System and method for selectively defining access to application features

• US 6,578,029 B2
• Filed: 06/06/2002
• Issued: 06/10/2003
• Est. Priority Date: 07/17/1998
• Status: Expired due to Term

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Electronic Data Systems Corporation (Perspecta, Inc.)
• Inventors: Gershfield, James N., Barger, Shawn G.
• Primary Examiner(s): Shah, Sanjiv
• Application Number:
  US10/164,511
• Publication Number:
  US 20030050913A1
• Time in Patent Office: 369 Days
• Field of Search: 707/2, 707/200, 707/9, 707/201, 707/1, 709/225, 709/229, 370/254
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing

Abstract

A method and system are described for defining a user'"'"'s access to one or more features of an application. One or more “attributes” are assigned to users of a computer system and stored in a data table. Each attribute has a name which designates the feature to which access is being defined, (e.g., the ability to access data within the database), and a value defining the limits of access. Attributes may be assigned in groups to eliminate the burden of preparing attribute assignments one by one for each user. When an application is run, the attributes are retrieved and enforced such that the user'"'"'s access to the features of the application is defined in accordance with the retrieved attributes.

Claims

1. In a computer system capable of running at least one application and maintaining a database, each application having at least one feature, a method for defining a user'"'"'s access to said at least one feature, comprising:

running an application having at least two features, one of the features relating to the ability to access data and one of the features relating to the ability to manipulate accessed data;

retrieving from a database two or more attributes assigned to a user, one of the retrieved attributes relating to the ability to access data and one of the retrieved attributes relating to the ability to manipulate accessed data; and

enforcing the retrieved attributes, whereby the user'"'"'s access to data and ability to manipulate accessed data is defined in accordance with the retrieved attributes.

2. The method of claim 1 wherein more than one of the at least two features relate to the ability to access data.

3. The method of claim 1 further comprising:

retrieving one or more parent-child value relationships from said database; and

determining whether any of the retrieved attributes may be discarded in accordance with the retrieved parent-child value relationships.

4. The method of claim 1 further comprising, providing a user a choice of applications to run in accordance with the at least two attributes assigned to said user.

5. The method of claim 4 wherein the applications provide access to different data based on the same attribute.

6. In a computer system capable of running at least one application and maintaining a database, each application having at least one feature, a method for defining a user'"'"'s access to said at least one feature, comprising:

assigning at least two attributes to a user, one of the attributes relating to the ability to access data and one of the attributes relating to the ability to manipulate accessed data;

running an application having at least two features, one of the features relating to the ability to access data and one of the features relating to the ability to manipulate accessed data; and

enforcing the attributes, whereby the user'"'"'s access to data and ability to manipulate accessed data is defined in accordance with the assigned attributes.

7. The method of claim 6 further comprising, providing to a user a choice of applications to run in accordance with the at least two attributes assigned to said user.

8. The method of claim 7 wherein the applications provide access to different data based on the same attribute.

9. The method of claim 6 wherein more than one of the at least two features relate to the ability to access data.

10. The method of claim 6 further comprising:

assigning a parent value for at least one actual value of said at least two attributes; and

determining whether any of the retrieved attributes may be discarded in accordance with the retrieved parent-child value relationships.

11. In a computer system capable of running at least one application and maintaining a database, each application having at least one feature, a method for defining a user'"'"'s access to said at least one feature, comprising:

running an application;

retrieving from a database at least one attribute assigned to a user and a parent-child value relationship for at least one of the attributes;

determining whether any of the retrieved attributes may be discarded in accordance with any of the retrieved parent-child value relationships; and

enforcing the retrieved attributes, whereby the user'"'"'s access to said at least one feature of said application is defined in accordance with the retrieved attributes.

12. The method of claim 11, wherein one or more of the at least one feature relates to the ability to access data.

13. The method of claim 11 further comprising, providing a user a choice of applications to run in accordance with the at least attribute assigned to the user.

14. The method of claim 13 wherein the applications provide access to different data based on the same attribute.

15. In a computer system capable of running at least one application and maintaining a database, each application having at least one feature, a method for defining a user'"'"'s access to said at least one feature, comprising:

assigning at least one attribute to a user and a parent-child value relationship to at least one of the attributes;

running an application in said computer system;

determining whether any of the attributes may be discarded in accordance with any of the parent-child value relationships; and

enforcing the assigned attributes, whereby the user'"'"'s access to said at least one feature of said application is defined in accordance with the assigned attributes.

16. The method of claim 15, wherein one or more of the at least one feature relates to the ability to access data.

17. The method of claim 15 further comprising, providing a user a choice of applications to run in accordance with the at least attribute assigned to a user.

18. The method of claim 17 wherein the applications provide access to different data based on the same attribute.

19. In a computer system capable of running at least one application and maintaining a database, each application having at least one feature, a method for defining a user'"'"'s access to said at least one feature, comprising:

running an application having a feature relating to the ability to manipulate accessed data;

retrieving from a database at least one attribute assigned to a user, at least one of the retrieved attributes relating to the ability to manipulate accessed data; and

enforcing the retrieved attributes, whereby the user'"'"'s ability to manipulate accessed data is defined in accordance with the retrieved attributes.

20. The method of claim 19 wherein the application has at least two features, one of the features relating to the ability to access data.

21. The method of claim 19 further comprising:

retrieving at least one parent-child value relationship from said database; and

determining whether any of the retrieved attributes may be discarded in accordance with the retrieved parent-child value relationships.

22. The method of claim 19 further comprising providing a user a choice of applications to run in accordance with the attributes assigned to a user.

23. The method of claim 22 wherein the applications provide access to different data based on the same attribute.

24. In a computer system capable of running at least one application and maintaining a database, each application having at least one feature, a method for defining a user'"'"'s access to said at least one feature, comprising:

assigning at least one attribute to a user, at least one of the attributes relating to the ability to manipulate accessed data;

running an application having a feature relating to the ability to manipulate accessed data; and

enforcing the assigned attributes, whereby the user'"'"'s ability to manipulate accessed data is defined in accordance with the assigned attributes.

25. The method of claim 24 wherein the application has at least two features, at least one of the features relating to the ability to access data.

26. The method of claim 24 further comprising:

assigning a parent value for at least one actual value of said at least one attribute, whereby one or more parent-child relationships are created; and

determining whether any of the assigned attributes may be discarded in accordance with the assigned parent-child value relationships.

27. The method of claim 24 further comprising, providing to said user a choice of one or more applications to run in accordance with the at least two attributes assigned to said user.

28. The method of claim 27 wherein the applications provide access to different data based on the same attribute.