US6308173B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Methods and arrangements for controlling resource access in a networked computing environment
Assignee: Microsoft Technology Licensing LLC
•
Filing: 2000-02-10
•
Granted: 2001-10-23
•
Expires: 2020-02-10
Abstract
Abstract A unified and straightforward approach to managing file and other resource security in a networked computing environment is disclosed. The invention can be implemented in a multi-user computer network that includes a client computer, a server computer that controls a resource sharable among users of the network, such as a shared file folder or directory, and a communications pathway between the client computer and the server computer. The resource is organized as a hierarchy of elements with a root elemnent at the top of the hierarchy and additional elements below the root element. According to the invention, a request is received to change a protection, such as an access permission, of an element of the resource hierarchy (other than the root) with respect to a particular network user. If the element in question lacks an associated access control list, a nearest ancestor element of the hierarchy is located that has an associated access control list. The first (descendant) element inherits the access control list of the second (ancestor) element. This inheritance is done by generating a copy of the access control list of the second element and associating the generated copy with the first element. The requested change in protection is then incorporated into the generated copy that has been associated with the first element so as to establish an updated access control list for the first element. Further, the requested change can be propagated downwards in the hierarchy from the first element to its descendants having access control lists.
Inventors
- 👤 Daniel S. Glasser
- 👤 Ann Elizabeth McCurdy
- 👤 Robert M. Price
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-08 20:59
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/20; G; G06; G06F; G06F16/00; G06F16/10; G06F16/18; G06F16/185; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; H04L63/10; H04L63/101; G06F2221/00; G06F2221/21; G06F2221/2145; Y; Y10; Y10S; Y10S707/00; Y10S707/99931; Y10S707/99939; Y10S707/99941; Y10S707/99944
Claims Analysis
Total Claims: 15
Claim 1
Independent Claim
170 words
A method in a computer system for providing access control in a file system hierarchy, the file system hierarchy comprising a plurality of nodes arranged hierarchically such that each node may have one or more ancestor nodes and one or more descendant nodes, each node further capable of having an access control list identifying users that are permitted to access the node, the method comprising the steps of: receiving a request to modify, for a specified node having an access control list, the list of users permitted to access the specified node; modifying the access control list of the specified node in accordance with the received request; displaying a prompt for user input indicating whether the requested modification should be propagated to a descendant node of the specified node; and selectively merging the requested modification into an access list associated with the descendant node only if user input received in response to displaying the prompt indicates that the requested modification should be propagated to the descendant of the specified node.
Claim 2
Independent Claim
170 words
A method in a computer system for providing access control in a file system hierarchy, the file system hierarchy comprising a plurality of nodes arranged hierarchically such that each node may have one or more ancestor nodes and one or more descendant nodes, each node further capable of having an access control list identifying users that are permitted to access the node, the method comprising the steps of: receiving a request to modify, for a specified node having an access control list, the list of users permitted to access the specified node; modifying the access control list of the specified node in accordance with the received request; displaying a prompt for user input indicating whether the requested modification should be propagated to a descendant node of the specified node; and selectively merging the requested modification into an access list associated with the descendant node only if user input received in response to displaying the prompt indicates that the requested modification should be propagated to the descendant of the specified node.
Claim 3
Dependent Claim
64 words
The method of claim 1 , further including the step of determining that the descendant node does not have an existing access control list, and wherein the selectively merging step includes the step of copying the access control list of the specified node, as modified in the modifying step, to the descendant node to form the access control list associated with the descendant node.
Claim 4
Independent Claim
180 words
A method in a computer system for providing access control in a file system hierarchy, the file system hierarchy comprising a plurality of nodes arranged hierarchically such that each node may have one or more ancestor nodes and one or more descendant nodes, each node further capable of having associated with it an access control list identifying users that are permitted to access the node, the method comprising the steps of: receiving a request to modify, for a specified node having an access control list, the list of users permitted to access the specified node; modifying the access control list of the specified node in accordance with the received request; displaying a prompt for user input selecting one or more nodes that are descendants of the specified node to which the requested modification should be propagated; receiving user input selecting one or more nodes that are descendants of the specified node to which the requested modification should be propagated; and selectively merging the requested modification into access lists associated with the descendant nodes as selected by the received user input.
Claim 5
Independent Claim
180 words
A method in a computer system for providing access control in a file system hierarchy, the file system hierarchy comprising a plurality of nodes arranged hierarchically such that each node may have one or more ancestor nodes and one or more descendant nodes, each node further capable of having associated with it an access control list identifying users that are permitted to access the node, the method comprising the steps of: receiving a request to modify, for a specified node having an access control list, the list of users permitted to access the specified node; modifying the access control list of the specified node in accordance with the received request; displaying a prompt for user input selecting one or more nodes that are descendants of the specified node to which the requested modification should be propagated; receiving user input selecting one or more nodes that are descendants of the specified node to which the requested modification should be propagated; and selectively merging the requested modification into access lists associated with the descendant nodes as selected by the received user input.
Claim 6
Dependent Claim
195 words
In a computer network having a plurality of users and comprising a server computer controlling a shareable resource organized as a hierarchy of elements, the hierarchy including a root element at a topmost point in the hierarchy and additional elements that are descendants of the root element in the hierarchy, a method of modifying attributes of the resource, the method comprising the computer-implemented steps of: receiving a request to change an attribute of a first element of the hierarchy with respect to a user of the network, the first element being a specified one of the additional elements; in response to the receiving step, determining whether the first element has an associated list of attributes; upon determining that the first element lacks an associated list of attributes, identifying a second element of the hierarchy, the second element having an associated list of attributes and being a proximate ancestor of the first element in the hierarchy; and based on the list of attributes associated with the second element, selectively generating and associating the list of attributes with the first element, such that the resulting list of attributes associated with the first element includes the requested change.
Claim 7
Dependent Claim
195 words
In a computer network having a plurality of users and comprising a server computer controlling a shareable resource organized as a hierarchy of elements, the hierarchy including a root element at a topmost point in the hierarchy and additional elements that are descendants of the root element in the hierarchy, a method of modifying attributes of the resource, the method comprising the computer-implemented steps of: receiving a request to change an attribute of a first element of the hierarchy with respect to a user of the network, the first element being a specified one of the additional elements; in response to the receiving step, determining whether the first element has an associated list of attributes; upon determining that the first element lacks an associated list of attributes, identifying a second element of the hierarchy, the second element having an associated list of attributes and being a proximate ancestor of the first element in the hierarchy; and based on the list of attributes associated with the second element, selectively generating and associating the list of attributes with the first element, such that the resulting list of attributes associated with the first element includes the requested change.
Claim 8
Dependent Claim
45 words
The method of claim 4 , wherein the step of receiving a request comprises receiving a request to change an attribute of the first element with respect to all users in a user group, the user group comprising a collection of users of the network.
Claim 9
Dependent Claim
44 words
The method of claim 4 , wherein the step of receiving a request to change an attribute of a first element of the hierarchy with respect to a user of the network comprises receiving a request to add an attribute related to said user.
Claim 10
Dependent Claim
44 words
The method of claim 4 , wherein the step of receiving a request to change an attribute of a first element of the hierarchy with respect to a user of the network comprises receiving a request to modify an attribute related to said user.
Claim 11
Dependent Claim
44 words
The method of claim 4 , wherein the step of receiving a request to change an attribute of a first element of the hierarchy with respect to a user of the network comprises receiving a request to remove an attribute related to said user.
Claim 12
Dependent Claim
67 words
The method of claim 4 , wherein: the step of receiving a request to change an attribute of a first element of the hierarchy comprises receiving a request to remove an attribute related to all users of the network; and the step of selectively generating and associating a list of attributes with the first element comprises providing an empty list of attributes associated with the first element.
Claim 13
Dependent Claim
61 words
The method of claim 4 , further comprising the step of: propagating the requested change downwards in the hierarchy from the first element to every element of the hierarchy that is a descendant of the first element in the hierarchy and has an associated list of attributes by merging the requested change into the list of attributes of every such element.
Claim 14
Dependent Claim
74 words
The method of claim 4 , further comprising the steps of: identifying a third element of the hierarchy, the third element having an associated list of attributes and being a descendant of the first element in the hierarchy; and upon identifying the third element, propagating the requested change downwards in the hierarchy from the first element to the third element by merging the requested change into the list of attributes of the third element.
Claim 15
Dependent Claim
76 words
The method of claim 4 wherein the computer network further comprises a client computer and a communications pathway between the client computer and the server computer, and further comprising the steps of: issuing from the client computer a request for a user of the network to access an element of the resource; receiving the issued request in the server computer; and responding to the issued request in a manner consistent with the updated list of attributes.
References Cited (Backward Citations)
US5220657A
Cited
US5335346A
Cited
US5129083A
Cited
US5136712A
Cited
US5048085A
Cited
US5263158A
Cited
US5459863A
Cited
US5237679A
Cited
US5388196A
Cited
US5173939A
Cited
US5315657A
Cited
US5410705A
Cited
US5450593A
Cited
US5469576A
Cited
US5463774A
Cited
US5615400A
Cited
US5495533A
Cited
US5778222A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-10-22 | 2005-04-23 | 2005-10-23 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-10-22 | 2009-04-23 | 2009-10-23 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-10-22 | 2013-04-23 | 2013-10-23 | $7700.00 | Window Closed / Lapsed |