Process for simultaneous user access using access control structures for authoring systems

[0001] 1. Field of the Invention

[0002] The present invention relates to the field of distributed authoring systems, and more particularly pertains to the implementing of authoring controls within the authoring system. Moreover, specifically the invention is directed to providing the authoring system with an improved and novel process of enabling access to the system for simultaneous users employing access control structures through the intermediary of an access control engine which is adapted to select criteria to provide system access to selective authors or users while incorporating a mechanism for dynamically enforcing the authoring controls.

[0003] In essence, authoring systems, which may also be known as authoring tools or authorware in technological and commercial applications, may be programs existing in hypertext and multimedia applications. Pursuant to more sophisticated applications, in internet, on-line or CD-ROM programs, the authoring systems may be scripting language or graphics elements, or may even represent a mixture of textual (teaching tools, printed works and the like) material, graphical representations, audio data and numerous, practically unlimited types of objects or programs. These authoring systems are ordinarily developed and designed by authors who define the relationships of the foregoing aspects with each other, and sequencing the programs in an appropriate order for data storage.

[0004] 2. Discussion of the Prior Art

[0005] In the present state of the technology and industry, authoring systems are adapted to control authoring access, generally to an authoring system utilizing various control parameters such as check-in/check-out, access control lists, profiles and predefined roles which are assigned to various authors of the system.

[0006] In various of the presently developed and known authoring systems, the access control mechanisms which facilitate access to the authoring system are specified or predefined by the system itself; whereas, other authoring systems do not provide access control systems or similar arrangements.

[0007] In order to obviate and overcome the limitations encountered in present authoring systems, a primary aspect of the present invention resides in the provision of an improved access control engine for authoring systems which includes a mechanism for dynamically enforcing authoring controls. The dynamically enforcing authoring control mechanism enables one or more users such as readers or authors to gain access to the authoring system, whereby multiple users may be afforded serial access the authoring system; or users may access the authoring system simultaneously or in an overlapping order in accordance with predetermined criteria or conditions established by the access control engine and enforced by the control mechanism for the authoring systems.

[0008] Attributes, logic and values are used to enforce multiple access in the present authoring system. Multiple access is an application of the access control engine (Improved Access Control Engine for Authoring Systems) against these attributes, logic and values. Access enforcement is dynamic, because roles, which contain the attributes, logic and values, can be created dynamically. An individual user's access can change based on 1) a role changing dynamically, or 2) other users entering/exiting the system. In the inventive authoring system, an attribute is a named field associated with content, display components and/or other system elements, and is used to tag a set of values with meaning. An attribute can be used to implement field level access with the appropriate logic. The same attribute can also be used to define custom multiple author relationships. It is not the field level access itself that is important, but that field level access can be used to define multiple author relationships.

[0009] Others systems' authoring access is not as tightly tied to content or display. The present authoring system provides an improved and more granular method of controlling authoring relationships, because applicants' system has an access control engine with the ability to handle attributes, logic and values associated with content and display. For example, applicants' authoring system can control access down to the values associated with a specific attribute.

[0010] Pursuant to the invention, the applicants implement authoring control directly via attributes, logic and values at document selection time. Other systems use second pass logic, which requires opening the document to check access.

[0011] In essence, the authoring system utilizes different parameters or criteria in order to provide reader or author (user) access thereto through the process of employing the access control engine and control structures pursuant to the invention.

[0012] Basically, these parameters or criteria include:

• • [0013] a) Userid (User identification)—which is designed to uniquely identify a user or number of users intending to gain permission for access to the authoring system;
  • [0014] b) Active flag—providing for indication that a particular user is logged into the authoring system;
  • [0015] c) Role—is utilized to group users by related functionality, which is implemented by attributes, logic and values, as defined hereinbelow;
  • [0016] d) Attribute—is a named field which is associated with content, display components, and/other system elements; and is utilized to tag or impart a set of values with a specific meaning or meanings;
  • [0017] e) Logic—utilizes boolean logic in order to test a given value against the value of a corresponding attribute in content, display component and/or other system element;
  • [0018] f) Value—defines a constant which is utilized in tabled logic, which is compared with corresponding constants which are assigned to content, display component or system element attributes;
  • [0019] g) Choice components—defines a list of that display component or those display components available to a role for both selection and display mechanisms, and which ties specific display-logic to content attributes;
  • [0020] h) Which display component—list of which particular set of logic is to be used against the attribute in the display mechanism;
  • [0021] i) Permissions—to implement the “access authority of the system” for a specific role as set forth in c) hereinabove.

[0022] The foregoing parameters or criteria are employed in that an improved and novel simultaneous user access process pursuant to the invention resolves access control or privileges in the authoring system, utilizing information from both an active user table and an access control structure table. In that instance, the roles are a membership structure utilized to group common functionality and to tie logic to attributes and values. Thus, the roles set forth in an access control table eliminate the need for author profiles in the authoring system, and by introducing logic and display components in the access control engine it is possible to obviate the need for having to execute logic subsequently, as do databases with their views. In the present authoring system, there is no distinction between authors and readers, and a person designated to multiple roles is imparted the combined functionality is of all of the roles. Hereby, functionality defined by the attributes, logic and values, and wherein every access is conveyed to the inventive access control engine, imparting the authoring system with the ability to dynamically reflect changes in the system.

[0023] The invention is an improved process of using a system for specifying and customizing an interface as a special case of authoring functionality. Changes in selection and display format privileges as specified by roles, attributes and logic are immediately reflected in modified interfaces. This eliminates the need for multiple separate interfaces. Both the content selected and how it is displayed are affected by the presence of other authors in the system. This flexible system allows for the customized definition of interfaces with differing function and scope of the content they access. This allows the distributed author, for example, faculty working with students on a project via networked personal electronic writing tablets, parents exchanging notes on an electronic home bulletin board with children, or primary writers collaborating with others via the Internet on a book, to easily specify and dynamically update the multiple interfaces.

[0024] Accordingly, it is an object of the present invention to provide an improved and novel process imparting access to authoring systems to simultaneous users of the system.

[0025] A further object of the present invention resides in the provision of a novel process for enabling simultaneous user access by means of access control structures adapted to implement controls within an authoring system.

[0027] Referring in detail to the single drawing figure, there is illustrated an authoring system 10 including an access control engine 12. The access control engine 12 resolves access control or privileges imparted to a user or plurality of users in the authoring system, utilizing information data, from both an active user table 14 and an access control structure table 16, and with data flow between the components 12 and 14, and respectively, components 12 and 16 of the authoring system 10.

[0028] A build mechanism 18 provides for appropriate variable data information and instructions from an external source to be imparted to and direct the access control engine 12, and is adapted to introduce logic and display components into the access control engine.

[0029] A selection mechanism 20 derives appropriate information, for subsequent transmission to a display mechanism 22, from a data store 24 having attribute contents stored therein, and from a further data store 26 having display components stored therein for selectively relaying the foregoing data to the display mechanism 22. The latter conveys displaying information to a multi-user process 28 in the access control engine 12.

[0030] Thus, as shown in particular, through the Active User Table 14, a user (i.e. reader, author) U may be assigned an active status by setting an Active Flag, indicating that the user has been logged into the authoring system 10 responsive to the Userid (User identification) assigned to the user.

[0031] The foregoing user assignment as in the Table 14, may be for any number of users U₁, U₂, - - - U_x, who may be assigned different roles imparting access to the authoring system 10, which may be used to group users by related functionality, as defined by attributes, logic and values. Thus, the Active User Table 14 which identifies the Userid, Active Flag and Role, leads to boolean logic to test a given value against a corresponding Attribute value in the content, display component and/or other authoring system constituents. The role assigned to a particular user may be predetermined by the data supplied to the access control engine 12 by the build mechanism 18, so as to impart to the user specific types of authorities, such as being capable of only reading the author material, or editing the author material at any particular site or sites.

[0032] Moreover, by way of example, a user or multiple users may be imparted further roles enabling him or them to access author material at different geographic locations; for instance, a user in New York may be empowered to gain access to author material in New York, Chicago or Los Angeles. Moreover, the user may possibly be empowered to only “read” material in Chicago and Los Angeles, while being able to “edit” the author material in New York, although numerous permutations and different attributes may be assigned to any particular user or users at any specific location or locations in accordance with data supplied to the active user table 14 from the access control engine 12.

[0033] The access control structure table 16 assigns to the particular user or users a role, various attributes, (boolean) logic values, choice components and permission for accessing which define the different types of access the user may have by means of the access control engine 12, wherein the table contains the foregoing information which has been imparted thereto through the access control engine 12 by data from the build mechanism 18, which was imputted from an external source or authority. In that instance, the build mechanism 18 assembles or builds the informative/data elements which are needed by the access control engine 12 to provide the required information and criteria to the remaining operative components of the authoring system 10. The selection mechanism 20, in turn, selects the content and display components based on information which is provided thereto by the access control engine 12. In turn, the display mechanism 22 builds or formulates a display which is based on information provided thereto by the selection mechanism 20. The multi-user process 28 of the authoring system utilizes the access control engine 12 in order to determine the relationship between the multiple authors to which access is to be gained.

[0034] This invention improves upon authoring systems which provide separate interfaces for specifying authoring functionality. The author uses the same interface to customize their interface and other interfaces. Changes to the roles, attributes and logic are dynamically reflected in the interface. Current authoring systems do not implement this capability as a special case of authoring functionality. It also provides enhanced capability to customized interfaces beyond the few predefined user interfaces typically provided by most authoring systems.

[0035] Reverting to a typical scenario in the application of the authoring system 10 through intermediary of the inventive process of simultaneous user access employing the control engine 12 and related control structures, the following data flow sequence is set forth hereinbelow:

• • [0036] 1) An individual makes a request.
  • [0037] 2) Look up the individual in the active user table.
  • [0038] 3) Get the individual's role(s) from the active user table.
  • [0039] 4) Look for the other active users in the active user table.
  • [0040] 5) Get the other active users role(s) from the active user table.
  • [0041] 6) Set the individual's active flag to active in the active user table.
  • [0042] 7) Find the individual role(s) in the access control table.
  • [0043] 8) Retrieve the logic(s) and choice component(s) from their respective table.
  • [0044] 9) Check the logic(s), which contains the attributes and values.
  • [0045] 10) Find the role(s) of the other active users in the access control structure table.
  • [0046] 11) Retrieve the corresponding logic(s).
  • [0047] 12) Check the logic(s), which contain the attributes and values.
  • [0048] 13) Check for the individual's attribute(s) against the other active roles' attributes.
  • [0049] 14) Transform the individual's logic(s) into a single logic, if there are no attributes or attributes values in common.
  • [0050] 15) Check the permission bits, if there are attribute values in common.
  • [0051] 16) Transform the individual's logic(s) into a single logic, if the permission bits are not identical.
  • [0052] 17) Forward the role name that contains the conflicting information with its corresponding logic to the requesting mechanism.
  • [0053] 18) Finally, the underlying system marks when a role enters a document, so that potential future conflicts will be handled when they come up during the selection mechanism.

[0054] The foregoing process, in essence, imparts an ability to the access control engine 12 and control structures of the authoring system 10 which receives the access request to implement a process for enabling simultaneous user access which will dynamically reflect and respond to changes in the authoring system.

[0055] While the invention has been particularly shown and described with respect to preferred embodiments thereof, it will be understood by those skilled in the art that the foregoing and other changes in form and details may be made therein without departing form the spirit and scope of the invention.