Data access control techniques using roles and permissions

• US 20040006594A1
• Filed: 11/26/2002
• Published: 01/08/2004
• Est. Priority Date: 11/27/2001
• Status: Abandoned Application

• Current Assignee: First to File, Inc. (Clarivate Plc)
• Original Assignee: First to File, Inc. (Clarivate Plc)
• Inventors: Grainger, Jeffry J., Boyer, Stephen K., Snyder, Cecily Anne
• Application Number:
  US10/306,818
• Publication Number:
  US 20040006594A1
• Time in Patent Office: Days
• US Class Current: 709/204
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A computer-implemented technique for data access management system and providing access to information associated with legal cases including intellectual property cases. The data access management system allows individuals securing intellectual property rights to share data while ensuring that unauthorized access to data is not permitted. According to an embodiment of the present invention, techniques are provided for customizing data access per the user'"'"'s needs.

Claims

1. A computer-implemented method of controlling access to information related to a first intellectual property (IP) case, the method comprising:

storing information related to a plurality of intellectual property cases on a computer-readable medium, the plurality of intellectual property cases including the first intellectual property case, wherein for each intellectual property case, the information related to the intellectual property case is stored in a case data unit, wherein the case data unit stores data related to the intellectual property case and one or more documents related to the intellectual property case;

receiving a request from a first user to perform an operation on the information related to the first IP case;

responsive to receiving the request;

determining a first group to which the first user is assigned;

determining a second group to which a first case data unit storing information related to the first IP case is assigned;

determining one or more roles to which the first user is assigned, the one or more roles being associated with a set of permissions;

determining case data unit level access information for the first case data unit; and

determining if the first user can perform the operation on the information related to the first IP case based upon the first group to which the first user is assigned, the second group to which the first case data unit is assigned, the set of permissions associated with the one or more roles to which the user is assigned, and the case data unit level access information for the first case data unit.

2. The method of claim 1 wherein the plurality of intellectual property cases include patent cases and the first intellectual property case is a patent application case.

3. The method of claim 1 wherein the plurality of intellectual property cases includes trademark cases and copyright cases.

4. The method of claim 1 wherein the set of permission is selected from the group consisting of create, modify, delete, or view.

5. The method of claim 1 wherein the information related to a first intellectual property (IP) case is selected from the group consisting of specification/application, drawing, amendment response, form, declaration, petition, appeal brief, prior art/reference, correspondence, legal research, translation, and invention disclosure.

6. The method of claim 1 wherein the set of permission is selected from the group consisting of create mail, modify mail, delete mail, signature process, witness, annuity payment notification preference, annuity payment instructions, corm annuity payment, modify annuity payment confirmation, export annuity data, import annuity data, create annuity agents, modify annuity agents, delete annuity agents, get status from PAIR, purge case, create invention disclosure, modify invention disclosure, delete invention disclosure, publication, upload invention disclosure, create alert, view alert, setup alert, create case, modify case, delete case, create customer company, modify customer company, delete customer company, create/respond discussion, delete discussion, view discussion, docket, create ad hoc action, de-docket, delete docket, docketing rule, calculate patent term extension, file provisional patent application, file final patent application, create document entity, modify document entity, delete document entity, generate reports, setup automated reporting, internal searching, create URL for external search, modify URL for external search, delete URL for external search, view external URL, create individual, modify individual, delete individual, create entity, modify entity, delete entity.

7. The method of claim 1 wherein the first user can perform the operation on the information related to a first intellectual property (IP) case if the first user is assigned a first permission from the set permissions related to the operation and if the case data unit level access information permits the first user to perform the operation.

8. The method of claim 1 wherein the first user cannot perform the operation on the information related to a first intellectual property (IP) case if the first user is excluded by the case data unit level access information.

9. The method of claim 1 wherein the plurality of groups is organized as a hierarchy such that a group in the plurality of groups may contain one or more other groups in the plurality of groups.

10. The method of claim 1 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are the same group or if first group to which the first user is assigned contains the second group to which the first case data unit is assigned, and

if the set of permissions assigned to the first user includes a first permission for the operation, then

the operations on the information is permitted.

11. The method of claim 1 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if the set of permissions assigned to the first user does not include a first permission for the operation, then

the operation on the information is not permitted.

12. The method of claim 1 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if the first group to which the first user is assigned and the second group to which the first case data unit is assigned are not the same group or if first group to which the first user is assigned does not contain the second group to which the first case data unit is assigned, then,

the operation on the information is not permitted.

13. The method of claim 1 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP case, and

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are the same group or if first group to which the first user is assigned contains the second group to which the first case data unit is assigned, and

if the set of permissions assigned to the first user includes a first permission for the operation, then

the operations on the information is permitted.

14. A computer-implemented method of controlling access to information related to a first intellectual property (IP) case, the method comprising:

storing information related to a plurality of intellectual property cases on a computer-readable medium, the plurality of intellectual property cases including the first intellectual property case, wherein for each intellectual property case, the information related to the intellectual property case is stored in a case data unit, wherein the case data unit stores data related to the intellectual property case and one or more documents related to the intellectual property case;

receiving a request from a first user to perform an operation on the information related to the first IP case;

responsive to receiving the request;

determining a first group to which the first user is assigned;

determining a second group to which a first case data unit storing information related to the first IP case is assigned;

determining one or more roles to which the first user is assigned, the one or more roles being associated with a set of permissions;

determining case data unit level access information for the first case data unit; and

determining if the first user can perform the operation on the information related to the first IP case based the set of permissions associated with the one or more roles to which the user is assigned, and the case data unit level access information for the first case data unit.

15. The method of claim 14 wherein the first user can perform the operation on the information related to a first intellectual property (IP) case if the first user is assigned a first permission from the set permissions related to the operation and if the case data unit level access information permits the first user to perform the operation.

16. The method of claim 14 wherein the first user cannot perform the operation on the information related to a first intellectual property (IP) case if the first user is excluded by the case data unit level access information.

17. A computer-implemented method of controlling access to information related to a first intellectual property (IP) case, the method comprising:

storing information related to a plurality of intellectual property 5 cases on a computer-readable medium, the plurality of intellectual property cases including the first intellectual property case, wherein for each intellectual property case, the information related to the intellectual property case is stored in a case data unit, wherein the case data unit stores data related to the intellectual property case and one or more documents related to the intellectual property case;

receiving a request from a first user to perform an operation on the information related to the first IP case;

responsive to receiving the request;

determining a first group to which the first user is assigned;

determining a second group to which a first case data unit storing information related to the first IP case is assigned;

determining one or more roles to which the first user is assigned, the one or more roles being associated with a set of permissions;

determining case data unit level access information for the first case data unit; and

determining if the first user can perform the operation on the information related to the first IP case based upon the first group to which the first user is assigned, the second group to which the first case data unit is assigned, and the set of permissions associated with the one or more roles to which the user is assigned.

18. The method of claim 17 wherein

if the set of permissions assigned to the first user does not include a first permission for the operation, then

the operation on the information is not permitted.

19. The method of claim 17 wherein

if the first group to which the first user is assigned and the second group to which the first case data unit is assigned are not the same group, or

if first group to which the first user is assigned does not contain the second group to which the first case data unit is assigned, then

the operation on the information is not permitted.

20. The method of claim 17 wherein

if the first group to which the first user is assigned and the second group to which the first case data unit is assigned are the same group or if first group to which the first user is assigned contains the second group to which the first case data unit is assigned, and

if the set of permissions assigned to the first user includes a first permission for the operation, then

the operations on the information is permitted.

21. A computer-implemented method of controlling access to information related to a first intellectual property (IP) case, the method comprising:

storing information related to a plurality of intellectual property cases on a computer-readable medium, the plurality of intellectual property cases including the first intellectual property case, wherein for each intellectual property case, the information related to the intellectual property case is stored in a private folder associated with a case data unit, wherein the private folder stores data related to the intellectual property case and one or more documents related to the intellectual property case;

receiving a request from a first user to perform an operation on the information related to the first IP case;

responsive to receiving the request;

determining a first group to which the first user is assigned;

determining a second group to which a first private folder containing information related to the first IP case is assigned; and

determining if the first user can perform the operation on the information related to the first IP case based upon the first group to which the first user is assigned and the second group to which the first private folder is assigned.

22. The method of claim 21 wherein

if the second group to which the first user is assigned and the first group to which the private folder is assigned are the same group, then

the operation on the information related to an intellectual property (IP) case is permitted.

23. The method of claim 21 wherein

if the second group to which the first user is assigned is not the same group to which the private folder is assigned or if the second group to which the first user is assigned does not contain the first group to which the private folder is assigned, then

the operation on the information related to an intellectual property (IP) case is not permitted.

24. A computer program product stored on a computer readable medium for controlling access to information related to a first intellectual property (IP) case, the computer program product comprising:

code for storing information related to a plurality of intellectual property cases on a computer-readable medium, the plurality of intellectual property cases including the first intellectual property case, wherein for each intellectual property case, the information related to the intellectual property-case is stored in a case data unit, wherein the case data unit stores data related to the intellectual property case and one or more documents related to the intellectual property case;

code for receiving a request from a first user to perform an operation on the information related to the first IP case;

code for responsive to receiving the request;

code for determining a first group to which the first user is assigned;

code for determining a second group to which a first case data unit storing information related to the first IP case is assigned;

code for determining one or more roles to which the first user is assigned, the one or more roles being associated with a set of permissions;

code for determining case data unit level access information for the first case data unit; and

code for determining if the first user can perform the operation on the information related to the first IP case based upon the first group to which the first user is assigned, the second group to which the first case data unit is assigned, the set of permissions associated with the one or more roles to which the user is assigned, and the case data unit level access information for the first case data unit.

25. The computer program product of claim 24 wherein the plurality of intellectual property cases include patent cases and the first intellectual property case is a patent application case.

26. The computer program product of claim 24 wherein the plurality of intellectual property cases includes trademark cases and copyright cases.

27. The computer program product of claim 24 wherein the set of permission is selected from the group consisting of create, modify, delete, or view.

28. The computer program product of claim 24 wherein the information related to a first intellectual property (IP) case is selected from the group consisting of specification/application, drawing, amendment response, form, declaration, petition, appeal brief, prior art/reference, correspondence, legal research, translation, and invention disclosure.

29. The computer program product of claim 24 wherein the set of permission is selected from the group consisting of create mail, modify mail, delete mail, signature process, witness, annuity payment notification preference, annuity payment instructions, confirm annuity payment, modify annuity payment confirmation, export annuity data, import annuity data, create annuity agents, modify annuity agents, delete annuity agents, get status from PAIR, purge case, create invention disclosure, modify invention disclosure, delete invention disclosure, publication, upload invention disclosure, create alert, view alert, setup alert, create case, modify case, delete case, create customer company, modify customer company, delete customer company, create/respond discussion, delete discussion, view discussion, docket, create ad hoc action, de-docket, delete docket, docketing rule, calculate patent term extension, file provisional patent application, file final patent application, create document entity, modify document entity, delete document entity, generate reports, setup automated reporting, internal searching, create URL for external search, modify URL for external search, delete URL for external search;

view external URL, create individual, modify individual, delete individual, create entity, modify entity, delete entity.

30. The computer program product of claim 24 wherein the first user can perform the operation on the information related to a first intellectual property (IP) case if the first user is assigned a first permission from the set permissions related to the operation and if the case data unit level access information permits the first user to perform the operation.

31. The computer program product of claim 24 wherein the first user cannot perform the operation on the information related to a first intellectual property (IP) case if the first user is excluded by the case data unit level access information.

32. The computer program product of claim 24 wherein the plurality of groups is organized as a hierarchy such that a group in the plurality of groups may contain one or more other groups in the plurality of groups.

33. The computer program product of claim 24 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are the same group or if first group to which the first user is assigned contains the second group to which the first case data unit is assigned, and

if the set of permissions assigned to the first user includes a first permission for the operation, then

the operations on the information is permitted.

34. The computer program product of claim 24 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if the set of permissions assigned to the first user does not include a first permission for the operation, then

the operation on the information is not permitted.

35. The computer program product of claim 24 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is notpermitted by the case data unit level access

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are not the same group or if first group to which the first user is assigned does not contain the second group to which the first case data unit is assigned, then

the operation on the information is not permitted.

36. The computer program product of claim 24 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are the same group or if first group to which the first user is assigned contains the second group to which the first case data unit is assigned, and

if the set of permissions assigned to the first user includes a first permission for the operation, then

the operations on the information is permitted.

37. A system comprising a processor and a computer readable memory coupled to said processor, said computer-readable memory including computer instructions that:

storing information related to a plurality of intellectual property cases on a computer-readable medium, the plurality of intellectual property cases including the first intellectual property case, wherein for each intellectual property case, the information related to the intellectual property case is stored in a case data unit, wherein the case data unit stores data related to the intellectual property case and one or more documents related to the intellectual property case;

receiving a request from a first user to perform an operation on the information related to the first IP case;

responsive to receiving the request;

determining a first group to which the first user is assigned;

determining a second group to which a first case data unit storing information related to the first IP case is assigned;

determining one or more roles to which the first user is assigned, the one or more roles being associated with a set of permissions;

determining case data unit level access information for the first case data unit; and

determining if the first user can perform the operation on the information related to the first IP case based upon the first group to which the first user is assigned, the second group to which the first case data unit is assigned, the set of permissions associated with the one or more roles to which the user is assigned, and the case data unit level access information for the first case data unit.

38. The system of claim 37 wherein the plurality of intellectual property cases include patent cases and the first intellectual property case is a patent application case.

39. The system of claim 37 wherein the plurality of intellectual property cases includes trademark cases and copyright cases.

40. The system of claim 37 wherein the set of permission is selected from the group consisting of create, modify, delete, or view.

41. The system of claim 37 wherein the information related to a first intellectual property (IP) case is selected from the group consisting of specification/application, drawing, amendment response, form, declaration, petition, appeal brief, prior art/reference, correspondence, legal research, translation, and invention disclosure.

42. The system of claim 37 wherein the set of permission is selected from the group consisting of create mail, modify mail, delete mail, signature process, witness, annuity payment notification preference, annuity payment instructions, confirm annuity payment, modify annuity payment confirmation, export annuity data, import annuity data, create annuity agents, modify annuity agents, delete annuity agents, get status from PAIR, purge case, create invention disclosure, modify invention disclosure, delete invention disclosure, publication, upload invention disclosure, create alert, view alert, setup alert, create case, modify case, delete case, create customer company, modify customer company, delete customer company, create/respond discussion, delete discussion, view discussion, docket, create ad hoc action, de-docket, delete docket, docketing rule, calculate patent term extension, file provisional patent application, file final patent application, create document entity, modify document entity, delete document entity, generate reports, setup automated reporting, internal searching, create URL for external search, modify URL for external search, delete URL for external search, view external URL, create individual, modify individual, delete individual, create entity, modify entity, delete entity.

43. The system of claim 37 wherein the first user can perform the operation on the information related to a first intellectual property (IP) case if the first user is assigned a first permission from the set permissions related to the operation and if the case data unit level access information permits the first user to perform the operation.

44. The system of claim 37 wherein the first user cannot perform the operation on the information related to a first intellectual property (IP) case if the first user is excluded by the case data unit level access information.

45. The system of claim 37 wherein the plurality of groups is organized as a hierarchy such that a group in the plurality of groups may contain one or more other groups in the plurality of groups.

46. The system of claim 37 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are the same group or if first group to which the first user is assigned contains the second group to which the first case data unit is assigned, and

if the set of permissions assigned to the first user includes a first permission for the operation, then

the operations on the information is permitted.

47. The system of claim 37 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if the set of permissions assigned to the first user does not include a first permission for the operation, then

the operation on the information is not permitted.

48. The system of claim 37 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are not the same group or if first group to which the first user is assigned does not contain the second group to which the first case data unit is assigned, then

the operation on the information is not permitted.

49. The system of claim 37 wherein

if the first user is not excluded by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case and is not permitted by the case data unit level access information from performing the operation on the information related to a first intellectual property (IP) case, and

if first group to which the first user is assigned and the second group to which the first case data unit is assigned are the same group or if first group to which the first user is assigned contains the second group to which the first case data unit is assigned, and

if the set of permissions assigned to the first user includes a first permission for the operation, then

the operations on the information is permitted.