US6038563A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for restricting database access to managed object information using a permissions table that specifies access rights corresponding to user access rights to the managed objects
Assignee: Oracle America Inc
•
Filing: 1998-03-25
•
Granted: 2000-03-14
•
Expires: 2018-03-25
Abstract
Abstract An access control database has access control objects that collectively store information that specifies access rights by users to specified sets of the managed objects. The specified access rights include access rights to obtain management information from the network. An access control server provides users access to the managed objects in accordance with the access rights specified by the access control database. An information transfer mechanism sends management information from the network to a database management system (DBMS) for storage in a set of database tables. Each database table stores management information for a corresponding class of managed objects. An access control procedure limits access to the management information stored in the database tables using at least one permissions table. A permissions table defines a subset of rows in the database tables that are accessible to at least one of the users. The set of database table rows that are accessible corresponds to the managed object access rights specified by the access control database. A user access request to access management information in the database is intercepted, and the access control procedure is invoked when the user access request is a select statement. The database access engine accesses information in the set of database tables using the permissions tables such that each user is allowed access only to management information in the set of database tables that the user would be allowed by the access control database to access.
Inventors
- 👤 Subodh Bapat
- 👤 Bart Lee Fisher
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-28 06:11
CPC Classifications
H; H04; H04L; H04L41/00; H04L41/28; G; G06; G06F; G06F1/00; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6227; H04L41/02; H04L41/024; H04L63/00; H04L63/10; H04L63/101; G06F2221/00; G06F2221/21; G06F2221/2141; G06F2221/2145; Y; Y10; Y10S; Y10S707/00; Y10S707/99931; Y10S707/99932; Y10S707/99933; Y10S707/99936; Y10S707/99938; Y10S707/99939; Y10S707/99941; Y10S707/99942; Y10S707/99951; Y10S707/99952; Y10S707/99953
Claims Analysis
Total Claims: 15
Claim 1
Independent Claim
362 words
An access control system for controlling access to managed objects in a distributed network, comprising: an access control database, including access control objects, the access control objects collectively storing information that specifies access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network; at least one access control server for providing users access to the managed objects in accordance with the access rights specified by the access control database; a database management system; and an information transfer mechanism for sending the management information from the network to the database management system; the database management system including: a set of database tables for storing the management information sent by the information transfer mechanism, wherein each table in the set of database tables stores in individual rows management information for corresponding managed objects; at least one permissions table, including access permission objects, the access permission objects for collectively storing information that specifies the access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network, wherein the access rights of the access permission objects corresponds to the managed object access rights specified by the access control database for at least one of the users; means for intercepting a user access request to access management information in the database; means for invoking an access control procedure when the user access request is a select statement to access management information for any of the managed objects; the access control procedure for limiting access to the management information stored in the set of database tables, the access control procedure using the set of access rights stored in the at least one permissions table to define a permitted subset of rows in at least one of the database tables that are accessible, wherein the permitted subset of rows corresponds to the managed object access rights specified by the at least one permissions table for at least one of the users; and the database access engine for accessing the management information stored in the permitted rows in the set of database tables.
Claim 2
Dependent Claim
362 words
An access control system for controlling access to managed objects in a distributed network, comprising: an access control database, including access control objects, the access control objects collectively storing information that specifies access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network; at least one access control server for providing users access to the managed objects in accordance with the access rights specified by the access control database; a database management system; and an information transfer mechanism for sending the management information from the network to the database management system; the database management system including: a set of database tables for storing the management information sent by the information transfer mechanism, wherein each table in the set of database tables stores in individual rows management information for corresponding managed objects; at least one permissions table, including access permission objects, the access permission objects for collectively storing information that specifies the access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network, wherein the access rights of the access permission objects corresponds to the managed object access rights specified by the access control database for at least one of the users; means for intercepting a user access request to access management information in the database; means for invoking an access control procedure when the user access request is a select statement to access management information for any of the managed objects; the access control procedure for limiting access to the management information stored in the set of database tables, the access control procedure using the set of access rights stored in the at least one permissions table to define a permitted subset of rows in at least one of the database tables that are accessible, wherein the permitted subset of rows corresponds to the managed object access rights specified by the at least one permissions table for at least one of the users; and the database access engine for accessing the management information stored in the permitted rows in the set of database tables.
Claim 3
Dependent Claim
21 words
The system of claim 1 wherein the access control procedure accesses the permitted rows stored in the set of database tables.
Claim 4
Dependent Claim
29 words
The system of claim 1 wherein the access control procedure returns a list of permitted rows, and the select statement uses the returned list to access the permitted rows.
Claim 5
Dependent Claim
13 words
The system of claim 1 wherein the means for invoking is a trigger.
Claim 6
Dependent Claim
39 words
The system of claim 1 wherein the select statement causes a trigger to invoke the access control procedure and the access control procedure modifies at least one parameter of the select statement to access the permitted subset of rows.
Claim 7
Independent Claim
318 words
A method of controlling access to managed objects in a distributed network, comprising the steps of: storing an access control database, including access control objects, the access control objects collectively storing information that specifies access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network; sending management information from the network to a database management system; in the database management system: storing in a first set of database tables the management information sent by the information transfer mechanism, wherein each table in the set of database tables stores in individual rows the management information for corresponding managed objects; storing in at least one permissions table, including permission objects, the permission objects collectively storing information that specifies the access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network, wherein the access rights of the permission objects corresponds to the managed object access rights specified by the access control database for at least one of the users; intercepting a user access request to access management information stored in the database tables; invoking an access control procedure when the user access request is a select statement to access any of the set of database tables; limiting access, in the access control procedure, to the management information stored in the set of database tables, the access control procedure using the set of access rights stored in the at least one permissions table to define a permitted subset of rows in at least one of the database tables that are accessible, wherein the permitted subset of rows corresponds to the managed object access rights specified by the at least one permissions table for at least one of the users; and accessing management information stored in the permitted rows in the set of database tables.
Claim 8
Independent Claim
318 words
A method of controlling access to managed objects in a distributed network, comprising the steps of: storing an access control database, including access control objects, the access control objects collectively storing information that specifies access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network; sending management information from the network to a database management system; in the database management system: storing in a first set of database tables the management information sent by the information transfer mechanism, wherein each table in the set of database tables stores in individual rows the management information for corresponding managed objects; storing in at least one permissions table, including permission objects, the permission objects collectively storing information that specifies the access rights by users to specified sets of the managed objects, the specified access rights including access rights to obtain management information from the network, wherein the access rights of the permission objects corresponds to the managed object access rights specified by the access control database for at least one of the users; intercepting a user access request to access management information stored in the database tables; invoking an access control procedure when the user access request is a select statement to access any of the set of database tables; limiting access, in the access control procedure, to the management information stored in the set of database tables, the access control procedure using the set of access rights stored in the at least one permissions table to define a permitted subset of rows in at least one of the database tables that are accessible, wherein the permitted subset of rows corresponds to the managed object access rights specified by the at least one permissions table for at least one of the users; and accessing management information stored in the permitted rows in the set of database tables.
Claim 9
Dependent Claim
21 words
The method of claim 6 wherein the access control procedure accesses the permitted rows stored in the set of database tables.
Claim 10
Dependent Claim
29 words
The method of claim 6 wherein the access control procedure returns a list of permitted rows, and the select statement uses the returned list to access the permitted rows.
Claim 11
Dependent Claim
16 words
The method of claim 6 wherein a trigger is used to invoke the access control procedure.
Claim 12
Dependent Claim
39 words
The method of claim 6 wherein the select statement causes a trigger to invoke the access control procedure and the access control procedure modifies at least one parameter of the select statement to access the permitted subset of rows.
Claim 13
Dependent Claim
31 words
The method of claim 10, further including the step of updating the at least one permissions table for a specified set of users and a specified subset of the managed objects.
Claim 14
Dependent Claim
21 words
The method of claim 11, wherein the updating step is invoked when a new managed object is added to the network.
Claim 15
Dependent Claim
18 words
The method of claim 11, wherein the updating step is invoked when the specified access rights are changed.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-03-14 | 2003-09-13 | 2004-03-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-03-14 | 2007-09-13 | 2008-03-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-03-14 | 2011-09-13 | 2012-03-14 | $7700.00 | Window Closed / Lapsed |