Assigning Security Levels to Particular Documents on a Document by Document Basis in a Database

The present invention relates to a system and method for providing a security database for HTML (hypertext markup language) documents in a world wide web application. In particular, the security database allows security to be assigned to particular documents on a document by document basis.

A microfiche appendix, containing one (1) microfiche and 21 total frames is filed herewith.

With the increased number of internet users and the ease of accessibility of the World Wide Web, there is an increasing demand for the use of the Web as a vehicle for distributed applications. These distributed applications are composed of HTML documents and can be accessed by various Web browsers, such as Netscape Navigator or Microsoft Internet Explorer. Hypertext links relate the documents to each other and give users a way to navigate from one file to another.

These distributed applications require security to limit access to valid users. Currently, a typical approach to providing security for HTML documents requires the server directory and subdirectories where the HTML documents are located to be secured at the same level. This means that an individual user can have access to all the documents in the directory or access to none of the documents in the directory based on an appropriate user id and password. Another drawback of this typical approach is that this approach depends upon the naming convention used for the subdirectories and thus makes porting of the application (and all of the associated HTML documents) to another server difficult.

There is a need for a system and method for providing required security levels to particular documents in distributed applications on a document by document basis (or groups of documents or any combination).

In accordance with the teachings of the present invention, a system and method of providing a security database for HTML documents in a world wide web application are provided.

It is an important feature of the present invention that user access to individual HTML documents (or groups of documents) can be determined and controlled.

It is also an important feature of the present invention that the applications (or documents in an application) can be ported to other servers since the applications do not rely on the directory structure to provide security.

Additional benefits and advantages of the present invention will become apparent to those skilled in the art to which this invention relates from the subsequent description of the preferred embodiments and the appended claims, taken in conjunction with the accompanying drawings, in which:

FIG. 1 is a block diagram of a system of the present invention;

FIG. 2 is a block diagram of a User Table for use with the present invention;

FIGS. 3A and 3B are block diagrams of a File Table for use with the present invention; and

FIG. 4 is a flowchart of the method of the present invention.

A portion of the disclosure of this patent document contains material which is subject to copyright protection and to which a claim of copyright protection is made. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyrights and similar rights whatsoever.

Referring now to the drawings, in which like-referenced characters indicate corresponding elements throughout the several views, attention is first drawn to FIG. 1 which shows a block diagram of the system 10 for providing a security database for HTML documents in a WWW application. The system 10 includes a plurality of PCs 20A through 20N or other client terminals which have access to the Internet. PCs 20A through 20N include a web browser such as Netscape Navigator or Microsoft Internet Explorer. PCs 20A through 20N also include an input device such as a keyboard or a mouse and other standard components such as memory, display, microprocessor, etc.

The system 10 also includes a plurality of servers 12A through 12X or other large storage devices also connected to the Internet. Each server 12A, 12B , . . . 12N may include a database having specified files or the server may not initially include a database at all such as 12X. The databases included may be any commonly available databases. Examples include Access (available from Microsoft), Dbase (available for Ashton-Tate), etc. Each server 12A, 12B, 12N also includes a CGI (common gateway interface) script file (CGI-A, CGI-B, etc.) for passing information from the PCs via the browsers to the servers and from the servers via the browsers to the PCs. The required CGI script files can be built with just about any programming or scripting language (for example, C) that the user's servers support. The CGI code provides the interface with the server and passes and receives the information between the database in the server and the user terminal. A sample of CGI code is included at the end of this description. The sample CGI code also includes an invention-specific or customized module entitled "Module 2" which provides specific examples of code for checking security levels and granting access and downloading HTML files according to the present invention.

In discussing FIGS. 2, 3A and 3B, exemplary database A in server 12A will be described. This description applies to the other databases located in the other servers. Additionally, server 12X does not initially include a database. However, according to the present invention, any desired database from one of the other servers can be ported to server 12X without the difficulties normally encountered when moving or copying a grouping of files from one server to another server when the files are located in the directory structure.

Referring first to FIG. 2, database A includes a User Table 100 which is basically used to keep track of users. The User Table may include fields such as user name 110, user identification (id) 120, user password 130, user security level 140 and user group 150. Additional fields may be included or some of the above fields may be deleted as long as the User Table contains enough information to accurately identify a user requesting a document and provide the security level (or privileges) corresponding to that user.

Referring next to FIGS. 3A and 3B, database A also includes a Files Table 200 which is basically used to control access to individual HTML documents. The Files Table 200 may include fields such as security level 210, user group 220, file name 230 and HTML code 240. Additional fields may be included or some of the above fields may be deleted as long as the Files Table contains enough information to accurately determine if a requested document is contained in the database and whether a user requesting a document should be given access to the document. If the user is given access, then the code (or file) in the HTML code field 240 is passed to the user (through the user's browser) To provide the HTML code field to the user, the customized CGI module passes the code (or file) to the user verbatim with the following exception. In any hypertext links to other documents, referenced by <A HREF=filename> HTML tags, the specific file name is replaced with a reference to the customized CGI module and the file name is appended as a parameter.

For example:

<A HREF="filename" is replaced with

<A HREF="invent.exe?Name=UserName&file=filename"

In this way the customized CGI module can interact with the user's web browser and invoke the correct hypertext link to other files in the database. This process allows the passing of the file to the user to occur without any noticeable difference from a server with security protection for the entire server or subdirectory because the user's inquiry for a specific HTML file calls the customized CGI module which handles the processing of the user's security level and user group and the file's required security level and user group. Thus, although the present invention provides flexibility in allowing access to various documents on a server, the user interface is virtually the same as standard systems which do not provide varying security levels for documents on the same server or in the same directory.

FIG. 4 shows a flowchart of the method for providing a security database for HTML documents in WWW applications. First in step 310, a user requests access to a file, preferably using a web browser. Then in step 320, the web browser interacts with cgi script files in servers 12A through 12N until the desired file, which is embedded in a database, is located in a particular server. Alternatively, a user could request a list of all files located in a particular database and select a desired file from that list. Next in step 330, the cgi script file of the particular server uses the user id and the user password to determine the assigned security level and user group in the User Table 100.

Then in step 340, the cgi script file compares the user's security level and user group with those required in the Files Table 200 corresponding to the desired file. In step 350, it is determined whether the user has the required security level and user group to access the desired file. If yes, then in step 360, the information in the HTML Code field 240 of Files Table 200 is provided to the user's browser as described above. Thus the user is provided a first document or web page. If the user requests a different file in the same server then in step 370, the step of comparing the user's security level and user group with those required in the Files Table 200 corresponding to the new desired file is performed. If the user does not request a different file in the same server then the process is ended in step 390. (Of course, if the user requests access to a file in another server, then the user's browser must interact with the cgi script files in all the servers until the desired file embedded in the database of the new server is located.)

If a user requests access to a document and does not have the required security level and user group for the desired document, then the user is informed that access has been denied in step 380. Then the process ends in step 390.

An advantage of the present invention is that user access to individual HTML documents (or groups of documents) can be determined and controlled.

Another advantage of the present invention is that applications (or documents in an application) can be ported to other servers since the applications do not rely on the directory structure to provide security. Rather the documents are located in the database.

Although the invention has been described with the use of an example CGI script file and related customized module of the CGI file, it is contemplated that any coding which provides the functions as discussed with respect to the above files is contemplated within the scope of the present invention. Additionally, although the program providing the fields has been described as a database, any program which can provide fields to be accessed and compared according to the description is contemplated within the scope of the present invention.

Although the invention has been described with particular reference to certain preferred embodiments thereof, variations and modifications of the present invention can be effected within the spirit and scope of the following claims.