System and method for managing objects and resources with access rights embedded in nodes within a hierarchical tree structure

Abstract

A system and method for controlling access to data within a hierarchically organized document, such as an XML document. Elements may have their access rights specified, for example as a variable in an XML tag. If not specified within an element of the document, access rights are inherited from its nearest ancestor. Specified access rights may refer to a collection of entitlement expressions, which describe with arbitrarily fine granularity which users and user types may access the data.

1 . A method of controlling access to a hierarchically organized collection of data elements, comprising: 
 receiving a document used in defining said data elements, said document including an entitlement ID as an attribute within a definition of a data element or optionally an attribute within a definition of one or more ancestor elements of the data element;    examining in succession said data element and optionally said one or more ancestor elements of the data element to determine an entitlement status for the element;    consulting said entitlement ID to determine an entitlement group corresponding to the entitlement status;    consulting a membership map to determine whether a selected user is a member of the entitlement group, wherein the membership map comprises a matrix of users and group memberships; and    allowing the user to access the data element only if the user is a member of the entitlement group.    
   
   
       2 . The method of  claim 1 , wherein the membership map is stored as a bit map.  
   
   
       3 . The method of  claim 1 , wherein the entitlement status in the data element or ancestor element is an entitlement expression.  
   
   
       4 . The method of  claim 1 , wherein the hierarchically organized collection of data elements is an XML document.  
   
   
       5 . The method of  claim 4 , wherein the XML document complies with the HIPAA standard.  
   
   
       6 . The method of  claim 1 , further comprising caching entitlement group definitions for the hierarchically organized collection of data elements prior to consulting the membership map.  
   
   
       7 . A method of describing access restrictions on individual elements of a document having a hierarchical structure, comprising: 
 placing entitlement ID's in definitions for one or more elements of the document, said entitlement ID's referring to entitlement expressions describing classes of users allowed to access the elements, where the entitlement ID applicable to an element is the ID placed in the element or in the first ancestor of the element having an entitlement ID.    
   
   
       8 . The method of  claim 7 , wherein the document is an XML document.  
   
   
       9 . The method of  claim 8 , wherein the entitlement ID's are variable settings on XML tags.  
   
   
       10 . The method of  claim 8 , wherein the XML document complies with HIPAA standards.  
   
   
       11 . The method of  claim 7 , wherein the document comprises a table of entitlement ID's and corresponding entitlement expressions.  
   
   
       12 . A method of providing a document having access restrictions described according to the method of  claim 7 , comprising: 
 consulting the entitlement ID's and comparing them with entitlement groups of the user; and    serving to the user those portions of the document which the user is authorized to receive.    
   
   
       13 . The method of  claim 12 , wherein user authorizations are stored in a membership map.  
   
   
       14 . The method of  claim 13 , wherein the membership map is a bit map.  
   
   
       15 . The method of  claim 12 , further comprising caching entitlement expressions in the document prior to serving to the user.