US6047377A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Typed, parameterized, and extensible access control permissions
Assignee: Oracle America Inc
•
Filing: 1997-12-11
•
Granted: 2000-04-04
•
Expires: 2017-12-11
Abstract
Abstract A method and apparatus for establishing and maintaining complex security rules is provided. The security rules are established through the use of "permission" classes that take advantage of the power and simplicity various features of object oriented programming, including the ability to inherit attributes and methods. For example, a permission super class is established that defines an interface to a validation method. A permission subclass may then be created which provides an implementation of the validation method. When invoked, the validation method indicates whether a given permission represented by one object belonging to a permission class encompasses the permission represented by another object belonging to a permission class. Classes are also provided for grouping permissions into sets, and for establishing protection domains for classes of objects.
Inventors
- 👤 Li Gong
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 18:40
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/52; G06F2221/00; G06F2221/21; G06F2221/2145
Claims Analysis
Total Claims: 27
Claim 1
Independent Claim
77 words
A method for providing security, the method comprising the steps of: establishing a permission class; wherein each permission object that is a member of said permission class represents at least one permission to perform an action; wherein said permission class includes a validation method; and wherein said validation method, when invoked for a particular permission object belonging to said permission class, indicates whether a specified permission is encompassed by a permission represented by the particular permission object.
Claim 2
Independent Claim
77 words
A method for providing security, the method comprising the steps of: establishing a permission class; wherein each permission object that is a member of said permission class represents at least one permission to perform an action; wherein said permission class includes a validation method; and wherein said validation method, when invoked for a particular permission object belonging to said permission class, indicates whether a specified permission is encompassed by a permission represented by the particular permission object.
Claim 3
Dependent Claim
39 words
The method of claim 1, wherein: the step of establishing a permission class includes establishing a permission subclass that is a descendant of a permission super class; and the permission super class defines an interface of said validation method.
Claim 4
Dependent Claim
75 words
The method of claim 2, further including the steps of: obtaining a first permission object, wherein said first permission object belongs to said permission subclass; obtaining a second object, wherein said second object belongs to a descendent class of the permission super class; and determining whether a first permission represented by said first permission object encompasses a second permission represented by said second object by invoking a validation method associated with said first permission object.
Claim 5
Dependent Claim
24 words
The method of claim 3, wherein the step of obtaining a second object includes obtaining a second object that belongs to said permission subclass.
Claim 6
Dependent Claim
30 words
The method of claim 3, wherein the step of obtaining a second object includes obtaining a second object that belongs to a class that is different from said permission subclass.
Claim 7
Dependent Claim
46 words
The method of claim 5, wherein: the method further includes the step of receiving a request to perform a particular action; and the step of obtaining said second object includes the step of obtaining said second object based on said request to perform said particular action.
Claim 8
Dependent Claim
45 words
The method of claim 6, wherein the step of determining whether said first permission represented by said first permission object encompasses said second permission represented by said second object includes sending to the validation method of said first object data that identifies the second object.
Claim 9
Dependent Claim
109 words
The method of claim 4, further including the steps of: obtaining a first permission object, wherein said first permission object belongs to said permission subclass, wherein said first permission object specifies a first action and a first target; obtaining a second object, wherein said second object belongs to a descendent class of the permission super class, wherein said second object specifies a second action and a second target; and determining whether a first permission represented by said first permission object encompasses a second permission represented by said second object by determining whether said first action encompasses said second action and determining whether said first target encompasses said second target.
Claim 10
Dependent Claim
54 words
The method of claim 3, further including the steps of obtaining a permission collection object associated with a plurality of permission objects, wherein said permission collection object includes a group validation method which, when invoked, indicates whether a specified permission is encompassed by at least one permission represented by said plurality of permission objects.
Claim 11
Dependent Claim
47 words
The method of claim 3, wherein: the step of establishing a permission class includes establishing a permission subclass that is a descendant of a permission super class; and the permission super class defines an interface of said validation method without providing an implementation for said validation method.
Claim 12
Dependent Claim
114 words
A computer-readable medium carrying one or more sequences of one or more instructions for providing security, the one or more sequences of the one or more instructions including instructions which, when executed by one or more processors, cause the one or more processors to perform the steps of: establishing a permission class; wherein each permission object that is a member of said permission class represents at least one permission to perform an action; wherein said permission class includes a validation method; and wherein said validation method, when invoked for a particular permission object belonging to said permission class, indicates whether a specified permission is encompassed by a permission represented by the particular permission object.
Claim 13
Dependent Claim
114 words
A computer-readable medium carrying one or more sequences of one or more instructions for providing security, the one or more sequences of the one or more instructions including instructions which, when executed by one or more processors, cause the one or more processors to perform the steps of: establishing a permission class; wherein each permission object that is a member of said permission class represents at least one permission to perform an action; wherein said permission class includes a validation method; and wherein said validation method, when invoked for a particular permission object belonging to said permission class, indicates whether a specified permission is encompassed by a permission represented by the particular permission object.
Claim 14
Dependent Claim
41 words
The computer readable medium of claim 11, wherein: the step of establishing a permission class includes establishing a permission subclass that is a descendant of a permission super class; and the permission super class defines an interface of said validation method.
Claim 15
Dependent Claim
83 words
The computer readable medium of claim 12, further including one or more instructions for performing the steps of: obtaining a first permission object, wherein said first permission object belongs to said permission subclass; obtaining a second object, wherein said second object belongs to a descendent class of the permission super class; and determining whether a first permission represented by said first permission object encompasses a second permission represented by said second object by invoking a validation method associated with said first permission object.
Claim 16
Dependent Claim
56 words
The computer readable medium of claim 13, wherein: the computer readable medium further includes one or more instructions for performing the step of receiving a request to perform a particular action; and the step of obtaining said second object includes the step of obtaining said second object based on said request to perform said particular action.
Claim 17
Dependent Claim
47 words
The computer readable medium of claim 14, wherein the step of determining whether said first permission represented by said first permission object encompasses said second permission represented by said second object includes sending to the validation method of said first object data that identifies the second object.
Claim 18
Dependent Claim
117 words
The computer readable medium of claim 12, further including one or more instructions for performing the steps of: obtaining a first permission object, wherein said first permission object belongs to said permission subclass, wherein said first permission object specifies a first action and a first target; obtaining a second object, wherein said second object belongs to a descendent class of the permission super class, wherein said second object specifies a second action and a second target; and determining whether a first permission represented by said first permission object encompasses a second permission represented by said second object by determining whether said first action encompasses said second action and determining whether said first target encompasses said second target.
Claim 19
Dependent Claim
62 words
The computer readable medium of claim 11, further including one or more instructions for performing the steps of obtaining a permission collection object associated with a plurality of permission objects, wherein said permission collection object includes a group validation method which, when invoked, indicates whether a specified permission is encompassed by at least one permission represented by said plurality of permission objects.
Claim 20
Dependent Claim
49 words
The computer readable medium of claim 11, wherein: the step of establishing a permission class includes establishing a permission subclass that is a descendant of a permission super class; and the permission super class defines an interface of said validation method without providing an implementation for said validation method.
Claim 21
Dependent Claim
94 words
A computer system comprising: a processor; a memory coupled to said processor; said processor being configured to establish a permission super class, wherein the permission super class defines an interface of a validation method; and said processor being configured to establish a permission subclass of the permission super class, wherein said permission subclass provides an implementation for said validation method, wherein said validation method, when invoked for a particular permission object belonging to said permission subclass, indicates whether a given permission is encompassed within a permission that is represented by said particular permission object.
Claim 22
Dependent Claim
94 words
A computer system comprising: a processor; a memory coupled to said processor; said processor being configured to establish a permission super class, wherein the permission super class defines an interface of a validation method; and said processor being configured to establish a permission subclass of the permission super class, wherein said permission subclass provides an implementation for said validation method, wherein said validation method, when invoked for a particular permission object belonging to said permission subclass, indicates whether a given permission is encompassed within a permission that is represented by said particular permission object.
Claim 23
Dependent Claim
26 words
The computer system of claim 19, wherein the permission super class defines said interface of said validation method without defining any implementation of the validation method.
Claim 24
Dependent Claim
91 words
The computer system of claim 19, wherein: said processor is configured to create a first permission object in said memory; said first permission object belongs to said permission subclass; said processor is configured to create a second object in said memory, said second object belongs to a descendant class of the permission super class; and said processor is configured to determine whether a first permission represented by said first permission object encompasses a second permission represented by said second object by invoking a validation method associated with said first permission object.
Claim 25
Dependent Claim
44 words
The computer system of claim 21, wherein: said processor is configured to receive a request to perform a particular action; and said processor is configured to create said second object by obtaining said second object based on said request to perform said particular action.
Claim 26
Dependent Claim
51 words
The computer system of claim 22, wherein said processor is configured to determine whether said first permission represented by said first permission object encompasses said second permission represented by said second object by passing as a parameter to the validation method of said first object data that identifies the second object.
Claim 27
Dependent Claim
122 words
The computer system of claim 19, wherein: said processor is configured to create a first permission object in said memory; said first permission object belongs to said permission subclass; said first permission object specifies a first action and a first target; said processor is configured to create a second object in said memory; said second object belongs to a subclass of the permission super class; said second object specifies a second action and a second target; and said processor is configured to determine whether a first permission represented by said first permission object encompasses a second permission represented by said second object by determining whether said first action encompasses said second action and determining whether said first target encompasses said second target.
References Cited (Backward Citations)
US4919545A
Cited
US5261102A
Cited
GB2259590A
Cited
US5421011A
Cited
US5311591A
Cited
US5577252A
Cited
US5761498A
Cited
US5742759A
Cited
GB2308688A
Cited
US5787427A
Cited
US5815657A
Cited
US5781633A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-04-04 | 2003-10-04 | 2004-04-04 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-04-04 | 2007-10-04 | 2008-04-04 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-04-04 | 2011-10-04 | 2012-04-04 | $7700.00 | Window Closed / Lapsed |