Method for implementing access control for queries to a content management system
First Claim
1. A processor-implemented method for implementing access control for a query to a content management system that includes a content management server, the method comprising:
- a user processor transmitting the query to the content management server;
wherein the user processor is remotely located relative to the content management server to prevent user access to the content management server and to prevent the bypass of the security of the content management server;
at the content management server;
parsing the query into a plurality of portions;
creating an access control logic string for the query according to an access control privilege information of a user, wherein the access control logic string is query language that prohibits an unauthorized user from accessing restricted data;
inserting the access control logic string in each portion of the query that has been parsed to generate a dynamic query, wherein the dynamic query is a result of adding the access control logic string to each of the plurality of portions of the query;
executing the dynamic query; and
generating a secure query result.
2 Assignments
0 Petitions
Accused Products
Abstract
A method to generate an SQL sub-expression that implement access control rules stored in a library server. The SQL sub-expression is then merged with the SQL passed from an application program interface (API). The access control checking mechanism is implemented on the server side of the content management system. In this client/server environment, the query SQL statement is built in two layers: the API (client) layer and the server layer. The API sends the query string to the underlying stored procedure. The stored procedure then generates the access control logic based on the configuration parameters of the library server. This access control logic is dynamically added to the query string sent by the API. The stored procedure prepares, builds and executes this new query string as a dynamic SQL statement.
65 Citations
2 Claims
-
1. A processor-implemented method for implementing access control for a query to a content management system that includes a content management server, the method comprising:
-
a user processor transmitting the query to the content management server;
wherein the user processor is remotely located relative to the content management server to prevent user access to the content management server and to prevent the bypass of the security of the content management server;at the content management server; parsing the query into a plurality of portions; creating an access control logic string for the query according to an access control privilege information of a user, wherein the access control logic string is query language that prohibits an unauthorized user from accessing restricted data; inserting the access control logic string in each portion of the query that has been parsed to generate a dynamic query, wherein the dynamic query is a result of adding the access control logic string to each of the plurality of portions of the query; executing the dynamic query; and generating a secure query result. - View Dependent Claims (2)
-
Specification