System and method for providing security in a communities framework

• US 20070113187A1
• Filed: 02/28/2006
• Published: 05/17/2007
• Est. Priority Date: 11/17/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Patadia, Jalpesh, Beartusk, Brodi, McMullen, Cindy, Griffin, Philip
• Granted Patent: US 8,185,643 B2
• Time in Patent Office: Days
• US Class Current: 715/742
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Systems and methods are disclosed for providing security for a communities framework in a collaborative computing environment. A community can be provided for maintaining user membership during collaboration. The community can contain various collaboration resources, community services and members having access to the resources and services. A first layer of security can be implemented via membership and functional capabilities. Members can be assigned to various membership capabilities and these membership capabilities can be mapped to functional capabilities in order to control access to the resources by the various members. A second layer of security can be implemented via entitlements and security policies applied to the content repository. Entitlements can be applied at a node level of a content repository. Each node can be evaluated when operations are requested for it.

Claims

1. A system for providing security in a collaborative computing environment, comprising:

a server that provides a portal to a community which maintains user membership in the collaborative computing environment, said community comprised of one or more members;

a repository accessed via the portal and containing one or more resources wherein the members can access and share the resources;

a membership capability assigned to the one or more members;

a functional capability mapped to the membership capability wherein the functional capability defines operations that the members assigned to the membership capability are allowed to perform; and

wherein the mapped membership and functional capabilities control user access to the repository.

2. The system of claim 1 wherein the membership capability defines a selected group of members of the community having the same access rights to the repository.

3. The system of claim 1 further comprising:

an entitlement associated with the resource for controlling member access to the resource within the repository.

4. The system of claim 3 wherein the repository contains data stored in nodes, each node wrapped by a content object for representing the type of resource which the node contains data for.

5. The system of claim 4 wherein the entitlement is a security policy associated with the node for granting and denying access to the node.

6. The system of claim 3 further comprising:

a content role including a set of rules for granting and denying access to the resource based on its entitlement.

7. The system of claim 3 wherein the resource has at least one of private, personal and community visibilities to the one or more members.

8. The system of claim 7 wherein the entitlement is based at least partly on the visibility of the resource.

9. The system of claim 1 wherein definition of the membership capability is scoped to the community or to an application.

10. The system of claim 1 further comprising:

a community property for storing data associated with the community, including storing definitions of the membership capability and the functional capability.

11. The system of claim 1 wherein the functional capability specifies actions that the one or more members assigned to the membership capability are allowed to perform.

12. The system of claim 1 wherein the functional capability and the membership capability are capable of being edited by the one or more members.

13. The system of claim 1 wherein the functional capability is hierarchically related to other functional capabilities within the community and inherits all capabilities of its children located hierarchically beneath it.

14. The system of claim 1 wherein the one or more members are precluded from getting to the repository level if access is denied by the functional capability.

15. A system for providing two levels of security for a communities framework, comprising:

a community that maintains user membership in the collaborative computing environment, said community comprising one or more members;

a first level of security, comprising;

a membership capability assigned to the one or more members;

a functional capability mapped to the membership capability for controlling access to a repository, the repository including at least one resource;

a second level of security, comprising;

an entitlement associated with the resource for providing user access to the resource.

16. The system of claim 15 wherein a user is precluded from accessing the repository if the functional capability denies access based on the user'"'"'s membership.

17. The system of claim 15 further comprising:

a content role for specifying a set of rules for granting and denying access to the resource based on the entitlement.

18. The system of claim 17 wherein a user is precluded from accessing the resource if the user does not fit the content role based on its rules as enforced by the entitlement.

19. The system of claim 15 wherein resource data is contained in a node within the repository, the node being wrapped by a content wrapper object.

20. The system of claim 15 further comprising:

a community property containing community data, including definitions of the functional capability and the membership capability.

21. A method of providing security for a collaborative computing environment, comprising:

providing a community for maintaining user membership in the collaborative computing environment, said community comprising one or more members;

assigning the one or more members to a membership capability;

mapping the membership capability to a functional capability for controlling access to a repository.

22. The method of claim 21 wherein the repository includes at least one resource.

23. The method of claim 22 further comprising:

associating an entitlement with the resource for controlling user access to the resource within the repository.

24. The method of claim 23 wherein resource data is stored in a node located within the repository, said node being wrapped by a resource wrapper object.

25. The method of claim 24 wherein the entitlement is a security policy associated with the node for granting and denying access to the node.

26. The method of claim 23 further comprising:

providing a content role including a set of rules for granting and denying access to the resource based on its entitlement.

27. The method of claim 23 wherein the resource has at least one of private, personal and community visibilities to the one or more members.

28. The method of claim 27 wherein the entitlement is based at least partly on the visibility of the resource.

29. The method of claim 21 wherein definition of the membership capability is scoped to the community or to an application.

30. The method of claim 21 further comprising:

providing a community property for storing data associated with the community, said data including definitions of the membership capability and the functional capability.

31. The method of claim 21 wherein the functional capability specifies actions that the one or more members assigned to the membership capability are allowed to perform.

32. The method of claim 21 wherein the functional capability and the membership capability are capable of being edited by the one or more members.

33. The method of claim 21 wherein the functional capability is hierarchically related to other functional capabilities within the community and inherits all capabilities of its children located hierarchically beneath it.

34. The method of claim 21 wherein the one or more members are precluded from getting to the repository level if access is denied by the functional capability.

35. A computer-readable medium having instructions stored thereon that when executed by one or more processors cause a system to:

provide a community for maintaining user membership in the collaborative computing environment, said community comprising one or more members;

assign the one or more members to a membership capability;

map the membership capability to a functional capability for controlling access to a repository.