Method and apparatus for an improved security system mechanism in a business applications management system platform

• US 6,850,893 B2
• Filed: 01/12/2001
• Issued: 02/01/2005
• Est. Priority Date: 01/14/2000
• Status: Expired due to Term

• Current Assignee: Saba Software Incorporated
• Original Assignee: Saba Software Incorporated
• Inventors: Mehra, Gaurav, Lipkin, Daniel S.
• Primary Examiner(s): HUA, LY
• Application Number:
  US09/759,062
• Publication Number:
  US 20020120859A1
• Time in Patent Office: 1,481 Days
• Field of Search: 713/182, 713/200, 713/201, 707/1, 707/101, 707/103, 705/8, 705/9, 705/50, 705/76, 434/107, 434/118, 434/219, 434/350, 434/362
• US Class Current: 705/7.11
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99944 Object-oriented database structure

Abstract

The present invention provides a solution to the needs described above through an improved method and apparatus for an improved security system mechanism in a business applications management system platform. The security management system partitions a number of business objects into a number of hierarchical domains. A security list is then created and configured to grant a member the right to perform a security operation on the business object located within the hierarchical domain. The security list is created by adding the security operation to the security list, applying the security operation to one of the multiple domains, and adding members to the security list.

Claims

1. A method for managing security on a business application management platform implemented on a computer, comprising the steps of:

partitioning a plurality of business objects into a hierarchy of domains; and

creating a security list configured to grant a member the right to perform a security operation on a business object located in said hierarchy of domains, comprising the steps of;

adding said security operation to said security list;

applying said security operation to a given domain and to each child domain of the given domain; and

adding said member to said security list.

2. The method of claim 1, wherein said partitioned business objects are grouped together in specific categories and/or classes.

3. The method of claim 2, wherein said security operation is performed on said category or class of business objects.

4. The method of claim 1, wherein the right to perform said security operation is shared by more than one member.

5. The method of claim 1, wherein said security operation is assigned based on a customizable partitioning of said business objects into said plurality of hierarchical domains.

6. The method of claim 1, wherein said security operation is predefined to apply to all of said business objects located in said plurality of hierarchical domains.

7. The method of claim 1, wherein said security operation represents a group of one or more security operations.

8. The method of claim 1,

wherein said partitioned business objects are grouped together in specific categories and/or classes;

and

wherein at least one category and/or class of business objects defines additional security operations that can be performed on said business objects within said at least one category and/or class of business objects.

9. The method of claim 1, wherein said domains are partitioned based on geography, divisions, and/or business function.

10. The method of claim 1, wherein said security list is a global security list configured to apply across said hierarchy of domains.

11. The method of claim 1, wherein said member is an individual user, associated with a generic role, and/or associated with an automated process.

12. A computer security management system for managing security on a business application management platform, comprising:

a partitioning mechanism configured to partition a plurality of business objects into a hierarchy of domains;

a security list mechanism configured to create a security list, said security list comprising;

a security operation, wherein said security operation is applied to at least one of said plurality of domains and to all of the child domains of the at least one domain; and

a member, wherein said security list grants said member the right to perform said security operation in the at least one domain and in all of the child domains of the at least one domain.

13. The system of claim 12, wherein said partitioned business objects are grouped together in specific categories or classes.

14. The system of claim 13, wherein said security operation is performed on said category or class of business objects.

15. The system of claim 12, wherein the right to perform said security operation is shared by more than one member.

16. The system of claim 12, wherein said security operation is assigned based on a customizable partitioning of said business objects into said hierarchy of domains.

17. The system of claim 12, wherein said security operation is predefined to apply to all of said business objects located in said hierarchy of domains.

18. The system of claim 12, wherein said security operation represents a group of one or more security operations.

19. The system of claim 12,

wherein said partitioned business objects are grouped together in specific categories and/or classes;

and

wherein at least one category and/or class of business objects defines additional security operations that can be performed on said business objects within said at least one category and/or class of business objects.

20. The system of claim 12, wherein said domains are partitioned based on geography, divisions, and/or business function.

21. The system of claim 12, wherein said security list is a global security list and is configured to apply across said hierarchy of domains.

22. The system of claim 12, wherein said member is an individual user, associated with a generic role, and/or associated with an automated process.

23. A computer-readable storage medium containing computer executable code for implementing a security management system for managing security on a business application management platform by instructing a computer to operate as follows:

partition a plurality of business objects into a hierarchy of domains;

create a security list by further instructing the computer to operate as follows;

add a security operation to said security list;

apply said security list to at least one of said plurality of domains and to all child domains of the at least one domain; and

add said member to said security list, wherein said security list is configured to grant a member the right to perform said security operation in each domain to which it has been applied.

24. The computer-readable storage medium of claim 23, wherein said partitioned business objects are grouped together in specific categories or classes.

25. The computer-readable storage medium of claim 24, wherein said security operation is performed on said category or class of business objects.

26. The computer-readable storage medium of claim 23, wherein the right to perform said security operation is shared by more than one member.

27. The computer-readable storage medium of claim 23, wherein said security operation is assigned based on a customizable partitioning of said business objects into said hierarchy of domains.

28. The computer-readable storage medium of claim 23, wherein said security operation is predefined to apply to all of said business objects located in each domain.

29. The computer-readable storage medium of claim 23, wherein said security operation represents a group of one or more security operations.

30. The computer-readable storage medium of claim 23,

wherein said partitioned business objects are grouped together in specific categories and/or classes;

and

wherein at least one category and/or class of business objects defines additional security operations that can be performed on said business objects within said at least one category and/or class of business objects.

31. The computer-readable storage medium of claim 23, wherein said domains are partitioned based on geography, divisions, and/or business function.

32. The computer-readable storage medium of claim 23, wherein said security list is a global security list and is configured to apply across said hierarchy of domains.