Role-based navigation of information resources

• US 6,453,353 B1
• Filed: 02/12/1999
• Issued: 09/17/2002
• Est. Priority Date: 07/10/1998
• Status: Expired due to Term

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Belmonte, Emilio, Win, Teresa
• Primary Examiner(s): Dinh, Dung C.
• Assistant Examiner(s): SALAD, ABDULLAHI ELMI
• Application Number:
  US09/248,764
• Time in Patent Office: 1,313 Days
• Field of Search: 709/229, 709/225, 709/219, 709/218, 709/203, 709/226, 713/200, 713/201, 713/226, 707/9, 705/8
• US Class Current: 709/229
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A single secure sign-on gives a user access to authorized Web resources, based on the user'"'"'s role in the organization that controls the Web resources. The information resources are stored on a protected Web server. A user of a client or browser logs in to the system. A runtime module on the protected server receives the login request and intercepts all other request by the client to use a resource. The runtime module connects to an access server that can determine whether a particular user is authentic and which resources the user is authorized to access. User information is associated with roles and functional groups of an organization to which the user belongs; the roles are associated with access privileges. The access server connects to a registry server that stores information about users, roles, functional groups, resources, and associations among them. The access server and registry server exchange encrypted information that authorized the user to use the resource. The user is presented with a customized Web page showing only those resources that the user may access. Thereafter, the access server can resolve requests to use other resources without contacting the registry server. The registry server controls a flexible, extensible, additive data model stored in a database that describes the user, the resources, roles of the user, and functional groups in the enterprise that are associated with the user.

Claims

1. In a World Wide Web computer system, a computer-implemented method of controlling access to one or more resources to which access is controlled through a Web server, the method comprising the steps of:

the Web server receiving information describing a user;

said Web server causing transmission of said information describing said user to a Web application server;

said Web application server receiving said information describing said user;

in response to receiving said information describing said user;

said Web application server identifying a subset of the one or more resources that the user is authorized to access, based on stored information describing one or more roles and one or more access rights of the user that are stored in association with user identifying information, and

said Web application server communicating information defining the subset to the Web server;

said Web server storing said information defining the subset;

communicating, to a client that is associated with the user, a Web page containing links to only those resources that the user is authorized to access, based on the user'"'"'s role within an enterprise that controls the resources;

after communicating information defining the subset, said Web server receiving one or more requests from said client to access said one or more resources; and

said Web server resolving whether to grant said one or more requests based on said information defining the subset.

2. The method recited in claim 1, further comprising the steps of:

storing, in a database, information describing a role of the user, a person type of the user, and a functional group to which the user belongs within the enterprise; and

storing an association of the user to the role, person type, and functional group at the Web application server.

3. The method recited in claim 1, further comprising the steps of:

storing, in a database, information describing one or more roles and functional groups of the enterprise to which the user belongs in association with information describing the user; and

determining whether the user may access the one or more resources based on the information describing the roles and functional groups.

4. The method recited in claim 2, further comprising the steps of:

based on the association, automatically granting access to the one or more resources to all users who have the role when the association is stored; and

based on the association, automatically denying access to the one or more resources to all users who do not have the role when the association is un-assigned.

5. The method recited in claim 1, wherein the receiving step further comprises the steps of:

storing, in a database accessible by the Web application server, information describing one or more roles and one or more access rights of the user that are stored in association with user identifying information, wherein the roles represent the work responsibilities carried out by the user in the enterprise, and wherein the access rights represent the kinds and levels of access privileges that are held by the user in the enterprise.

6. The method recited in claim 2, in which the step of storing information describing a functional group further comprises the steps of storing, in the database, information identifying a department of the enterprise in which persons work who have the role associated with the user.

7. The method recited in claim 1, further comprising the steps of storing, in a database accessible by the Web application server, information defining the one or more resources including a resource identifier value, a location value, and a list of protected resources.

8. The method recited in claim 7, further comprising the steps of storing, in the database, an association of each resource to one or more of the roles.

9. The method recited in claim 7, further comprising the steps of assigning, by storing in the database, an association of a resource to one or more of the roles, and un-assigning the one or more resources from the roles.

10. The method recited in claim 1, further comprising the steps of:

based on the association, automatically granting access to the one or more resources to all users who have the role when the one or more resources is assigned to that role; and

based on the association, automatically denying access to the one or more resources to all users who have the role when the association is un-assigned from that role.

11. The method recited in claim 1, further comprising the steps of:

communicating, from the Web server to the client, information describing a customized display that identifies only those resources that the user may access.

12. A method of controlling access to Web documents that are stored on a protected Web access server, the method comprising the steps of:

said Web access server receiving information identifying a user;

said Web access server causing transmission of said information describing said user to a registry server;

in response to receiving said information describing said user;

said registry server identifying a subset of the Web documents that the user is authorized to access, based on stored information describing the Web documents, one or more roles, one or more functional groups, and one or more access rights of the user that are stored in association with user identifying information, and

said registry server communicating information defining the subset to the Web access server;

communicating, to a client that is associated with the user, a Web page containing links to only those Web documents that the user is authorized to access, based on the user'"'"'s role within an enterprise that controls the Web documents;

after communicating information defining the subset, said Web access server receiving one or more requests from said client to access said subset of Web documents; and

said Web server resolving whether to grant said one or more requests based on said information defining the subset.

13. The method recited in claim 12, further comprising the steps of:

resolving requests from the client to access one of the Web documents based on information stored in the Web access server and without contacting the registry server.

14. The method recited in claim 12, further comprising the steps of including a link to a resource in the Web page that is communicated to the client only when the roles associated with the user satisfy an access rule.

15. The method recited in claim 14, further comprising the steps of storing, in a database, information that defines the access rule, associated with the user, as a Boolean expression that includes one or more roles.

16. A computer-readable medium carrying one or more sequences of instructions for controlling access to one or more resources to which access is controlled through a Web server, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

the Web server receiving information describing a user;

said Web server causing transmission of said information describing said user to a Web application server;

said Web application server receiving said information describing said user;

in response to receiving said information describing said user;

said Web application server identifying a subset of the one or more resources that the user is authorized to access, based on stored information describing one or more roles and one or more access rights of the user that are stored in association with user identifying information, and

said Web application server communicating information defining the subset to the Web server;

said Web server storing said information defining the subset;

communicating, to a client that is associated with the user, a Web page containing links to only those resources that the user is authorized to access, based on the user'"'"'s role within an enterprise that controls the resources;

after communicating information defining the subset, said Web server receiving one or more requests from said client to access said one or more resources; and

said Web server resolving whether to grant said one or more requests based on said information defining the subset.

17. The computer-readable medium recited in claim 16, the steps further comprising:

storing, in a database, information describing a role of the user, a person type of the user, and a functional group to which the user belongs within the enterprise; and

storing an association of the user to the role, person type, and functional group at the Web application server.

18. The computer-readable medium recited in claim 16, the steps further comprising:

storing, in a database, information describing one or more roles and functional groups of the enterprise to which the user belongs in association with information describing the user; and

determining whether the user may access the one or more resources based on the information describing the roles and functional groups.

19. The computer-readable medium recited in claim 17, the steps further comprising:

based on the association, automatically granting access to the one or more resources to all users who have the role when the association is stored; and

based on the association, automatically denying access to the one or more resources to all users who do not have the role when the association is un-assigned.

20. The computer-readable medium recited in claim 16, wherein the receiving step further comprises the steps of:

storing, in a database accessible by the Web application server, information describing one or more roles and one or more access rights of the user that are stored in association with user identifying information, wherein the roles represent the work responsibilities carried out by the user in the enterprise, and wherein the access rights represent the kinds and levels of access privileges that are held by the user in the enterprise.

21. The computer-readable medium recited in claim 17, in which the step of storing information describing a functional group further comprises the steps of storing, in the database, information identifying a department of the enterprise in which persons work who have the role associated with the user.

22. The computer-readable medium recited in claim 16, the steps further comprising:

storing, in a database accessible by the Web application server, information defining the one or more resources including a resource identifier value, a location value, and a list of protected resources.

23. The computer-readable medium recited in claim 22, the steps further comprising:

storing, in the database, an association of each resource to one or more of the roles.

24. The computer-readable medium recited in claim 22, the steps further comprising:

assigning, by storing in the database, an association of a resource to one or more of the roles, and un-assigning the one or more resources tom the roles.

25. The computer-readable medium recited in claim 16, the steps further comprising:

based on the association, automatically granting access to the one or more resources to all users who have the role when the one or more resources is assigned to that role; and

based on the association, automatically denying access to the one or more resources to all users who have the role when the association is un-assigned from that role.

26. The computer-readable medium recited in claim 16, the steps further comprising:

communicating, from the first server to the client, information describing a customized display that identifies only those resources that the user may access.

27. A computer-readable medium carrying one or more sequences of instructions for controlling access to Web documents that are stored on a protected Web access server, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

said Web access server receiving information identifying a user;

said Web access server causing transmission of said information describing said user to a registry server;

in response to receiving said information describing said user;

said registry server identifying a subset of the Web documents tat the user is authorized to access, based on stored information describing the Web documents, one or more roles, one or more functional groups, and one or more access rights of the user that are stored in association with user identifying information, and

said registry server communicating information defining the subset to the Web access server;

communicating, to a client that is associated with the user, a Web page containing links to only those Web documents that the user is authorized to access, based on the user'"'"'s role within an enterprise that controls the Web documents;

after communicating information defining the subset, said Web access server receiving one or more requests from said client to access said subset of Web documents; and

said Web server resolving whether to grant said one or more requests based on said information defining the subset.

28. The computer-readable medium recited in claim 27, the steps further comprising resolving requests from the client to access one of the Web documents based on information stored in the Web access server and without contacting the registry server.

29. The computer-readable medium recited in claim 27, the steps further comprising including a link to a Web resource in the Web page that is communicated to the client only when the roles associated with the user satisfy an access rule.

30. The computer-readable medium recited in claim 29, the steps further comprising storing, in a database, information that defines the access rule, associated with the user, as a Boolean expression that includes one or more roles.