System and method for managing application specific privileges in a content management system

• US 6,976,023 B2
• Filed: 04/23/2002
• Issued: 12/13/2005
• Est. Priority Date: 04/23/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wang, Yuping, Nelson, Kenneth Carlin, Yaung, Alan Tsu-I, Hu, Tawei, Choy, David Mun-Hien, Chen, An Feng-I, Lin, Jy-Jine James
• Primary Examiner(s): Mizrahi, Diane D.
• Application Number:
  US10/131,651
• Publication Number:
  US 20030200215A1
• Time in Patent Office: 1,330 Days
• Field of Search: 707 1- 10, 707/100, 707/103.R, 709/203, 709/225, 709/226, 709/227, 709/231, 713/201, 714/35, 714/38, 714/49, 717/101, 717/102, 717/100, 718/101
• US Class Current: 707/785
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

Access to system and user defined entities (objects, data items, or the like) is managed by a content manager. A privilege grants a user an ability to access system such controlled entities. An item is an atomic user data entity stored in the CM library server. A privileges table is used to store system and user defined privileges. A privilege is represented by a row in the table. Each privilege has a unique privilege code, with codes 0 to 999 reserved to store system-defined privileges and codes beyond 999 open for user-defined privileges thus allowing application specific privileges to be added without limit.

Claims

1. A computer-implemented method;

for managing privileges, comprising;

storing system defined and user defined privilege definition codes in a database table, with a first plurality of said codes reserved to said system defined privilege definition codes, and codes beyond said first plurality reserved to said user defined privilege definition codes; and

executing a database stored procedure selectively for adding, updating and deleting a user defined privilege.

2. The method of claim 1, further comprising:

responsive to a user request to add a new user defined privilege, determining a new definition code and inserting said new definition code into said database table;

responsive to a user request to update an existing user defined privilege, selectively updating a privilege definition name and privilege definition description; and

responsive to a user request to delete an existing privilege, verifying that said existing privilege is a user defined privilege code and deleting from said database table a row containing said user defined privilege code.

3. The method of claim 1, further comprising:

establishing for said user a user privilege code;

collecting into a privilege set at least one said privilege definition code;

coupling an access control list to a controlled entity, said access control list including for a user authorized to access said controlled entity a reference to said privilege set;

responsive to a request from said user to access said controlled entity for a specific function, allowing said user to access said controlled entity provided that said user privilege code and said privilege set for said user both authorize said specific function.

4. A computer-implemented system;

for managing privileges, comprising;

a data base table for storing system defined and user defined privilege definition codes, with a first plurality of said codes reserved to said system defined privilege definition codes, and codes beyond said first plurality reserved to said user defined privilege definition codes; and

a database stored procedure selectively for adding, updating and deleting a user defined privilege.

5. The system of claim 4, further comprising:

a content manager responsive to a user request to add a new user defined privilege for determining a new definition code and inserting said new definition code into said database table;

said content manager further responsive to a user request to update an existing user defined privilege for selectively updating a privilege definition name and privilege definition description; and

said content manager further responsive to a user request to delete an existing privilege for verifying that said existing privilege is a user defined privilege code and deleting from said database table a row containing said user defined privilege code.

6. The system of claim 4, further comprising:

a user table for storing for said user a user privilege code;

a privilege set table for collecting into a privilege set at least one said privilege definition code;

an access control list coupled to a controlled entity, said access control list including for a user authorized to access said controlled entity a reference to said privilege set;

said content manager further responsive to a request from said user to access said controlled entity for a specific function for allowing said user to access said controlled entity provided that said user privilege code and said privilege set for said user both authorize said specific function.

7. A computer-implemented;

computer-readable medium combining program instructions;

for managing privileges, said method comprising;

storing system defined and user defined privilege definition codes in a database table, with a first plurality of said codes reserved to said system defined privilege definition codes, and codes beyond said first plurality reserved to said user defined privilege definition codes; and

executing a database stored procedure selectively for adding, updating and deleting a user defined privilege.

8. The computer-readable medium;

program storage device of claim 7, comprising;

responsive to a user request to add a new user defined privilege, determining a new definition code and inserting said new definition code into said database table;

responsive to a user request to update an existing user defined privilege, selectively updating a privilege definition name and privilege definition description; and

responsive to a user request to delete an existing privilege, verifying that said existing privilege is a user defined privilege code and deleting from said database table a row containing said user defined privilege code.

9. The computer-readable medium;

device of claim 7, comprising;

establishing for said user a user privilege code;

collecting into a privilege set at least one said privilege definition code;

coupling an access control list to a controlled entity, said access control list including for a user authorized to access said controlled entity a reference to said privilege set;

responsive to a request from said user to access said controlled entity for a specific function, allowing said user to access said controlled entity provided that said user privilege code and said privilege set for said user both authorize said specific function.