System and method for document isolation

• US 7,035,910 B1
• Filed: 06/29/2000
• Issued: 04/25/2006
• Est. Priority Date: 06/29/2000
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Dutta, Tanmoy, Naresh, Himani, Balikov, Alexander
• Primary Examiner(s): Follansbee, John
• Assistant Examiner(s): LIN, KENNY S
• Application Number:
  US09/607,170
• Time in Patent Office: 2,126 Days
• Field of Search: 709/218, 709/226, 709/225, 709/229, 709/217, 707/103, 707/10, 707/200, 707/8, 707/500, 707/9, 707/102, 707/203, 705/8, 713/201, 713/165, 715/733, 715/500
• US Class Current: 709/217
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: Y10S 707/99938 Concurrency, e.g. lock management in shared database

Abstract

A computer based system and method of providing document isolation during routing of a document through a workflow is disclosed. The method comprises maintaining a separate “working” copy of the original base document while the document is routed through a workflow. Access controls, which define who may access the original document as well as any versions of the working copy document, are defined and stored in relation to the documents. The access controls further define the types of actions users may take with respect to the document. Users are selectively directed to the appropriate document, either the base document or working copy, and selectively granted permission to perform publishing operations on the working copy document, as determined by the access controls.

Claims

1. A computer-implemented method for controlling access to documents during a workflow, comprising:

upon entry of a base document into a workflow, creating a workflow working copy of the base document;

receiving a request to access the base document by a user;

determining using the identity of the user if the user should be provided access to the workflow working copy of the base document;

providing the user access to the base document if it is not determined that the user should be provided access to the workflow working copy of the base document;

providing the user access to the workflow working copy of the base document if it is determined that the user should be provided access to the workflow working copy of the base document; and

if the user is provided access to the workflow working copy of the base document, selectively providing access to perform operations on the workflow working copy of the base document depending upon the identity of the user.

2. The method of claim 1, further comprising:

storing access control list data in relation to the base document, the access control list data defining access controls on performing operations of the workflow working copy of the base document; and

storing security descriptor data in relation to the base document and the workflow working copy of the base document, the security descriptor data defining access controls on reading the base document and the workflow working copy of the base document.

3. The method of claim 2, wherein selectively providing access to perform operations on the workflow working copy of the base document depending upon the identity of a user, comprises:

determining using the access control list data stored in relation to the base document that a user has permission to perform an operation on the workflow working copy of the base document; and

allowing the user to perform the operation on the workflow working copy of the base document.

4. The method of claim 2, wherein the step of selectively providing access to perform operations on the workflow working copy of the base document depending upon the identity of a user, comprises:

determining using the access control list data stored in relation to the base document that a user does not have permission to perform an operation on the workflow working copy of the base document; and

denying the user access to perform the operation on the workflow working copy of the base document.

5. The method of claim 2, wherein the access control list data comprises information identifying for each of a plurality of operations, the set of users that have permission to perform the operation, and said act of selectively providing access to perform operations on the workflow working copy of the base document depending upon the identity of a user, comprises:

referencing the information identifying for each of a plurality of operations, the set of users that have permission to perform the operation; and

if the user is in the set of users that have permission to perform the operation, providing access to the operation.

6. The method of claim 5, wherein the set of users are defined in terms of the roles that have permission to perform the operation, and said act of referencing the information identifying for each of a plurality of operations, the set of users that have permission to perform the operation, comprises:

resolving for the user the set of roles to which the user has been assigned; and

determining using the set of roles to which the user has been assigned and the set of users defined in terms of the roles that have permission to perform the operation, whether the user has permission to perform the requested operation.

7. The method of claim 2, wherein the access control list data comprises information identifying for each of a plurality of operations, the set of users that have permission to perform the operation, and said act of selectively providing access to perform operations on the workflow working copy of the base document depending upon the identity of a user, comprises:

referencing the information identifying for each of a plurality of operations, the set of users that have permission to perform the operation; and

if the user is not in the set of users that have permission to perform the operation, denying access to the operation.

8. The method of claim 2, wherein determining using the identity of the user if the user should be provided access to the workflow working copy of the base document, comprises:

determining using the security descriptor data stored in relation to the base document and the workflow working copy document, if the user has permission to read the workflow working copy of the base document.

9. The method of claim 2, wherein the security descriptor data comprises information identifying the set of users that have permission to read each of the base document and the workflow working copy of the base document, and said act of determining using the identity of the user if the user should be provided access to the workflow working copy of the base document, comprises:

referencing the information identifying the set of users that have permission to read the workflow working copy of the base document; and

determining if the user is in the set of users that have permission to read the workflow working copy of the base document.

10. The method of claim 9, wherein the set of users are defined in terms of the roles that have permission to read each of the base document and the workflow working copy of the base document, and said act of referencing the information identifying the set of users that have permission to read the workflow working copy of the base document, comprises:

resolving for the user the set of roles to which the user has been assigned; and

determining using the set of roles to which the user has been assigned and the set of roles that have permission to read the workflow working copy of the base document, whether the user has permission to read the workflow working copy of the base document.

11. A computer-readable media having stored thereon computer-executable instructions for performing the steps recited in claim 1.

12. The method of claim 1, further comprising replacing the base document with the working workflow document upon exit of the base document from the workflow.

13. A system for providing document isolation in a workflow environment, comprising:

a processor, wherein said processor is operable to execute instructions for performing the following acts;

maintaining for a base document undergoing a publishing workflow, a workflow copy of the base document;

maintaining access control data in relation to the base document and the workflow copy of the base document,

upon receipt of a request to access the base document, determining based on the access control data if access should be provided to the workflow copy of the base document; and

providing access to the workflow copy of the base document if it determined that access should be provided to the workflow copy of the base document; and

providing access to the base document if it is determined that access should not be provided to the workflow copy of the base document.

14. The system of claim 13, wherein the access control data comprises security descriptor data identifying the set of users that have permission to read the base document and the workflow copy of the base document, the set of users comprising reviewers and approvers.

15. The system of claim 14, wherein said processor is operable to execute instructions for performing the following acts:

referencing the security descriptor data; and

determining that a user should be provided access to the workflow copy of the base document based on the security descriptor data.

16. The system of claim 15, wherein the security descriptor data identifies a set of roles corresponding to the set of users that have permission to read the base document and the workflow copy of the base document, and wherein said processor is operable to execute instructions for performing the act of determining the set of roles that a user has been assigned.

17. The system of claim 13, wherein the access control data comprises access control list data identifying the set of users that have permission to perform operations on the workflow copy of the base document.

18. The system of claim 17, wherein said processor is operable to execute instructions for performing the following acts:

referencing the access control list data; and

determining that a user should be allowed to perform an operation on the workflow copy of the base document based on the access control list data.

19. The system of claim 18, wherein the access control list data identifies a set of roles corresponding to the set of users that have permission to perform operations on the workflow copy of the base document, and wherein said processor is operable to execute instructions for performing the act of determining the set of roles that a user has been assigned.

20. The system of claim 13, further comprising upon exit of the base document from the workflow replacing the base document with the workflow copy of the base document.