Patent Application
20050021977
The present invention relates generally to computer security, and more particularly, to the prevention of access to content stored on a computer by unauthorized individuals.
Lack of security exposes computer systems to accidental mischief or intentional harm. Accidental mischief may innocently come from a child who somehow gains access to his parents' personal computer to cause physical loss of data, among other examples. Intentional harm is typically instigated by a “cracker,” which is a dysphemism for a person who uses computer expertise for illicit ends, such as by gaining access to computer systems without permission and tampering with programs and data. It is easy to eliminate most computer security problems—just unplug computer systems from all external communications. But this is no longer the way of doing business (if it has ever been) for many companies, especially with the quickening pace of pushing commerce to the Internet. Thus, a major focus of computer security, especially on systems that are accessed by many people through communication lines, is the prevention of system access by unauthorized individuals.
A simple security model includes three elements: a user (who must be recognized by a computer system as an authorized user of the computer system); a piece of content that is desired by the user to view or alter, among other things; and a permission to access the piece of content by the user. This model is simple in theory but complicated for a system administrator to put into practice. Consider a situation in which a million users all want access to the piece of content. The model described above would force a system administrator to create and store a million different permissions, each corresponding with the million users, to limit access to the piece of content. Thus, more computing resources must be used-not to store content, but to process and store permissions. Not only is this economically unfeasible but the “permission explosion” itself may cripple the computer system without any undertaking by crackers.
To avoid administrative problems associated with permission explosion, an industry standard security model called role-based access control (RBAC) was developed. In role-based access control, a system administrator programmatically assigns roles to different types of users within an organization, such as a hospital's various staffs, and permissions to secured pieces of content are granted to those assigned roles. Because there are fewer roles than there are users (multiple users may have the same role, such as a nurse role), permission explosion is avoided. A user receives permission through the role he is assigned. A user can have multiple roles, hence indirectly gaining multiple permissions to access content in a computer system. A role can inherit the characteristics of other roles so that a user with an inheriting role also gets all the permissions granted to the inherited role. Although the role-based access control model eliminates administrative problems associated with permission explosion, it creates new administrative problems, namely those associated with “role explosion.”
Consider the following explicit role inheritances: the Irish are Europeans (an Irish role inherits from a European role), and ophthalmologists are surgeons (an ophthalmologist role inherits from a surgeon role) who are doctors (a surgeon role inherits from a doctor role). If the system administrator needs to add just one complex role: “Dr. Murphy is an Irish ophthalmologist,” this would require the system administrator to create from such a complex role many implied roles: Irish, European, ophthalmologist, surgeon, doctor, Irish ophthalmologist, Irish surgeon, Irish doctor, European ophthalmologist, European surgeon, and European doctor.
Only 11 implied roles are created from the example above, but there are situations that require the system administrator to create and painfully maintain thousands of roles so as to allow users to access pieces of content that are available only for an esoteric role. In practice, the system administrator compromises the security requirements of a company to prevent prohibitive administration costs and errors in the maintenance of roles. Another problem comes whenever a new piece of content is added to the computer system with its unique security requirements. The system administrator not only has to create a new role to represent the unique security requirements of the new piece of content, but he also needs to create a relationship between the new piece of content and the new role as well as create multiple relationships (possibly thousands) with existing roles. In practice, the system administrator avoids unearthing existing roles to understand how the new role fits the existing roles, and instead, likely add the new role in an ad hoc manner without considering the wider security implications of accommodating the new piece of content which allows him to move on with his business.
A system 100 in
The system 100 includes a user 102, who is Dr. Murphy, the surgeon; a user 104, who is a nurse; and a user 106, who is a CT scan technician. Users 102-106 are all employees of the hospital 120. Employees can gain entry to the hospital 120 via electronic card access (not shown). Using the role-based access control model, users 102-106 can inherit the role of employee (role 108). Role 108 has privileges, which include hospital entrance permission (permission 114). Because users 102-106 have the role of employee (role 108), users 102-106 can gain entry to the hospital 120 by waving their electronic cards near an electronic detector so as to allow the system 100 to verify their roles, hence granting them permission to enter.
Suppose that the hospital 120 procures eye laser equipment 122. Only authorized users with the appropriate training may access and use the eye laser equipment 122 (which has a computer system to which a user must log on to operate the eye laser equipment 122). One such user is the user 102 (Dr. Murphy, the surgeon). However, the role-based access model prohibits permitting of a specific user to have access to a specific piece of content (so as to avoid permission explosion). Instead of trying to understand existing roles in the system 100, a system administrator of the hospital 120 fabricates a new role of “Dr. Murphy, the surgeon” (role 110) so as to allow only the user 102 (Dr. Murphy, the surgeon) to use the eye laser equipment. The problem, however, is that role 110 is not a role at all. If there were a thousand doctors, each doctor would require his own role, thereby creating permission explosion again.
Now suppose the hospital 120 were to procure new CT scan equipment 124. The CT scan equipment 124 has a computer to which a user must log on in order to operate the CT scan equipment 124. Only authorized users of the hospital 120 are allowed to access and use the CT scan equipment 124. Instead of trying to understand the existing roles at the hospital 120, the system administrator creates the role of a CT scan machine (role 112), which is associated with permission 118, allowing access to user 104, the nurse, and 106, the CT scan technician. The fabricated role of the CT scan machine (role 112), however, makes no sense at all within the role-based access control model because it does not identify a group of users within an organization, but instead, identifies a machine for the convenience of the system administrator. This non-representative role 102 attenuates the security strength of the system 100 over time because system administrators have increasingly difficult time understanding various role relationships which causes difficulty in managing authorized users and eliminating unauthorized access.
The problems described above are made more severe with the desire of many companies to expose corporate content to business partners and customers over the Internet. For example, the hospital 120 may allow a patient to view his hospital bills on-line from his home. Given the problems encountered maintaining content security within an organization with a relative few number of users, it will come as no surprise that exposing corporate computing assets to the world causes role explosion to an exponential degree, consuming time, introducing error, and sapping performance while rendering information to users both internally and externally. Without a resolution to the problem of role explosion, users may eventually no longer trust the system 100 to provide a secured computing experience that can allow quick access to content by authorized users while preventing access to content by unauthorized individuals. Thus, there is a need for a system, method, and computer-readable medium for securing information while avoiding or reducing the above problems associated with existing systems.
In accordance with this invention, a system, method, and computer-readable medium for evaluating access requests of users is provided. A computer-readable medium form of the invention includes a computer-readable medium having a data structure stored thereon for use by a computing system to evaluate an access request of a user. The data structure comprises a content class that is indicative of a piece of content; a permission class that is indicative of access privileges to the piece of content; and an expressed role class associated with the permission class. The expressed role class has one attribute representing an expression of the access scope of the expressed role class and another attribute representing a type of the expression. The type of the expression includes a set of elements.
In accordance with further aspects of this invention, a computer-readable medium form of the invention includes a computer-readable medium having a data structure stored thereon for use by a computing system to evaluate an access request of a user. The data structure comprises a permission class that is indicative of access privileges to a piece of content; and an accessor class associated with the permission class. The accessor class represents an access scope of the piece of content.
In accordance with further aspects of this invention, a system form of the invention includes a networked system for evaluating an access request of a user. The networked system comprises a user account representing the user accessing the networked system. The user account includes a user access scope expressed by a first expression for a security space; and a piece of content including a content access scope defined by a second expression for the security space. The user is granted access to the piece of content when the user access scope overlaps with the content access scope.
In accordance with further aspects of this invention, a method form of the invention includes a computer-executable method for forming an access scope of a user or a piece of content. The method comprises forming a security space with dimensions, each including a set of members; representing a dimension extent as a dimension with a subset of the set of members; and representing the access scope by a number of dimension extents, each dimension extent being logically conjoined or disjoined with another dimension extent.
In accordance with further aspects of this invention, a system form of the invention includes a computer system for evaluating an access request by a user. The computer system comprises a sentence compiler for compiling textual sentences into binary sentences, each sentence including binary phrases; and an access evaluator for comparing two binary sentences by logically ANDing each binary phrase of a first binary sentence and each corresponding binary phrase of a second binary sentence. The access evaluator grants access when the access scope of the first binary sentence overlaps the access scope of the second binary sentence.
In accordance with further aspects of this invention, a method form of the invention includes a computer-implemented method for evaluating the scope of a content access request by a user. The method comprises expressing an access scope for a piece of content by a content sentence; expressing an access scope for the user by an accessor sentence; and evaluating whether to grant or deny the content access request of the user by comparing the access scope as expressed by the content sentence and the access scope as expressed by the accessor sentence to determine whether there is an overlap.
The foregoing aspects and many of the attendant advantages of this invention will become more readily appreciated as the same become better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein:
The invention is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments and/or configurations that may be suitable for use with the invention include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
The invention is described in the general context of computer-executable instructions, such as program modules being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including memory storage devices.
The computing system environment illustrated in
Computer 210 typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by computer 210 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer-readable media may comprise computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other computer storage media. Communication media typically embody computer-readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism that includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media include wired media, such as a wired network or direct-wired connection, and wireless media, such as acoustic, RF infrared, and other wireless media. A combination of any of the above should also be included within the scope of computer-readable media.
The system memory 230 includes computer storage media in the form of volatile and/or nonvolatile memory, such as read only memory (ROM) 231 and random access memory (RAM) 232. A basic input/output system 233 (BIOS), containing the basic routines that help to transfer information between elements within computer 210, such as during start-up, is typically stored in ROM 231. RAM 232 typically contains data and/or program modules that are immediately accessible and/or presently being operated on by processing unit 220. By way of example, and not limitation,
The computer 210 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,
The drives and their associated computer storage media discussed above and illustrated in
The computer 210 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 280. The remote computer 280 may be a personal computer, a server, a router, a network PC, a peer device, or other common network node, and typically includes many or all of the elements described above relative to the computer 210, although only a memory storage device 281 has been illustrated in
When used in a LAN networking environment, the computer 210 is connected to the LAN 271 through a network interface or adapter 270. When used in a WAN networking environment, the computer 210 typically includes a modem 272 or other means for establishing communications over the WAN 273, such as the Internet. The modem 272, which may be internal or external, may be connected to the system bus 221 via the input/output peripheral interface 295, or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer 210, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,
Various embodiments of the present invention avoid role explosion by abstracting users and roles associated with users into accessors. Permissions to a piece of content are granted to accessors. Thus, if a user or a role has an accessor that is permitted to access the piece of content, the user or the role may access the piece of content. The discovery of roles eliminates permission explosion because there are fewer roles than users. The discovery of accessors eliminates role explosion because there are fewer accessors than roles. Moreover, role explosion is controlled because permission to the piece of content is explicitly revealed through expressions rather than implicitly hidden in roles, which can be imprecise. A user conveys his access scope through expressions independently from the access scope of the piece of content, which is also conveyed through expressions. These two expressions can be evaluated to determine whether the access scope of the user overlaps with the access scope of the piece of content. If so, the user may access the piece of content. If not, access will be denied. The term “overlap” means that a user needs an expression that covers the complete access scope required by the piece of content. A user expression can be larger in terms of access scope than the access scope defined by the expression of the piece of content but never smaller.
A class diagram 300A illustrates the use of expressions to make explicit the implicit access scope of a role. See
In this particular instance, the class diagram 300A includes a user class 302, which represents an individual or a group of individuals in an organization, such as a company, that may have access to a piece of content in a computer system. The user class 302 defines or inherits a set of attributes or a set of services that may allow access to the piece of content in the computer system. Further specialized classes can be derived from the user class 302 to represent other entities that have a relationship to the organization. For example, an employee class 302A represents employees of the organization. The employee class 302A inherits from the user class 302 the characteristics of the user class 302 so as to gain the capability of accessing the piece of content. Similarly, customers of the organization can be represented by a customer class 302B, which inherits from the user class 302, thereby incorporating characteristics that also allow customers of the company to access the piece of content.
The user class 302 is associated with a role class 304. The role class 304 represents collections of privileges that are granted to users, which are represented by the user class 302. For example, a sales executive role may contain privileges allowing him to access a license to a piece of software residing on a computer system of a software manufacturer. An arrow extended in a circle illustrated above the role class 304 represents one or more inherited roles. An inherited role acquires the characteristics of the role class 304, such as privileges that are granted to the user class 302, albeit the inherited characteristics may be enhanced, restricted, or modified.
An explicit role 306 inherits the characteristics of the role class 304. The main attribute of the explicit role 306 is simply a name whose data structure is composed of a sequence of characters usually representing human-readable text. As previously discussed, explicit roles are difficult to maintain because their number may explode to an unmanageable size. An expressed role class 308 also inherits from the role class 304. The expressed role class 308 has at least two attributes: an expression type, which is preferably a set (a collection of distinct mathematical elements), and an expression, which textually describes the scope of access for a role. Various embodiments of the present invention use the expressed role class 308 to explicitly define an access scope that may encompass dozens to thousands of implied and explicit roles of a role-based access control model. The role class 304 is associated with a permission class 310. The permission class 310 is associated with a content class 312. The permission class 310 represents the ability of a particular role represented by the role class 304 to access a particular resource, such as a piece of content represented by the content class 312.
Another class diagram 300B is illustrated in
The user class 302, the role class 304, and an expressed accessor class 314A inherit from the accessor class 314. This abstraction allows an organization to structure its users (via the user class 302) and roles within the organization (via the role 304) without role explosion. In other words, both users and roles may grow, but there are only a few accessors from which users and roles inherit access privileges. Through the accessor class 314 permission is granted to access a piece of content. This allows a user to be assigned permissions directly to access a piece of content. The expressed accessor 314A has at least two attributes. One attribute is an expression type, which is preferably a set (a collection of distinct mathematical elements). The other attribute is an expression characterized by a data structure composed of a sequence of characters usually representing human-readable text. The expression attribute allows the access scope of accessors as well as a piece of content to be explicitly revealed, hence easing the determination of whether a user should have access to the piece of content.
Users 318A-318C gain access to a piece of content 326 on a computer system 316 via a network (not shown). The network is a group of computers and associated devices that are connected by communications facilities. The network can involve permanent connections, such as coaxial or other cables, or temporary connections made through telephone or other communication links. The network can be as small as a LAN (local area network) consisting of a few computers, printers, and other devices, or it can consist of many small and large computers distributed over a vast geographic area (WAN or wide area network). One exemplary implementation of a WAN is the Internet, which is a worldwide connection of networks and gateways that use the TCP/IP suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, including thousands of commercial, government, educational, and other computer systems, that route data and messages. One or more Internet nodes can go off line without endangering the Internet as a whole or causing communications on the Internet to stop, because no single computer or network controls it.
The computer system 316 uses a load balancing component 320, which is the first stage to receive access requests from users 318A-318C. The request can be formed from any suitable protocols. One suitable protocol includes SOAP. (Simple Object Access Protocol), which is a simple, XML-based protocol for exchanging structured and type information on the Web. In distributed processing, the load balancing component 320 distributes activities across two or more servers in order to avoid overloading any one server with too many requests from users, such as users 318A-318C. Load balancing can be either static or dynamic. In the static case, the load is balanced ahead of time by assigning different groups of users to different servers. In the dynamic case, however, software refers incoming requests at run time to whichever server is most capable of handling them. The load balancing component 320 directs access requests of users 318A-318C to one of a number of Web servers 322A-322D, which are servers utilizing HTTP to deliver World Wide Web documents. The cluster of Web servers 322A-322D can be formed by utilizing a Web farm. Each Web server 322A-322D unravels the protocol envelope of access requests from users 318A-318C. Any suitable software can be run on servers 332A-332D, such as software providing a framework for Web services.
The piece of content 326 is stored in a database 324. The database 324 is basically a file composed of records, each containing fields, together with a set of operations for searching, sorting, recombining, and performing other database functions. Each record of the database 324 has a data structure, which is typically characterized by rows and columns, with data occupying or potentially occupying each cell formed by a row-column intersection. The piece of content 326 therefore has a data structure for describing its information.
To limit access to the piece of content 326 only to authorized users, an access scope is expressed for each of users 318A-318C by the computer system 316. An access scope is also expressed for the piece of content 326. Access is possible when the access scope of a user overlaps with the access scope of the piece of content. If a user has an appropriate access scope, he has access privileges, which are permitted operations for a user to access a certain system resource on a network or file server. A variety of operations, such as the ability to access a server, view the contents of a directory, open a transfer file, and create, modify, or delete files or directories, can be allowed or disallowed by revealing the access scope through expressions in the system 316. These expressions conveying access scopes can be defined by a system administrator of the computer system 316 to limit access of users 318A-318C so as to maintain security on the computer system 316, as well as to maintain the privacy of confidential information, such as the piece of content 316, and to allocate system resources, such as disk space.
An access scope of a user can be visualized as a sphere of privileges surrounding the user. These spheres of access scopes of users 318A-318C are two-dimensionally illustrated in
A user's access scope, unlike in a role-based access control model, can be expressed independently of the access scope of the piece of content 326. The determination of when a user has permission to access a piece of content is made at access time by determining whether there is an overlap between the access scope of a user and the access scope of a piece of content. This decoupling is possible in various embodiments of the present invention allowing the piece of content 326 to be granted to classes of users, such as users 318B-318C, without ever needing to form an explicit relationship tying users 318B-318C to the piece of content 326. Access scopes of users may be completely defined via expressions without needing to determine which pieces of content are accessible via certain access scopes, and, at the same time, access scopes of pieces of content may be completely defined via expressions without any reference to classes of users, such as users 318B-318C. This reduces the size of the permission space, hence reducing exponential role explosion and simplifying administration of the system 316.
Expressions conveyed by the access scope of users 318A-318C and the piece of content 326 are expressed by a security language 330 shown in
Line 330A of the grammar of the security language 330 defines a syntactical rule to form an access scope sentence, which recites “SCOPE::=EXTENT [AND|OR EXTENT . . . ],” where the term “SCOPE” represents an access scope of a user or a piece of content; the symbol “::=” represents the commencement of the definition of the term SCOPE; the term “EXTENT” represents the range of a security space over which an access scope extends; the bracket “[” and its companion bracket “]” indicate that the syntactical elements between the brackets are optional; the term “AND” is a logic operator to form a conjunction; the symbol “|” represents a choice to be made between elements that are adjacent to the vertical bar “|”; the term “OR” represents a logic operator to form a disjunction; and the symbol “. . . ” represents that additional EXTENTs may be defined to complete the access scope sentence.
The syntactical element EXTENT is defined on line 330B: “[NOT] DIMENSION ALL|ANY [NOT] (ELEMENTS)”, where the bracket “[” and its companion bracket “]” indicate that the enclosed syntactical elements between the brackets are optional; the first term “NOT” represents a logical operator that causes an inverse to occur; the term “DIMENSION” represents a group of members that define a portion of a security space in which an access scope is defined; the term “ALL” represents a set operator that requires each member in a set to be processed; the symbol “|” represents a choice to be made between elements adjacent to the symbol “|”; the term “ANY” represents a set operation that requires any one of a number of members in a set to be processed; the bracket “[” and its companion bracket “]” indicate that the syntactical elements enclosed by the brackets are optional; the second term “NOT” represents a set operator that defines the not set; the parenthesis “(” and its companion parenthesis “)” represents a set of members; and the term “MEMBERS” represents members of a set.
The syntactical element MEMBERS is defined on line 330C as follows: “MEMBER|LEVEL [,[−] MEMBER|LEVEL . . . ]”, where the term “MEMBER” represents a member of a DIMENSION defining a portion of a security space; the symbol “|” represents a choice to be made between two elements adjacent to the symbol “|”; the term “LEVEL” represents a hierarchical label within a security space under which a number of dimensional members can be organized; the first set of brackets “[” and “]” indicate optional syntactical elements enclosed within the brackets; the symbol “,” represents a delimitation of one constituency or member of the DIMENSION from another member; the second set of brackets “[” and “]” indicates optional syntactical elements to be included (which are defined between the brackets); the symbol “−” represents a subtraction of a MEMBER from a LEVEL so as to remove the subtracted MEMBER from processing; and the symbol “. . . ” represents that additional MEMBERs or LEVELs may be defined to complete the list of member.
Before the security language 330 can be used to express access scopes of users 318A-318C and the piece of content 326, a security space is preferably defined. A security space is preferably defined by segregating access possibilities into a number of dimensions, each dimension having members specifying in greater detail the properties of the dimension. Suppose that the users 318A-318C are sales executives wanting to access a software license (the piece of content 326) stored in the computer system 316. A security space, such as a portion of a licensing security space 332 illustrated at
The portion of the licensing security space 332 is presented in a table in which information is contained at row-column intersections. The table form facilitates discussion but information of the portion of the licensing security space 332 need not be in table form and can be in other suitable forms. One such suitable form includes a hierarchical graph, such as a directed acyclic graph. Row 332RA contains four cells, which have category designations for each dimension defining the portion of the licensing security space 332. For example, cell 332RA, 332CA defines a “sales location” dimension; cell 332RA, 332CB defines a “licensing program” dimension; cell 332RA, 332CC defines a “customer type” dimension; and cell 332RA, 332CD defines an “agreement type” dimension. Cells in column 332CA contain members of the “sales location” dimension, such as United States, China, Germany, and Russia; cells in column 332CB define members of the “licensing program” dimension, such as selection 4, selection 5, open, and school. Cells in 332CC define members of the “customer type” dimension, such as direct, OEM, VAR, and ISV; and cells in column 332CD define members of the “agreement type” dimension, such as corporation, academic, and government. The portion of the licensing security space 332 can be used in conjunction with the security language 330 to define access scopes for users 318A-318C and the piece of content 326 to limit unauthorized access.
As indicated above, the information in the portion of the licensing security space 332 need not be in table form but can be presented in a hierarchical form. One such form is created from a customizable, tag-based language, such as XML. See
Once the security space, such as the licensing security space 332, 334, has been defined with dimensions as well as members or levels of these dimensions, the security language 330 can be used to create sentences expressing the access scopes of users 318A-318C and the piece of content 326.
An access scope 380 is defined for the user 318A (illustrated at
An access scope 378 for the user 318B is illustrated at
Under certain circumstances where multiple access scope sentences are defined for a user or a piece of content, such as lines 376A, 376B, and only one access scope sentence is defined for comparison, such as the access scope 382 illustrated in
A system 384 in which access scope sentences of the security language 330 are evaluated to determine whether to grant or to deny access to the piece of content 326 is described. See
The table 397 at
Cell 397RB, 397CA contains the binary phrase “0100” which indicates that China is a selected member in the dimension “sales location.” The “1” of the binary phrase “0100” simply indicates that “China” at column 332CA (
Regarding the compiled content sentence 399A, cell 397RC, 397CA contains a binary phrase “0100” reflecting that the member “China” of the “sales location” dimension was selected. (column 332CA,
To evaluate for overlapping of dimensions for granting or denying access, the access evaluator 396 logically ANDs the binary sentence at row 397RB and the binary sentence at row 397RC resulting in the binary sentence at row 397RD. Because the numerical value of each binary phrase of the binary sentence at row 397RD is greater than zero, there is at least one dimensional overlap, hence access is allowed for a user having the accessor sentence 398A.
As a point of contrast, a content accessor scope 395 is provided to show a case where the access evaluator 396 denies an access request by a user. A sentence 395A expresses the content access scope 395 as follows: “SALESLOCATION ANY (CHINA) AND CUSTOMERTYPE ANY (VAR, DIRECT) AND AGREEMENTTYPE ANY (ACADEMIC)”. The content sentence 395A varies from the content sentence 399A (
The resultant binary sentence shown at row 393RD is similar to the resultant binary sentence at row 397RD except that cell 393RD, 393CD contains a binary phrase “000”. This resultant binary phrase “000” is formed from the logical ANDing of the binary phrase “101” (cell 393RB, 393CD) and the binary phrase “010” (cell 393RC, 393CD). Because not all of the binary phrases of the binary sentence at row 393RD have numerical values greater than 0, the access evaluator 396 determines that access to the piece of content 326 is denied.
Components of the system 384, such as the security compiler 392 and the security evaluator 396, are pieces of software running on the system 384. These pieces of software, including representations of users 318A and 318C and the piece of content 326, can be distributed on the Internet as Web services, which are a modular collection of Web protocol-based applications that can be mixed and matched to provide functionality through an Internet connection. Web services use standard Internet protocols such as HTTP, XML, and SOAP to provide connectivity and interoperability between Web services. For example, Web services 389A-389C can represent users 318A-318C in a framework of Web services. Web services 389A-389C can contain one or more accessor sentences to define the access scope of Web services 389A-389C.
Any suitable set of technologies can be used to build, host, deploy and use Web services 389A-389C. One suitable set of technologies includes the .NET framework of Microsoft Corporation, but other suitable technologies can be used. The same set of technologies can be used to transform the security evaluator 396 into an access evaluator Web service 387. The same set of technologies can be used to transform the sentence compiler 392 into a sentence compiler Web service 383. The piece of content 326 and its corresponding content sentence 388 can be transformed into a Web service 381 using the Web service technologies. Web services 381, 383, 387, 389A-389C can register themselves with the Universal Description Discovery and Integration framework 385 (UDDI). UDDI is a platform-independent framework functioning like a directory that provides a way to locate and register Web services on the Internet.
Using the UDDI 385, users represented by Web services 389A-389C can discover the piece of content 326 encapsulated as the Web service 381 and request access to the piece of content 326. The Web service 381 uses the UDDI 385 to locate the sentence compiler Web service 383 to compile (as discussed above with respect to
From terminal A (
From terminal A3 (
Next, the method 400 proceeds to another decision block 428 where it is determined whether to logically remove an access member from an access level. If the answer to the test at decision block 428 is YES, another continuation terminal (“terminal A5”) is entered by the method 400. Otherwise, the answer is NO, and the method 400 proceeds to another continuation terminal (“terminal A6”).
From terminal A5 (
From terminal A7 (
From terminal B (
From terminal C (
If the answer to the test at decision block 458 is NO, the method 400 constructs explicit access scope sentences implied by two or more access scope sentences. See block 460. An example of this is the sentence 382, which is formed from a permutation of sentences 376A, 376B. The method 400 then continues on to another continuation terminal (“terminal C3”).
From terminal C3 (
From terminal D (
From terminal E (
From terminal E3 (
From terminal E5 (
From terminal E6 (
From terminal E2 (
While the preferred embodiment of the invention has been illustrated and described, it will be appreciated that various changes can be made therein without departing from the spirit and scope of the invention.
