Method, an apparatus, a computer system, a security component and a computer readable medium for defining access rights in metadata-based file arrangement

• US 20120078965A1
• Filed: 09/29/2010
• Published: 03/29/2012
• Est. Priority Date: 09/29/2010
• Status: Active Grant

• Current Assignee: M-Files Oy
• Original Assignee: Motive Systems Incorporated
• Inventors: Laitkorpi, Markku, Nivala, Antti, Lepola, Juha, Partanen, Timo, Metsäpelto, Ari
• Granted Patent: US 8,996,575 B2
• Time in Patent Office: Days
• US Class Current: 707/785
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/51 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy

Abstract

The invention relates to a method for a computer system storing electronic objects being defined by metadata items. The method comprises deriving access rights from one or more security components originating from respective metadata items of at least one object, and determining the effective access rights for the object by means of the security components. The invention also relates to a method for a computer system storing electronic objects being defined by metadata items, wherein access rights for an object are determined by means of one or more pseudo-users. The invention also relates to an apparatus, a computer system and a computer readable medium comprising a computer program stored therein for carrying out the methods.

Claims

1. A method for a computer system storing electronic objects being defined by metadata items, comprising:

deriving access rights from one or more security components originating from respective metadata items of at least one object, and

determining the effective access rights for the object by means of the security components.

2. The method according to claim 1, wherein an object refers to the object'"'"'s own access control list, wherein the effective access rights for the said object are determined by means of security components as part of the object'"'"'s own access control list.

3. The method according to claim 1, wherein a security component originates directly from the object'"'"'s metadata item.

4. The method according to claim 1, wherein a security component originates indirectly from the object'"'"'s metadata item.

5. The method according to claim 4, wherein the security component originates from a metadata item of more than one cascaded object.

6. The method according to claim 1, further comprising:

combining more than one security components, wherein the effective access rights are determined as an intersection of more than one security components.

7. The method according to claim 1, further comprising:

combining more than one security components, wherein the effective access rights are determined according to one of the following rules;

one overrides the others, each supplements the effective access rights, one restricts the others, one defines the maximum rights, one defines the minimum rights, or any combination of those.

8. The method according to claim 1, further comprising defining access rights by means of pseudo-users in said security component.

9. The method according to claim 8, further comprising:

identifying the persons being allowed to access the document by resolving pseudo-users from the metadata items of the object.

10. The method according to claim 8, further comprising:

identifying the persons being allowed to access the document by resolving pseudo-users from the metadata items of more than one cascaded object.

11. An apparatus comprising a processor, memory including computer program code, the memory and the computer program code configured to, with the processor, cause the apparatus to perform at least the following:

storing electronic objects being defined by metadata items,

deriving access rights from one or more security components originating from respective metadata items of at least one object, and

determining the effective access rights for the object by means of the security components.

12. The apparatus according to claim 11, wherein an object refers to the object'"'"'s own access control list, wherein the effective access rights for the said object are determined by means of security components as part of the object'"'"'s own access control list.

13. The apparatus according to claim 11, wherein a security component originates directly from the object'"'"'s metadata item.

14. The apparatus according to claim 11, wherein a security component originates indirectly from the object'"'"'s metadata item.

15. The apparatus according to claim 14, wherein the security component originates from a metadata item of more than one cascaded object.

16. The apparatus according to claim 11, further comprising computer program code configured to, with the processor, cause the apparatus to perform at least the following:

combining more than one security component, wherein the effective access rights are determined as an intersection of more than one security component.

17. The apparatus according to claim 11, further comprising computer program code configured to, with the processor, cause the apparatus to perform at least the following:

combining the more than one security component, wherein the effective access rights are determined according to one of the following rules;

one overrides the others, each supplements the effective access right, one restricts the others, one defines the maximum rights, one defines the minimum rights, or any combination of those.

18. The apparatus according to claim 11, wherein the security component is configured to define access rights by means of pseudo-users.

19. The apparatus according to claim 18, further comprising computer program code configured to, with the processor, cause the apparatus to perform at least the following:

identifying the persons being allowed to access the document by resolving pseudo-users from the metadata items of the object.

20. The apparatus according to claim 18, further comprising computer program code configured to, with the processor, cause the apparatus to perform at least the following:

identifying the persons being allowed to access the document by resolving pseudo-users from the metadata items of more than one cascaded object.

21. A computer system comprising:

at least one processor,

at least one memory including computer program code,

the memory and the computer program code configured to, with said at least one processor, cause the computer system at least to perform;

storing electronic objects being defined by metadata items,

deriving access rights from one or more security components originating from respective metadata items of at least one object, and

determining the effective access rights for the object by means of the security components.

22. The computer system according to claim 21, further comprising a client and a server.

23. A computer readable medium comprising computer program instructions stored thereon, wherein said instructions, when executed, are for

storing electronic objects being defined by metadata items,

deriving access rights from one or more security components originating from respective metadata items of at least one object, and

determining the effective access rights for the object by means of the security components.

24. A method for a computer system storing electronic objects being defined by metadata items, comprising:

determining access rights for an object by means of one or more pseudo-users.

25. The method according to claim 24, further comprising:

identifying the persons being allowed to access the document by resolving pseudo-users from the metadata items of the object.

26. The method according to claim 24, further comprising:

identifying the persons being allowed to access the document by resolving pseudo-users from the metadata items of more than one cascaded object.

27. The method according to claim 24, further comprising retrieving said access rights from at least one security component being referred by a metadata item of the object.

28. The method according to claim 27, wherein an object refers to the object'"'"'s own access control list, wherein the effective access rights for the said object are determined by means of security components as part of the object'"'"'s own access control list.

29. A computer readable medium comprising computer program instructions stored thereon, wherein said instructions, when executed, are for

determining access rights for an object by means of one or more pseudo-users