Method and system for interacting with a virtual content repository

• US 7,752,205 B2
• Filed: 08/04/2006
• Issued: 07/06/2010
• Est. Priority Date: 09/26/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Zhou, Xiaojiang, McVeigh, Ryan Sean, Posner, Brad, Saarva, Tanya, Patadia, Jalpesh, Roth, Steven Leslie
• Primary Examiner(s): Trujillo; James
• Assistant Examiner(s): Casanova; Jorge A
• Application Number:
  US11/499,114
• Publication Number:
  US 20070073671A1
• Time in Patent Office: 1,432 Days
• Field of Search: 707/5, 707/10, 707/102, 707/104.1, 707/202, 707/999.005, 707/999.102, 707/999.104, 707/999.202, 707/736, 707/781, 726/2
• US Class Current: 707/736
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 21/6236 between heterogeneous systems

Abstract

In accordance with embodiments, there are provided mechanisms and methods for providing content management security to federated content repositories in a content management system and for interacting with a virtual content repository. These mechanisms and methods can enable embodiments to provide secure access to repositories based upon policies defined at a federated repository level and to secure repository access at the federated level based upon policies defined for differing classes of users. These abilities of embodiments can enable users to create services and applications by integrating content from unsecured repositories.

Claims

1. A method for interacting with a virtual content repository in a content management system, the method comprising:

providing a virtual content repository (VCR) with a plurality of content repositories, wherein the VCR is capable of modeling content in the plurality of content repositories and providing uniform content services;

providing, via the VCR, a federal level security mechanism and a repository level security mechanism, wherein the federal level security mechanism is associated with each content repository of the plurality of content repositories and is based on one or more federal level security policies that are defined for differing classes of users that can access content in the VCR, and wherein the repository level security mechanism can be associated with at least a first content repository in the VCR, but not associated with a second content repository in the VCR;

receiving, via a common Application Programming Interface (API), a request to access content stored in the VCR;

preparing a result set from the VCR responsive to the request after applying the federal level security mechanism, wherein the result set includes content from both the first content repository and the second content repository that satisfy the one or more federal level security policies;

applying the repository level security mechanism to the result set, wherein the repository level security mechanism is associated with a repository level security policy;

redacting the result set received from the VCR to exclude the portion of the result set that is returned by the first content repository, prior to providing access to content in the result set, when the request does not satisfy the repository level security policy; and

providing access to content in the VCR when the request satisfies the repository level security policy.

2. The method of claim 1, wherein the receiving step, includes:

receiving, the request to access content stored in at least one of a plurality of content repositories from at least one of an administrator and a user.

3. The method of claim 1, further comprising:

determining based upon the classification of the request that the request is an administrative request; and

selecting a security policy to apply to the administrative request;

wherein the security policy to apply to the administrative request is based upon a default administrative security policy that bars access to content within the VCR except for explicitly stated exceptions permitting access to specific content in the VCR.

4. The method of claim 1, further comprising:

determining based upon the classification of the request that the request is a user request; and

selecting a security policy to apply to the user request;

wherein the security policy to apply to the user request is based upon a default user security policy that permits access to content within the VCR except for explicitly stated exceptions baring access to specific content in the VCR.

5. The method of claim 1, wherein providing access to content in the VCR when the request satisfies the selected security policy includes:

enabling at least one of navigation, CRUD operations (create, read, update, delete), versioning, workflows, and searching operations to operate on a plurality of repositories as though the plurality of repositories were one repository.

6. The method of claim 1, further comprising:

redacting the request prior to accessing content in the VCR when the request does not satisfy a selected security policy.

7. The method of claim 1, further comprising:

determining whether the request will be permitted by applying a selected security policy to a result set returned by the VCR that is responsive to the request; and

blocking the request altogether when the request does not satisfy the selected security policy.

8. The method of claim 1, further comprising creating a security policy when a new content repository is created within the VCR and attaching the security policy to the new content repository.

9. A machine-readable storage medium storing one or more sequences of instructions for interacting with a virtual content repository in a content management system, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

providing a virtual content repository (VCR) with a plurality of content repositories, wherein the VCR is capable of modeling content in the plurality of content repositories and providing uniform content services;

providing, via the VCR, a federal level security mechanism and a repository level security mechanism, wherein the federal level security mechanism is associated with each content repository of the plurality of content repositories and is based on one or more federal level security policies that are defined for differing classes of users that can access content in the VCR, and wherein the repository level security mechanism can be associated with at least a first content repository in the VCR, but not associated with a second content repository in the VCR;

receiving, via a common Application Programming Interface (API), a request to access content stored in the VCR;

preparing a result set from the VCR responsive to the request after applying the federal level security mechanism, wherein the result set includes content from both the first content repository and the second content repository that satisfy the one or more federal level security policies;

applying the repository level security mechanism to the result set, wherein the repository level security mechanism is associated with a repository level security policy;

redacting the result set received from the VCR to exclude the portion of the result set that is returned by the first content repository, prior to providing access to content in the result set, when the request does not satisfy the repository level security policy; and

providing access to content in the VCR when the request satisfies the repository level security policy.

10. The machine-readable storage medium as recited in claim 9, wherein the instructions for carrying out the receiving step, further include instructions for carrying out the step of:

receiving, the request to access content stored in at least one of a plurality of content repositories from at least one of an administrator and a user.

11. The machine-readable storage medium as recited in claim 9, further comprising instructions for carrying out the steps of:

determining based upon the classification of the request that the request is an administrative request; and

selecting a security policy to apply to the administrative request;

wherein the security policy to apply to the administrative request is based upon a default administrative security policy that bars access to content within the VCR except for explicitly stated exceptions permitting access to specific content in the VCR.

12. The machine-readable storage medium as recited in claim 9, further comprising instructions for carrying out the steps of:

determining based upon the classification of the request that the request is a user request; and

selecting a security policy to apply to the user request;

wherein the security policy to apply to the user request is based upon a default user security policy that permits access to content within the VCR except for explicitly stated exceptions baring access to specific content in the VCR.

13. The machine-readable storage medium as recited in claim 9, wherein the instructions for carrying out the step of providing access to content in the VCR when the request satisfies the selected security policy include instructions for carrying out the step of:

enabling at least one of navigation, CRUD operations (create, read, update, delete), versioning, workflows, and searching operations to operate on a plurality of repositories as though the plurality of repositories were one repository.

14. The machine-readable storage medium as recited in claim 9, further comprising instructions for carrying out the step of:

redacting the request prior to accessing content in the VCR when the request does not satisfy a selected security policy.

15. The machine-readable storage medium as recited in claim 9, further comprising instructions for carrying out the steps of:

determining whether the request will be permitted by applying a selected security policy to a result set returned by the VCR that is responsive to the request; and

blocking the request altogether when the request does not satisfy the selected security policy.

16. An apparatus for interacting with a virtual content repository in a content management system, the apparatus comprising:

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

providing a virtual content repository (VCR) with a plurality of content repositories, wherein the VCR is capable of modeling content in the plurality of content repositories and providing uniform content services;

providing, via the VCR, a federal level security mechanism and a repository level security mechanism, wherein the federal level security mechanism is associated with each content repository of the plurality of content repositories and is based on one or more federal level security policies that are defined for differing classes of users that can access content in the VCR, and wherein the repository level security mechanism can be associated with at least a first content repository in the VCR, but not associated with a second content repository in the VCR;

receiving, via a common Application Programming Interface (API), a request to access content stored in the VCR;

preparing a result set from the VCR responsive to the request after applying the federal level security mechanism, wherein the result set includes content from both the first content repository and the second content repository that satisfy the one or more federal level security policies;

applying the repository level security mechanism to the result set, wherein the repository level security mechanism is associated with a repository level security policy;

redacting the result set received from the VCR to exclude the portion of the result set that is returned by the first content repository, prior to providing access to content in the result set, when the request does not satisfy the repository level security policy; and

providing access to content in the VCR when the request satisfies the repository level security policy.