CA2505156A1 - Techniques for supporting application-specific access controls with a separate server - Google Patents

Techniques for supporting application-specific access controls with a separate server Download PDF

Info

Publication number
CA2505156A1
CA2505156A1 CA002505156A CA2505156A CA2505156A1 CA 2505156 A1 CA2505156 A1 CA 2505156A1 CA 002505156 A CA002505156 A CA 002505156A CA 2505156 A CA2505156 A CA 2505156A CA 2505156 A1 CA2505156 A1 CA 2505156A1
Authority
CA
Canada
Prior art keywords
application
data
privileges
server
specific operation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CA002505156A
Other languages
French (fr)
Other versions
CA2505156C (en
Inventor
Sam Idicula
Nipun Agarwal
Ravi Murthy
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Oracle International Corp
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Publication of CA2505156A1 publication Critical patent/CA2505156A1/en
Application granted granted Critical
Publication of CA2505156C publication Critical patent/CA2505156C/en
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2113—Multi-level security, e.g. mandatory access control
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
    • Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10S707/00—Data processing: database and file management or data structures
    • Y10S707/953—Organization of data
    • Y10S707/956—Hierarchical

Abstract

Techniques for supporting access controls on application-specific operations performed by an application include receiving first data at a server distinct from the application. The first data describes a first set of privileges for performing a first set of application-specific operations. Second data is also received at the server. The second data associates a first user of the application with a privilege in the first set of privileges. In response to receiving a request at the server from the application, it is determined whether a particular user may have the application perform a particular application-specific operation based on the first data and the second data.
The request indicates the particular user and the particular application-specific operation. A response is sent to the application. The response indicates whether the particular user may have the application perform the particular application-specific operation.

Claims (20)

1. A method for controlling access to application-specific operations performed by an application, comprising the steps of:
receiving privilege information at a server that is distinct from the application;
causing the server to determine, based on the privilege information, whether a particular application-specific operation is allowed under a particular set of conditions; and causing the server to communicate to the application an indication of whether the particular application-specific operation is allowed under said particular set of conditions.
2. The method of Claim 1 wherein the step of receiving privilege information includes receiving, at said server, first data that describes a first set of privileges for performing a first plurality of application-specific operations.
3. The method of Claim 2 wherein the step of receiving privilege information further includes receiving, at said server, second data that associates users of the application with one or more privileges in the first set of privileges.
4. The method of Claim 1 further comprising the steps of:
in response to receiving, at the server from the application, a request that indicates a particular user and a particular application-specific operation, determining whether the particular user may have the application perform the particular application-specific operation based on the privilege information; and wherein the step of causing the server to communicate to the application an indication includes the step of sending to the application a response that indicates whether the particular user may have the application perform the particular application-specific operation.
5. The method of Claim 4, wherein:
said step of receiving privilege information further comprises receiving first data that associates a first set of privileges with a first type of data items upon which the plurality of application-specific operations operate; and said step of receiving the request further comprises receiving a request that also indicates a particular data item; and said step of determining whether the particular user may have the application perform the particular application-specific operation further comprises determining whether the particular data item is a member of the first type of data items.
6. The method of Claim 5, wherein:
the method further comprises receiving, at the server, second data that describes a second set of privileges for performing a second plurality of application-specific operations on a second type of data items that is different than said first type of data items; and said step of determining whether the particular user may have the application perform the particular application-specific operation is based, in part, on the particular type of the particular data item.
7. The method of Claim 1, said step of receiving privilege information comprises receiving a document in extensible markup language (XML).
8. The method of Claim 4, said step of determining whether the particular user may have the application perform the particular application-specific operation further comprising the step of managing a cache in fast memory for storing information that associates each of one or more users with one or more privileges in each of one or more sets of privileges.
9. The method of Claim 2, said step of managing the cache further comprising the step of storing in the cache data indicating a type of data item associated with each user.
10. The method of Claim 2, wherein the first set of privileges forms a first hierarchy of two or more levels of privileges.
11. The method of Claim 8, said step of managing the cache further comprising the step of storing in the cache a bitmap for each user, wherein:
each set of privileges forms a hierarchy of one or more levels of privileges;
each different position in the bitmap corresponds to one different leaf node in each hierarchy of the one or more sets of privileges; and a leaf node is a node of a hierarchy that does not have any child node.
12. A method for controlling access to application-specific operations performed by an application, comprising the steps of:
communicating privilege information to a server that is distinct from the application;
sending a request, from the application to the server, for the server to determine, based on the privilege information, whether a particular application-specific operation is allowed under a particular set of conditions;
receiving from the server an indication of whether the particular application-specific operation is allowed under said particular set of conditions; and the application only allowing the particular application-specific operation if the server indicated that the application-specific operation was allowed under said particular set of conditions.
13. The method of Claim 12 wherein:
the step of communicating privilege information to a server includes:
sending, to a server distinct from the application, first data that describes a first set of privileges for performing a first plurality of application-specific operations; and sending to the server second data that associates a first user of the application with a privilege in the first set of privileges.
14. The method of Claim 12 further comprising the steps of:
receiving at the application a command from a particular user, which command involves the application performing a particular application-specific operation;
sending to the server a request that indicates the particular user and the particular application-specific operation;
wherein the step of receiving from the server an indication of whether the particular application-specific operation is allowed under said particular set of conditions includes receiving from the server a response that indicates whether the particular user may have the application perform the particular application-specific operation based on the first data and the second data; and performing the particular application-specific operation only if the response indicates the particular user may have the application perform the particular application-specific operation.
15. The method of Claim 13, wherein:
said step of sending the first data further comprises sending first data that also associates the first set of privileges with a first type of data items upon which the plurality of application-specific operations operate; and said step of sending the request further comprises sending the request that also indicates a particular data item; and said step of receiving the response based on the first data and the second data further comprises receiving the response also based on whether the particular data item is a member of the first type of data items.
16. The method of Claim 15, wherein:
the method further comprises sending to the server third data that describes a different second set of privileges for performing a second plurality of application-specific operations on a different second type of data items;
and said step of sending the second data further comprises sending second data that also associates a second user of the application with a privilege in the second hierarchy of privileges; and said step of receiving the response based on the first data and the second data further comprises receiving the response also based on whether a particular type of the particular data item is associated with a particular set of privileges for a particular plurality of application-specific operations that include the particular application-specific operation.
17. The method of Claim 12, said step of communicating privilege information further comprises sending a document in extensible markup language (XML).
18. The method of Claim 13, wherein the application does not manage a cache in fast memory for storing information that associates each of one or more users with one or more privileges in each of one or more sets of privileges including the first set of privileges.
19. The method of Claim 13, wherein the first set of privileges forms a first hierarchy of two or more levels of privileges.
20. A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in any one of Claims 1-19.
CA2505156A 2002-11-06 2003-11-06 Techniques for supporting application-specific access controls with a separate server Expired - Lifetime CA2505156C (en)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
US42454302P 2002-11-06 2002-11-06
US60/424,543 2002-11-06
US10/364,610 US7020653B2 (en) 2002-11-06 2003-02-10 Techniques for supporting application-specific access controls with a separate server
US10/364,610 2003-02-10
PCT/US2003/035494 WO2004044738A2 (en) 2002-11-06 2003-11-06 Techniques for supporting application-specific access controls with a separate server

Publications (2)

Publication Number Publication Date
CA2505156A1 true CA2505156A1 (en) 2004-05-27
CA2505156C CA2505156C (en) 2011-07-05

Family

ID=32179549

Family Applications (1)

Application Number Title Priority Date Filing Date
CA2505156A Expired - Lifetime CA2505156C (en) 2002-11-06 2003-11-06 Techniques for supporting application-specific access controls with a separate server

Country Status (6)

Country Link
US (1) US7020653B2 (en)
EP (1) EP1559006B1 (en)
JP (1) JP4787617B2 (en)
AU (1) AU2003287565C1 (en)
CA (1) CA2505156C (en)
WO (1) WO2004044738A2 (en)

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7020653B2 (en) 2002-11-06 2006-03-28 Oracle International Corporation Techniques for supporting application-specific access controls with a separate server
US20050063524A1 (en) * 2002-12-11 2005-03-24 Leader Technologies, Inc. Communication system and method
US7925246B2 (en) 2002-12-11 2011-04-12 Leader Technologies, Inc. Radio/telephony interoperability system
US20070127400A1 (en) * 2002-12-11 2007-06-07 Leader Technologies, Inc. Professional Services Communications Architecture
US8195714B2 (en) 2002-12-11 2012-06-05 Leaper Technologies, Inc. Context instantiated application protocol
US8775468B2 (en) * 2003-08-29 2014-07-08 International Business Machines Corporation Method and system for providing path-level access control for structured documents stored in a database
US7546640B2 (en) * 2003-12-10 2009-06-09 International Business Machines Corporation Fine-grained authorization by authorization table associated with a resource
US20050132054A1 (en) * 2003-12-10 2005-06-16 International Business Machines Corporation Fine-grained authorization by traversing generational relationships
US7346617B2 (en) * 2004-01-23 2008-03-18 Oracle International Corporation Multi-table access control
US20050203850A1 (en) * 2004-01-29 2005-09-15 Peter Heussi-Pfleger Output data management
US8074288B2 (en) * 2005-07-15 2011-12-06 Microsoft Corporation Isolation of application-specific data within a user account
US7996367B2 (en) 2006-01-18 2011-08-09 Echosign, Inc. Automatic document exchange with document searching capability
US7895166B2 (en) * 2006-01-18 2011-02-22 Echosign, Inc. Automatic document exchange with archiving capability
US7996439B2 (en) * 2006-01-18 2011-08-09 Echosign, Inc. Automatic document exchange and execution management
US8423612B2 (en) * 2007-01-08 2013-04-16 Cisco Technology, Inc. Methods and apparatuses for selectively accessing an application
US20090157686A1 (en) * 2007-12-13 2009-06-18 Oracle International Corporation Method and apparatus for efficiently caching a system-wide access control list
US20100223320A1 (en) * 2009-02-27 2010-09-02 He Huang Data distribution efficiency for online collaborative computing sessions
US8538990B2 (en) * 2011-03-04 2013-09-17 International Business Machines Corporation Scalable mechanism for resolving cell-level access from sets of dimensional access rules
US20150134719A1 (en) * 2013-11-13 2015-05-14 Kaseya International Limited Third party application delivery via an agent portal
US9535610B2 (en) * 2014-02-21 2017-01-03 International Business Machines Corporation Optimizing peer-to-peer remote copy (PPRC) transfers for partial write operations using a modified sectors bitmap
US9507527B2 (en) 2014-02-21 2016-11-29 International Business Machines Corporation Efficient cache management of multi-target peer-to-peer remote copy (PPRC) modified sectors bitmap
US9600277B2 (en) * 2014-02-21 2017-03-21 International Business Machines Corporation Asynchronous cleanup after a peer-to-peer remote copy (PPRC) terminate relationship operation
US20150295852A1 (en) * 2014-04-15 2015-10-15 Ntt Innovation Institute, Inc. Protecting and tracking network state updates in software-defined networks from side-channel access
US9628555B2 (en) * 2015-06-18 2017-04-18 Live Nation Entertainment, Inc Enhanced load processing using linked hierarchical data structures

Family Cites Families (48)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1990014626A1 (en) * 1989-05-15 1990-11-29 Dallas Semiconductor Corporation Systems with data-token/one-wire-bus
US5226137A (en) * 1989-05-15 1993-07-06 Dallas Semiconductor Corp. Electronic key with multiple password protected sub-keys using address and translation to implement a block data move between public and protected sub-keys
US4993025A (en) * 1989-11-21 1991-02-12 Picker International, Inc. High efficiency image data transfer network
US5257365A (en) 1990-03-16 1993-10-26 Powers Frederick A Database system with multi-dimensional summary search tree nodes for reducing the necessity to access records
US5577209A (en) * 1991-07-11 1996-11-19 Itt Corporation Apparatus and method for providing multi-level security for communication among computers and terminals on a network
JPH05225057A (en) * 1992-02-14 1993-09-03 Casio Comput Co Ltd Cache memory controller
JPH0667951A (en) 1992-05-20 1994-03-11 Nec Corp Database management system
US5463772A (en) 1993-04-23 1995-10-31 Hewlett-Packard Company Transparent peripheral file systems with on-board compression, decompression, and space management
US5893109A (en) 1996-03-15 1999-04-06 Inso Providence Corporation Generation of chunks of a long document for an electronic book system
US5893104A (en) 1996-07-09 1999-04-06 Oracle Corporation Method and system for processing queries in a database system using index structures that are not native to the database system
US6208993B1 (en) 1996-07-26 2001-03-27 Ori Software Development Ltd. Method for organizing directories
US6023765A (en) * 1996-12-06 2000-02-08 The United States Of America As Represented By The Secretary Of Commerce Implementation of role-based access control in multi-level secure systems
JP3698851B2 (en) * 1997-02-20 2005-09-21 株式会社日立製作所 Database security management method and system
GB2329044B (en) 1997-09-05 2002-10-09 Ibm Data retrieval system
US6141655A (en) 1997-09-23 2000-10-31 At&T Corp Method and apparatus for optimizing and structuring data by designing a cube forest data structure for hierarchically split cube forest template
US5974407A (en) 1997-09-29 1999-10-26 Sacks; Jerome E. Method and apparatus for implementing a hierarchical database management system (HDBMS) using a relational database management system (RDBMS) as the implementing apparatus
JPH11161536A (en) * 1997-11-26 1999-06-18 Nec Inf Service Ltd User limiting device and method therefor
US6192476B1 (en) 1997-12-11 2001-02-20 Sun Microsystems, Inc. Controlling access to a resource
US6430549B1 (en) * 1998-07-17 2002-08-06 Electronic Data Systems Corporation System and method for selectivety defining access to application features
US6487546B1 (en) 1998-08-27 2002-11-26 Oracle Corporation Apparatus and method for aggregate indexes
US6279007B1 (en) 1998-11-30 2001-08-21 Microsoft Corporation Architecture for managing query friendly hierarchical values
US6704739B2 (en) 1999-01-04 2004-03-09 Adobe Systems Incorporated Tagging data assets
US6449652B1 (en) 1999-01-04 2002-09-10 Emc Corporation Method and apparatus for providing secure access to a computer system resource
US6370537B1 (en) 1999-01-14 2002-04-09 Altoweb, Inc. System and method for the manipulation and display of structured data
US6427123B1 (en) 1999-02-18 2002-07-30 Oracle Corporation Hierarchical indexing for accessing hierarchically organized information in a relational system
JP2000250872A (en) * 1999-03-02 2000-09-14 Mitsubishi Electric Corp Integral managing system for job processing system
HK1020419A2 (en) 1999-03-16 2000-03-17 Shi Piu Joseph Fong Frame model for universal database in database reengineering and integration
US6542898B1 (en) * 1999-05-12 2003-04-01 Motive Communications, Inc. Technical support chain automation with guided self-help capability using active content developed for specific audiences
US6496842B1 (en) 1999-05-28 2002-12-17 Survol Interactive Technologies Navigating heirarchically organized information
US6470344B1 (en) 1999-05-29 2002-10-22 Oracle Corporation Buffering a hierarchical index of multi-dimensional data
US6721727B2 (en) 1999-12-02 2004-04-13 International Business Machines Corporation XML documents stored as column data
AU2001236998A1 (en) 2000-02-11 2001-08-20 Acta Technologies, Inc. Nested relational data model
US7072896B2 (en) 2000-02-16 2006-07-04 Verizon Laboratories Inc. System and method for automatic loading of an XML document defined by a document-type definition into a relational database including the generation of a relational schema therefor
US20020056025A1 (en) 2000-11-07 2002-05-09 Qiu Chaoxin C. Systems and methods for management of memory
US6785718B2 (en) 2000-10-23 2004-08-31 Schneider Logistics, Inc. Method and system for interfacing with a shipping service
US6542911B2 (en) 2001-03-01 2003-04-01 Sun Microsystems, Inc. Method and apparatus for freeing memory from an extensible markup language document object model tree active in an application cache
JP2002259215A (en) * 2001-03-06 2002-09-13 Kyocera Communication Systems Co Ltd Access control system
JP2002324053A (en) * 2001-04-24 2002-11-08 Nec Corp Use authorization controlling system, use authorization controlling method and program
US6968334B2 (en) 2001-05-15 2005-11-22 Nokia Corporation Method and business process to maintain privacy in distributed recommendation systems
US6725212B2 (en) 2001-08-31 2004-04-20 International Business Machines Corporation Platform-independent method and system for graphically presenting the evaluation of a query in a database management system
AU2002334721B2 (en) 2001-09-28 2008-10-23 Oracle International Corporation An index structure to access hierarchical data in a relational database system
US7487168B2 (en) 2001-11-01 2009-02-03 Microsoft Corporation System and method for loading hierarchical data into relational database systems
US9374451B2 (en) 2002-02-04 2016-06-21 Nokia Technologies Oy System and method for multimodal short-cuts to digital services
US7570943B2 (en) 2002-08-29 2009-08-04 Nokia Corporation System and method for providing context sensitive recommendations to digital services
US7308474B2 (en) 2002-11-06 2007-12-11 Oracle International Corporation Techniques for scalably accessing data in an arbitrarily large document by a device with limited resources
US7020653B2 (en) 2002-11-06 2006-03-28 Oracle International Corporation Techniques for supporting application-specific access controls with a separate server
US7634480B2 (en) 2003-05-08 2009-12-15 Microsoft Corporation Declarative rules for metadirectory
US20040230893A1 (en) * 2003-05-16 2004-11-18 Dethe Elza Method and system for enabling collaborative authoring of hierarchical documents with node privileges

Also Published As

Publication number Publication date
AU2003287565A1 (en) 2004-06-03
AU2003287565A2 (en) 2005-07-07
JP4787617B2 (en) 2011-10-05
WO2004044738A2 (en) 2004-05-27
US20040088340A1 (en) 2004-05-06
EP1559006B1 (en) 2015-08-05
WO2004044738A3 (en) 2005-02-24
CA2505156C (en) 2011-07-05
US7020653B2 (en) 2006-03-28
EP1559006A2 (en) 2005-08-03
AU2003287565B2 (en) 2006-11-09
AU2003287565C1 (en) 2008-07-31
JP2006505877A (en) 2006-02-16

Similar Documents

Publication Publication Date Title
CA2505156A1 (en) Techniques for supporting application-specific access controls with a separate server
US8645318B2 (en) System and method for the synchronization of a file in a cache
US5960168A (en) Deferred printing
US9026583B2 (en) Method and apparatus for polymorphic serialization
US7536440B2 (en) Method and system for email synchronization for an electronic device
CN100504769C (en) System and method for implementing a general application program interface
US20050076086A1 (en) Method and system for polling and caching emails for an electronic device
US20050091336A1 (en) Method and apparatus for supporting cookie management in a web presentation architecture
US20050076085A1 (en) Method and system for managing email attachments for an electronic device
US20050182644A1 (en) E-service to manage contact information with privacy levels
US20050076294A1 (en) Method and apparatus for supporting layout management in a web presentation architecture
CN101421726A (en) Occasionally-connected application server
WO2006104720A2 (en) Methods and systems for saving draft electronic communications
WO2008016560A1 (en) Two-way and multi-master synchronization over web syndications
US9275165B2 (en) Method and apparatus for defining an application to allow polymorphic serialization
US7475089B1 (en) Enhanced portal server system and method
CN101730099A (en) Terminal management method based on authority control and device
CA2512677A1 (en) System and method for mouseless navigation of web applications
CN101331488A (en) Disk-based cache
CN104756596A (en) Intelligent homescreen for mobile devices
CN101223495A (en) Control panel framework
US6701323B2 (en) Object management system and method for distributed object system
US20070143303A1 (en) Method and system for automatically updating software
CN111459503A (en) Web front-end item deployment method, device, server and storage medium
CN107589941A (en) A kind of method of the instant seating maps scheduling based on DragDropMgr singletons

Legal Events

Date Code Title Description
EEER Examination request
MKEX Expiry

Effective date: 20231106