US5941947A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for controlling access to data entities in a computer network
Assignee: Adeia Technologies Inc
•
Filing: 1995-08-18
•
Granted: 1999-08-24
•
Expires: 2015-08-18
Abstract
Abstract Access rights of users of a computer network with respect to data entities are specified by a relational database stored on one or more security servers. Application servers on the network that provide user access to the data entities generate queries to the relational database in order to obtain access rights lists of specific users. An access rights cache on each application server caches the access rights lists of the users that are connected to the respective application server, so that user access rights to specific data entities can rapidly be determined. Each user-specific access rights list includes a series of category identifiers plus a series of access rights values. The category identifiers specify categories of data entities to which the user has access, and the access rights values specify privilege levels of the users with respect to the corresponding data entity categories. The privilege levels are converted into specific access capabilities by application programs running on the application servers.
Inventors
- 👤 Ross M. Brown
- 👤 Richard G. Greenberg
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-28 17:59
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/10; H04L63/101; G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06Q; G06Q99/00; H04L63/105; G06F2221/00; G06F2221/21; G06F2221/2141
Claims Analysis
Total Claims: 73
Claim 1
Independent Claim
151 words
A method for controlling user access to a plurality of data entities in a computer network, said plurality of data entities stored on a plurality of application servers, said method comprising the steps of: sending an access rights query from an application server to a security server, said access rights query specifying a user of the network; at said security server, accessing a relational database in response to said access rights query to obtain an access rights list for said user, said access rights list specifying access rights of said user with respect to said plurality of data entities; sending said access rights list from said security server to said application server; at said application server, storing said access rights list in an access rights cache; and accessing said cache to determine the access rights of said user with respect to a specific data entity of said plurality of data entities.
Claim 2
Independent Claim
151 words
A method for controlling user access to a plurality of data entities in a computer network, said plurality of data entities stored on a plurality of application servers, said method comprising the steps of: sending an access rights query from an application server to a security server, said access rights query specifying a user of the network; at said security server, accessing a relational database in response to said access rights query to obtain an access rights list for said user, said access rights list specifying access rights of said user with respect to said plurality of data entities; sending said access rights list from said security server to said application server; at said application server, storing said access rights list in an access rights cache; and accessing said cache to determine the access rights of said user with respect to a specific data entity of said plurality of data entities.
Claim 3
Dependent Claim
27 words
The method according to claim 1, wherein said access rights list comprises a plurality of category identifiers, each of said category identifiers specifying a data entity category.
Claim 4
Dependent Claim
54 words
The method according to claim 2, wherein said access rights list further comprises a plurality of access rights values, each of said access rights values corresponding to a respective one of said category identifiers and specifying access rights of said user with respect to data entities that fall within a respective data entity category.
Claim 5
Dependent Claim
23 words
The method according to claim 2, further comprising the step of determining a data entity category in which said specific data entity falls.
Claim 6
Dependent Claim
45 words
The method according to claim 4, wherein said step of determining a data entity category comprises accessing a directory structure which is stored on at least one of said plurality of application servers, said directory structure representing an arrangement of said plurality of data entities.
Claim 7
Dependent Claim
26 words
The method according to claim 4, wherein said step of determining a data entity category comprises reading a category identifier stored with said specific data entity.
Claim 8
Dependent Claim
34 words
The method according to claim 4, wherein said step of determining a data entity category comprises reading a category identifier that is stored on an application server in association with said specific data entity.
Claim 9
Dependent Claim
38 words
The method according to claim 2 wherein said step of accessing said cache comprises searching said cache for a specific category identifier, said specific category identifier representing a data entity category in which said specific data entity falls.
Claim 10
Dependent Claim
37 words
The method according to claim 2, wherein said step of storing said access rights list in said cache comprises storing said category identifiers in a numerical order within said cache to thereby facilitate searches of said cache.
Claim 11
Dependent Claim
29 words
The method according to claim 1, wherein said access rights list comprises a plurality of access rights values, said access rights values specifying generic privilege levels of said user.
Claim 12
Dependent Claim
38 words
The method according to claim 10, wherein said step of accessing said cache comprises the steps of reading an access rights value from said cache, and translating said access rights value into a set of specific access capabilities.
Claim 13
Dependent Claim
32 words
The method according to claim 11, wherein said step of translating is performed by a service application running on said application server, said service application being associated with said specific data entity.
Claim 14
Dependent Claim
28 words
The method according to claim 1, wherein said step of accessing said relational database comprises identifying at least one user group in which said user is a member.
Claim 15
Dependent Claim
43 words
The method according to claim 13, wherein said step of accessing said relational database further comprises identifying a plurality of data entity groups to which said user has access rights by virtue of being a member of said at least one user group.
Claim 16
Dependent Claim
36 words
The method according to claim 1, wherein said step of storing said access rights list in said cache and said step of accessing said cache to determine the access rights of said user are performed concurrently.
Claim 17
Dependent Claim
20 words
The method according to claim 1, wherein said plurality of data entities represents the content of an on-line services network.
Claim 18
Dependent Claim
20 words
The method according to claim 1, wherein at least one of said plurality of data entities is a system resource.
Claim 19
Dependent Claim
34 words
The method according to claim 1, further comprising the step of forwarding said access rights list from said application server to a different application server when said user connects to said different application server.
Claim 20
Dependent Claim
35 words
The method according to claim 1, further comprising the step of, if said user is not authorized to access said specific data entity, preventing said user from seeing a representation of said specific data entity.
Claim 21
Dependent Claim
26 words
The method according to claim 19, wherein said step of preventing comprises omitting said representation from a reconstructed directory structure that is shown to said user.
Claim 22
Independent Claim
102 words
A method of determining the access rights of a user of a computer system with respect to a plurality of data entities of the computer system, comprising the steps of: identifying at least one user group of which said user is a member, said at least one user group being part of a predefined set of user groups; and identifying at least one data entity category to which said user has access by virtue of being a member of said at least one user group, said at least one data entity category being part of a predefined set of data entity categories.
Claim 23
Independent Claim
102 words
A method of determining the access rights of a user of a computer system with respect to a plurality of data entities of the computer system, comprising the steps of: identifying at least one user group of which said user is a member, said at least one user group being part of a predefined set of user groups; and identifying at least one data entity category to which said user has access by virtue of being a member of said at least one user group, said at least one data entity category being part of a predefined set of data entity categories.
Claim 24
Dependent Claim
38 words
The method according to claim 21, wherein said steps of identifying at least one user group and identifying at least one data entity category each comprise accessing a relational database stored on a server of a computer network.
Claim 25
Dependent Claim
27 words
The method according to claim 21, further comprising the step of identifying at least one data entity that falls within said at least one data entity category.
Claim 26
Dependent Claim
59 words
The method according to claim 21, further comprising the steps of: determining a specific data entity category in which a specific data entity falls; and determining whether said at least one data entity category to which said user has access includes said specific data entity category, to thereby determine whether said user has access to said specific data entity.
Claim 27
Dependent Claim
44 words
The method according to claim 21, further comprising the step of reading an access rights value that specifies access rights of said user with respect to all data entities that fall within a data entity category of said at least one data entity category.
Claim 28
Dependent Claim
55 words
The method according to claim 21, further comprising the step of identifying at least one additional data entity category to which said user has access, said at least one additional data entity category being in addition to data entity categories to which said user has access by virtue of being a member of user group.
Claim 29
Dependent Claim
37 words
The method according to claim 21, wherein said step of identifying at least one user group of which said user is a member comprises identifying a plurality of user groups of which said user is a member.
Claim 30
Dependent Claim
34 words
The method according to claim 21, wherein each user group of said predefined set of user groups corresponds to a respective set of user access rights with respect to said plurality of data entities.
Claim 31
Dependent Claim
29 words
The method according to claim 21, wherein each data entity category of said predefined set of data entity categories contains a respective subgroup of said plurality of data entities.
Claim 32
Dependent Claim
31 words
The method according to claim 21, wherein each data entity of said plurality of data entities falls within exactly one data entity category of said predefined set of data entity categories.
Claim 33
Dependent Claim
45 words
The method according to claim 21, further comprising the steps of: generating a list of category identifiers that identifies said at least one data entity category to which said user has access; and transmitting said list across a computer network to at least one server.
Claim 34
Dependent Claim
24 words
The method according to claim 31, further comprising the step of storing said list in a cache memory of said at least one server.
Claim 35
Dependent Claim
23 words
The method according to claim 31, further comprising the step of storing said list in respective cache memories of a plurality of servers.
Claim 36
Dependent Claim
20 words
The method according to claim 21, wherein said plurality of data entities represents a content of an on-line services network.
Claim 37
Dependent Claim
18 words
The method according to claim 21, wherein said plurality of data entities comprises files of a file system.
Claim 38
Dependent Claim
24 words
The method according to claim 21, wherein said plurality of data entities comprises system resources to which access is controlled by an operating system.
Claim 39
Dependent Claim
108 words
In a computer network in which different users have different access rights with respect to different data entities, a method of efficiently specifying the access rights of users, comprising the steps of: assigning each of a plurality of data entities to one of a plurality of categorical groups of data entities, each of said categorical groups containing data entities for which user access rights may be specified collectively; and assigning each of a plurality of users to at least one of a plurality of user groups, each of said user groups having a corresponding set of access rights associated therewith with respect to said plurality of categorical groups.
Claim 40
Dependent Claim
108 words
In a computer network in which different users have different access rights with respect to different data entities, a method of efficiently specifying the access rights of users, comprising the steps of: assigning each of a plurality of data entities to one of a plurality of categorical groups of data entities, each of said categorical groups containing data entities for which user access rights may be specified collectively; and assigning each of a plurality of users to at least one of a plurality of user groups, each of said user groups having a corresponding set of access rights associated therewith with respect to said plurality of categorical groups.
Claim 41
Dependent Claim
43 words
The method according to claim 37, wherein said step of assigning each of said plurality of data entities to one of said plurality of categorical groups comprises storing a respective categorical group identifier in association with each of said plurality of data entities.
Claim 42
Dependent Claim
23 words
The method according to claim 38, wherein said step of storing comprises storing a categorical group identifier within a data entity directory structure.
Claim 43
Dependent Claim
41 words
The method according to claim 37, wherein said step of assigning each of said plurality of users to at least one of said plurality of user groups comprises assigning at least one of said users to multiple of said user groups.
Claim 44
Dependent Claim
24 words
The method according to claim 37, wherein each of said data entities is a content object that represents content of an on-line services network.
Claim 45
Independent Claim
146 words
A system for providing user access to data entities in a computer network, comprising: at least one application server that stores a plurality of data entities, said data entities accessible by a plurality of users through a plurality of application programs, different of said users having different levels of access with respect to at least some of said data entities; a database which stores access rights values that specify access rights of said users with respect to said data entities; and an access rights cache on said at least one application server, said access rights cache storing access rights lists, said access rights lists obtained from said database in response to requests from said at least one application server, each of said access rights lists comprising a plurality of said access rights values and specifying access rights for a respective one of said plurality of users.
Claim 46
Independent Claim
146 words
A system for providing user access to data entities in a computer network, comprising: at least one application server that stores a plurality of data entities, said data entities accessible by a plurality of users through a plurality of application programs, different of said users having different levels of access with respect to at least some of said data entities; a database which stores access rights values that specify access rights of said users with respect to said data entities; and an access rights cache on said at least one application server, said access rights cache storing access rights lists, said access rights lists obtained from said database in response to requests from said at least one application server, each of said access rights lists comprising a plurality of said access rights values and specifying access rights for a respective one of said plurality of users.
Claim 47
Dependent Claim
28 words
The system according to claim 42, wherein said access rights values are stored in said database in association with category identifiers that identify categories of said data entities.
Claim 48
Dependent Claim
19 words
The system according to claim 43, wherein each of said lists further comprises a plurality of said category identifiers.
Claim 49
Dependent Claim
22 words
The system according to claim 43, wherein said database is implemented on a separate server from said at least one application server.
Claim 50
Dependent Claim
22 words
The system according to claim 45, wherein said at least one application server stores at least a subgroup of said category identifiers.
Claim 51
Dependent Claim
28 words
The system according to claim 43, wherein said access rights values are stored in said database in further association with group identifiers that identify groups of said users.
Claim 52
Dependent Claim
58 words
The system according to claim 42, wherein said at least one application server runs a program module that generates a query of said database when a user connects to said at least one application server, said query causing an access rights list for said user to be obtained from said database and written to said access rights cache.
Claim 53
Dependent Claim
29 words
The system according to claim 48, wherein said program module deletes said access rights list from said cache when said user disconnects from said at least one application server.
Claim 54
Dependent Claim
23 words
The system according to claim 42, wherein said access rights cache specifies access rights for a variable subset of said plurality of users.
Claim 55
Dependent Claim
25 words
The system according to claim 42, wherein each of said access rights lists specifies user access rights with respect to all of said data entities.
Claim 56
Dependent Claim
39 words
The system according to claim 42, wherein said at least one application server comprises an application server that runs a directory service application program, said directory service application program providing a directory of said data entities to said users.
Claim 57
Dependent Claim
44 words
The system according to claim 42, wherein said access rights values contain privilege level bits which specify general privilege levels, said general privilege levels converted into specific access capabilities by said application programs, different application programs converting like privilege levels into different access capabilities.
Claim 58
Dependent Claim
125 words
An access rights list stored on a storage medium of a computer, said access list specifying the access rights of a user of a network with respect to a plurality of data entities of said network, said plurality of data entities subdivided into multiple categorical groups of data entities, said access rights list comprising: a plurality of group identifiers, each of said group identifiers specifying one of said multiple categorical groups, said plurality of group identifiers specifying a subset of said multiple categorical groups to which said user has access rights; and a plurality of access rights values, each of said access rights values specifying access rights with respect to data entities which fall within a respective one of said categorical groups of said subset.
Claim 59
Dependent Claim
125 words
An access rights list stored on a storage medium of a computer, said access list specifying the access rights of a user of a network with respect to a plurality of data entities of said network, said plurality of data entities subdivided into multiple categorical groups of data entities, said access rights list comprising: a plurality of group identifiers, each of said group identifiers specifying one of said multiple categorical groups, said plurality of group identifiers specifying a subset of said multiple categorical groups to which said user has access rights; and a plurality of access rights values, each of said access rights values specifying access rights with respect to data entities which fall within a respective one of said categorical groups of said subset.
Claim 60
Dependent Claim
25 words
The access rights list according to claim 54, wherein said group identifiers are arranged in a numerical order to facilitate searches for individual group identifiers.
Claim 61
Dependent Claim
21 words
The access rights list according to claim 54, wherein said plurality of data entities represents content of an on-line services network.
Claim 62
Dependent Claim
17 words
The access rights list according to claim 54, stored within an access rights cache of a server.
Claim 63
Dependent Claim
18 words
The access rights list according to claim 54, stored within an access rights cache of a gateway computer.
Claim 64
Dependent Claim
153 words
A relational database for storing access rights data which specifies access rights of users with respect to a plurality of data entities of a computer network, said plurality of data entities subdivided into a plurality of categories, said database comprising: a first table that maps users to user groups, at least one of said users being a member of multiple of said user groups; a second table which contains, for each of said user groups, a group-based access rights list that specifies group-based access rights of members of a respective user group, said group-based access rights list stored in association with a plurality of category identifiers that identify said categories of data entities; and a third table which contains, for a least one of said users, a user-specific access rights list that specifies special rights for a respective user, said user-specific access rights list stored in association with said plurality of category identifiers.
Claim 65
Dependent Claim
153 words
A relational database for storing access rights data which specifies access rights of users with respect to a plurality of data entities of a computer network, said plurality of data entities subdivided into a plurality of categories, said database comprising: a first table that maps users to user groups, at least one of said users being a member of multiple of said user groups; a second table which contains, for each of said user groups, a group-based access rights list that specifies group-based access rights of members of a respective user group, said group-based access rights list stored in association with a plurality of category identifiers that identify said categories of data entities; and a third table which contains, for a least one of said users, a user-specific access rights list that specifies special rights for a respective user, said user-specific access rights list stored in association with said plurality of category identifiers.
Claim 66
Dependent Claim
25 words
The relational database according to claim 59, wherein said special rights are additional rights that are added to said group-based rights of said respective user.
Claim 67
Dependent Claim
24 words
The relational database according to claim 59, wherein said special rights are exclusion rights that are subtracted from said group-based rights said respective user.
Claim 68
Dependent Claim
19 words
The relational database according to claim 59, wherein said data entities are content objects of an on-line services network.
Claim 69
Dependent Claim
110 words
In a computer network in which different users have different access rights with respect to different data entities, a method of specifying the access rights of a user with respect to a plurality of data entities, comprising the steps of: assigning a category identifier to said plurality of data entities; storing said category identifier with or in association with each data entity of said plurality of data entities; and storing an access rights value in association with said category identifier and in further association with an account number of said user, said access rights value specifying said access rights of said user with respect to said plurality of data entities.
Claim 70
Dependent Claim
110 words
In a computer network in which different users have different access rights with respect to different data entities, a method of specifying the access rights of a user with respect to a plurality of data entities, comprising the steps of: assigning a category identifier to said plurality of data entities; storing said category identifier with or in association with each data entity of said plurality of data entities; and storing an access rights value in association with said category identifier and in further association with an account number of said user, said access rights value specifying said access rights of said user with respect to said plurality of data entities.
Claim 71
Dependent Claim
37 words
The method according to claim 63, wherein said access rights value comprises a plurality of privilege level bits, each of said privilege level bits corresponding to a respective privilege level which may be assigned to said user.
Claim 72
Dependent Claim
27 words
The method according to claim 63, wherein said access rights value specifies a sysop privilege level of said user with respect to said plurality of data entities.
Claim 73
Dependent Claim
44 words
The method according to claim 63, wherein said step of storing said category identifier comprises storing said category identifier in association with at least one node of a directory structure, said directory structure providing a directory to at least said plurality of data entities.
References Cited (Backward Citations)
US4184200A
Cited
US4280176A
Cited
US4493024A
Cited
US4432057A
Cited
US4799153A
Cited
US4800488A
Cited
US4899136A
Cited
US4799156A
Cited
US5151989A
Cited
US4914571A
Cited
US4858117A
Cited
US5499342A
Cited
US5347632A
Cited
US5291597A
Cited
US5079765A
Cited
US5341477A
Cited
US5113499A
Cited
US5481720A
Cited
US5140689A
Cited
US5187790A
Cited
US5247676A
Cited
US5321841A
Cited
US5265250A
Cited
US5455932A
Cited
US5475819A
Cited
US5257369A
Cited
US5551508A
Cited
US5367621A
Cited
US5388255A
Cited
US5444848A
Cited
US5355497A
Cited
US5307490A
Cited
US5526491A
Cited
US5497463A
Cited
US5371852A
Cited
US5329619A
Cited
US5548724A
Cited
US5596744A
Cited
US5491817A
Cited
US5396626A
Cited
US5500929A
Cited
US5463625A
Cited
US5596579A
Cited
US5553242A
Cited
US5617570A
Cited
US5548726A
Cited
US5491800A
Cited
US5483652A
Cited
US5544327A
Cited
US5423003A
Cited
US5666519A
Cited
US5564043A
Cited
US5675796A
Cited
US5473599A
Cited
US5544313A
Cited
US5434994A
Cited
US5490270A
Cited
US5559969A
Cited
US5619632A
Cited
US5581753A
Cited
US5553239A
Cited
US5491820A
Cited
US5617568A
Cited
US5608903A
Cited
US5530852A
Cited
US5513314A
Cited
US5608865A
Cited
US5592611A
Cited
US5650994A
Cited
US5675723A
Cited
US5696895A
Cited
US5774668A
Cited
US5572643A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-08-23 | 2003-02-22 | 2003-08-24 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-08-23 | 2007-02-22 | 2007-08-24 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-08-23 | 2011-02-22 | 2011-08-24 | $7700.00 | Window Closed / Lapsed |