Delegated administration of information in a database directory

• US 6,772,157 B2
• Filed: 01/16/2001
• Issued: 08/03/2004
• Est. Priority Date: 10/19/2000
• Status: Active Grant

• Current Assignee: General Electric Company
• Original Assignee: General Electric Company
• Inventors: Aggour, Kareem Sherif, Barnett, Janet Arlie, Kornfein, Mark Mitchell, Vivier, Barbara Jean
• Primary Examiner(s): Corrielus, Jean M.
• Application Number:
  US09/761,000
• Publication Number:
  US 20020095414A1
• Time in Patent Office: 1,295 Days
• Field of Search: 707/10, 707/3, 707/101, 707/9, 707/103, 709/217, 709/218, 709/227, 709/229, 709/206, 709/246, 713/201
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16H 40/20 for the management or administration of healthcare resources or facilities, e.g. managing hospital staff or surgery rooms
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A delegated administration tool for administrating information in a database directory. The delegated administration tool enables an administrator to delegate administration and various types of administrative authority to other users within a community of users. In particular, an administrator with proper authority may create new administrative domains and assign authority referred to as delegation authority and edit authority to other users. The creation of additional administrative domains and the assignment of the delegation authority and edit authority can continue to an arbitrary level within the community.

Claims

1. A method for managing information associated with a user community, comprising:

specifying the information associated with the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

granting administrative privileges for managing the information associated with the user community according to the set of users, attributes and allowable attribute values specified for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

specifying the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values and granting administrative privileges for administrating the user community information associated with each sub-domain, wherein the specifying and granting continue to an arbitrary level with respect to the at least one administrative domain.

2. The method according to claim 1, wherein the administrative privileges for administrating the user community information associated with each sub-domain includes at least one of delegation authority and edit authority.

3. The method according to claim 1, further comprising delegating the granted administrative privileges for the at least one administrative domain and administrative sub-domains.

4. A method for providing delegated administration of a user community, comprising:

dividing the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

granting administrative privileges to an administrator for managing user community information according to the set of users, attributes and allowable attribute values specified for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

delegating the granted administrative privileges from the administrator to another administrator for managing user community information associated with the at least one administrative domain.

5. The method according to claim 4, further comprising dividing the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

6. The method according to claim 5, further comprising delegating the granted administrative privileges to other administrators for managing user community information associated with the administrative sub-domains.

7. The method according to claim 4, further comprising delegating the granted administrative privileges to additional administrators for managing user community information associated with the at least one administrative domain.

8. The method according to claim 4, further comprising dividing the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values and delegating administrative privileges for managing user community information associated with each domain, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

9. A method for providing delegated administration of a user community with a client system, comprising:

dividing the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

granting administrative privileges to an administrator for managing user community information according to the set of users, attributes and allowable attribute values specified for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

dividing the at least one administrative domain into administrative sub-domains each having set of users, attributes and allowable attribute values; and

delegating the granted administrative privileges from the administrator to other administrators for managing user community information associated with the administrative sub-domains.

10. The method according to claim 9, further comprising dividing the administrative sub-domains into more domains each having a set of users, attributes and allowable attribute values and delegating administrative privileges for managing user community information associated with each of these domains, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

11. The method according to claim 9, wherein the delegating of granted administrative privileges comprises having an administrator with delegation authority delegating at least one of delegation authority and edit authority and an administrator with edit authority delegating edit authority.

12. A method for enabling an administrator to control administration of information associated with a user community, comprising:

providing the information associated with the user community to the administrator;

prompting the administrator to define at least one administrative domain for the user community, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

prompting the administrator to define administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

using the at least one administrative domain and administrative privileges defined by the administrator to control administration of the information associated with the user community.

13. The method according to claim 12, further comprising prompting the administrator to divide the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

14. The method according to claim 13, further comprising prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for the administrative sub-domains.

15. The method according to claim 14, further comprising prompting the administrator to divide the administrative sub-domains into more domains each having a set of users, attributes and allowable attribute values and delegate administrative privileges for managing user community information associated with each of these domains, wherein the prompting to divide and delegate continues to an arbitrary level with respect to the at least one administrative domain.

16. A method for enabling an administrator to delegate administrative control of a user community, comprising:

providing information associated with the user community;

prompting the administrator to define at least one administrative domain for the user community, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

prompting the administrator to define administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

prompting the administrator to divide the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values;

prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for managing user community information associated with the administrative sub-domains; and

using the administrative domains and administrative privileges to control administration of the information associated with the user community.

17. A user community administration tool for managing information associated with a user community, comprising:

a domain definition component that defines the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

an administrative privileges component that grants administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component that manages user community information associated with the at least one administrative domain in accordance with the granted administrative privileges.

18. The tool according to claim 17, wherein the domain definition component specifies the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

19. The tool according to claim 18, wherein the administrative privileges component delegates the administrative privileges for managing user community information associated with the administrative sub-domains.

20. The tool according to claim 17, wherein the administrative privileges component delegates the granted administrative privileges for managing user community information associated with the at least one administrative domain.

21. The tool according to claim 17, wherein the domain definition component specifies administrative sub-domains each having a set of users, attributes and allowable attribute values and the administrative privileges component delegates the administrative privileges for managing user community information associated with the domains to an arbitrary level with respect to the at least one administrative domain.

22. A system for managing information associated with a user community, comprising:

a database directory containing a plurality of user information;

a user community administration tool to manage the plurality of user information in the database directory;

the user community administration tool comprising a domain definition component to define the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

an administrative privileges component to grant administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component to manage user community information associated with the at least one administrative domain in accordance with the granted administrative privileges; and

a first computing unit configured to serve the user community administration tool and the database directory.

23. The system according to claim 22, wherein the domain definition component specifies the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

24. The system according to claim 23, wherein the administrative privileges component delegates the administrative privileges for managing user community information associated with the administrative sub-domains.

25. The system according to claim 22, wherein the administrative privileges component delegates the granted administrative privileges for managing user community information associated with the at least one administrative domain.

26. The system according to claim 22, further comprising a second computing unit configured to execute the user community administration tool served from the first computing unit over a network.

27. A system for managing information associated with a user community, comprising:

a database directory containing a plurality of user information;

a user community administration tool to manage the plurality of user information in the database directory;

the user community administration tool comprising a domain definition component to define the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

an administrative privileges component to grant administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component to manage user community information associated with the at least one administrative domain in accordance with the granted administrative privileges;

a first computing unit configured to execute the user community administration tool;

a network; and

a second computing unit configured to serve the database directory and the user community administration tool to the first computing unit over the network.

28. A user community administration tool for providing delegated administration of a user community, comprising:

means for dividing the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

means for granting administrative privileges to an administrator for managing user community information according to the set of users, attributes and allowable attribute values specified for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

means for delegating the granted administrative privileges to another administrator for managing user community information associated with the at least one administrative domain.

29. The tool according to claim 28, further comprising means for dividing the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

30. The tool according to claim 29, further comprising means for delegating the granted administrative privileges to other administrators for managing user community information associated with the administrative sub-domains, wherein an administrator with delegation authority delegates at least one of delegation authority and edit authority, while an administrator with edit authority delegates edit authority.

31. The tool according to claim 28, further comprising means for delegating the granted administrative privileges to additional administrators for managing user community information associated with the at least one administrative domain.

32. A system for providing delegated administrative control of a user community, comprising:

a database directory containing a plurality of user information associated with the user community; and

a user community administration tool to facilitate administrative control of the user information in the database directory;

the user community administration tool comprising a domain definition component to define the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

an administrative privileges component to grant administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

an information management component to manage user community information associated with the at least one administrative domain in accordance with the granted administrative privileges.

33. The system according to claim 32, wherein the domain definition component divides the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

34. The system according to claim 33, wherein the administrative privileges component delegates the administrative privileges to an arbitrary level of administrators for managing user community information associated with the administrative sub-domains.

35. The system according to claim 32, wherein the administrative privileges component delegates the granted administrative privileges from the administrator to other administrators for managing user community information associated with the at least one administrative domain.

36. A computer-readable medium storing computer instructions for instructing a computer system to provide delegated administration of a user community, the computer instructions comprising:

dividing the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

granting administrative privileges to an administrator for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

delegating the granted administrative privileges to another administrator for managing user community information associated with the at least one administrative domain.

37. The computer-readable medium according to claim 36, further comprising instructions for dividing the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

38. The computer-readable medium according to claim 37, further comprising instructions for delegating the granted administrative privileges to other administrators for managing user community information associated with the administrative sub-domains.

39. The computer-readable medium according to claim 36, further comprising instructions for delegating the granted administrative privileges to additional administrators for managing user community information associated with the at least one administrative domain.

40. The computer-readable medium according to claim 36, further comprising instructions for dividing the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values and delegating administrative privileges for managing user community information associated with each domain, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

41. The computer-readable medium according to claim 36, further comprising instructions for managing user community information associated with the at least one administrative domain according to the delegated administrative privileges.

42. A computer-readable medium storing computer instructions for instructing a computer system to provide delegated administration of a user community, the computer instructions comprising:

dividing the user community into at least one administrative domain, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

granting administrative privileges to an administrator for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

dividing the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values; and

delegating the granted administrative privileges from the administrator to other administrators for managing user community information associated with the administrative sub-domains.

43. The computer-readable medium according to claim 42, further comprising instructions for dividing the administrative sub-domains into more domains each having a set of users, attributes and allowable attribute values and delegating administrative privileges for managing user community information associated with each of these domains, wherein the dividing and delegating continue to an arbitrary level with respect to the at least one administrative domain.

44. A computer-readable medium storing computer instructions for instructing a computer system to enable an administrator to control administration of a user community, the computer instructions comprising:

providing information associated with the user community to the administrator;

prompting the administrator to define at least one administrative domain for the user community, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

prompting the administrator to define administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority; and

using the at least one administrative domain and administrative privileges defined by the administrator to control administration of the information associated with the user community.

45. The computer-readable medium according to claim 44, further comprising instructions for prompting the administrator to divide the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values.

46. The computer-readable medium according to claim 45, further comprising instructions for prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for managing user community information associated with the administrative sub-domains.

47. The computer-readable medium according to claim 46, further comprising instructions for prompting the administrator to divide the administrative sub-domains into more domains each having a set of users, attributes and allowable attribute values and delegate administrative privileges for managing user community information associated with each of these domains, wherein the prompting to divide and delegate continues to an arbitrary level with respect to the at least one administrative domain.

48. A computer-readable medium containing computer instructions for instructing a computer system to enable an administrator to delegate administration control of a user community, the computer instructions comprising:

providing information associated with the user community;

prompting the administrator to define at least one administrative domain for the user community, wherein the at least one administrative domain is a managed object that comprises a set of users, a set of modifiable user attributes and a set of allowable values for the user attributes;

prompting the administrator to define administrative privileges for managing user community information according to the set of users, attributes and allowable attribute values defined for the at least one administrative domain, wherein the administrative privileges include at least one of delegation authority and edit authority;

prompting the administrator to divide the at least one administrative domain into administrative sub-domains each having a set of users, attributes and allowable attribute values;

prompting the administrator to delegate the granted administrative privileges from the administrator to other administrators for managing user community information associated with the administrative sub-domains; and

using the at least one administrative domain and administrative sub-domains and administrative privileges and delegated privileges defined by the administrator to control administration of the information associated with the user community.