comprises the step of building a privilege vector.

37. The article of manufacture of claim 36 above, wherein the privilege vector further comprises a plurality of privilege bits.

38. The article of manufacture of claim 37 above, wherein the step of building a privilege vector further comprises setting a privilege bit if the application privilege for the user is identified in the associated access control list.

39. The article of manufacture of claim 37 above, wherein the step of building a privilege vector further comprises not setting a privilege bit if the application privilege for the user is not identified in the associated access control list.

40. The article of manufacture of claim 29 above, further comprising the step of building an access control table that defines the application privileges for a user.

41. The article of manufacture of claim 40 above, further comprising the step of restricting the access of a user to a function of the application based upon the access control table.

42. The article of manufacture of claim 29 above, wherein one or more users comprises a group and wherein one or more application privileges are associated with a group.

50. The article of manufacture of claim 32, wherein the definition vector includes at least one application-specific privilege.