Object-oriented framework for managing access control in a multimedia database

This application is related to the following co-pending and commonly-assigned patent application Ser. No. 09/398,374, entitled, “Access Control System for a Multimedia Datastore” filed on the same date herewith, by Alan T. Yaung, et al., which is incorporated by referenced herein.

1. Field of the Invention

This invention relates in general to computer-implemented database management systems, and, in particular, to an object-oriented framework for managing access control to a multimedia database.

2. Description of Related Art

For nearly half a century computers have been used by businesses to manage information such as numbers and text, mainly in the form of coded data. However, business data represents only a small part of the world's information. As storage, communication and information processing technologies advance, and as their costs come down, it becomes more feasible to digitize other various types of data, store large volumes of it, and be able to distribute it on demand to users at their place of business or home.

New digitization technologies have emerged in the last decade to digitize images, audio, and video, giving birth to a new type of digital multimedia information. These multimedia objects are quite different from the business data that computers managed in the past, and often require more advanced information management system infrastructures with new capabilities. Such systems are often called “digital libraries.”

Bringing new digital technologies can do much more than just replace physical objects with their electronic representation. It enables instant access to information; supports fast, accurate, and powerful search mechanisms; provides, new “experiential” (i.e. virtual reality) user interfaces; and implements new ways of protecting the rights of information owners. These properties make digital library solutions even more attractive and acceptable not only to corporate IS organizations, but to the information owners, publishers and service providers.

Generally, business data is created by a business process (an airline ticket reservation, a deposit at the bank, and a claim processing at an insurance company are examples). Most of these processes have been automated by computers and produce business data in digital form (text and numbers). Therefore it is usually structured coded data. Multimedia data, on the contrary, cannot be fully pre-structured (its use is not fully predictable) because it is the result of the creation of a human being or the digitization of an object of the real world (x-rays, geophysical mapping, etc.) rather than a computer algorithm.

The average size of business data in digital form is relatively small. A banking record—including a customers name, address, phone number, account number, balance, etc.—represents at most a few hundred characters, i.e. few hundreds/thousands of bits. The digitization of multimedia information (image, audio, video) produces a large set of bits called an “object” or “blobs” (Binary Large Objects). For example, a digitized image of the parchments from the Vatican Library takes as much as the equivalent of 30 million characters (30 MB) to be stored. The digitization of a movie, even after compression, may take as much as the equivalent of several billions of characters (3-4 GB) to be stored.

Multimedia information is typically stored as much larger objects, ever increasing in quantity and therefore requiring special storage mechanisms. Classical business computer systems have not been designed to directly store such large objects. Specialized storage technologies may be required for certain types of information, e.g. media streamers for video or music. Because certain multimedia information needs to be preserved “forever” it also requires special storage management functions providing automated back-up and migration to new storage technologies as they become available and as old technologies become obsolete.

Finally, for performance reasons, the multimedia data is often placed in the proximity of the users with the system supporting multiple distributed object servers. This often requires a logical separation between applications, indices, and data to ensure independence from any changes in the location of the data.

In a digital library (DL), the multimedia object can be linked with the associated indexing information, since both are available in digital form. Integration of this legacy catalog information with the digitized object is crucial and is one of the great advantages of digital library technology. Different types of objects can be categorized differently as appropriate for each object type. Existing standards like MARC records for libraries, Finding Aids for archiving of special collections, etc. can be used when appropriate.

Object-oriented approaches are generally better suited for such complex data management. The term “object-oriented” refers to a software design method which uses “classes” and “objects” to model abstract or real objects. An “object” is the main building block of object-oriented programming, and is a programming unit which has both data and functionality (i.e., “methods”). A “class” defines the implementation of a particular kind of object, the variables and methods it uses, and the parent class it belongs to.

Controlling access to digital libraries and other types of multimedia databases by multiple users is an important aspect of managing the distribution of contents in a multimedia database. Currently, access control support has been problematic and of limited capability. An example of one such access control support is the access control provided for the DB2 Digital Library, a product from International Business Machines Corporation of Armonk, N.Y. The DB2 Digital Library provides two ways in which the user can provide access control. First, the DB2 Digital Library product includes a ready-to-use Java system administration tool. However, this Java system administration tool has a limited number of functions and is thus unacceptable for many sophisticated users. The DB2 Digital Library product also provides a low-level set of C Application Programming Interfaces (APIs) from which users can develop customized access control. However, these low-level APIs have three deficiencies. First, they are difficult to use for novice users. Second, they provide only limited functionalities and cannot meet the expectation of today's demanding application programers. Finally, these low level C APIs have no corresponding higher level APIs to allow for better interoperability.

Accordingly, there is a need in the art for an object-oriented framework for managing access control in a multimedia database which provides better usability, an expanded and more sophisticated capability, and increased interoperability.

To overcome the limitations in the prior art described above, and to overcome other limitations that will become apparent upon reading and understanding the present specification, the present invention discloses a method, apparatus, and article of manufacture for an object-oriented framework for managing access control in a multimedia database.

In accordance with the present invention, a technique for controlling access to a datastore connected to a computer is provided. Initially, a datastore access control object is generated for the datastore. The datastore access control object enables controlling access to the datastore by manipulating an access control list object to set access privileges.

Referring now to the drawings in which like reference numbers represent corresponding parts throughout:

FIG. 1 schematically illustrates the hardware environment of a preferred embodiment of the present invention, and more particularly, illustrates a typical distributed computer system;

FIG. 2 schematically illustrates an object-oriented framework for managing access control and the class and objects of the present invention.

FIG. 3 is a flow chart illustrating the order of operation of the method of the present invention.

FIG. 4 is a flow chart illustrating some of the operations that may be performed with a datastore access control object of the present invention.

In the following description of the preferred embodiment, reference is made to the accompanying drawings which form a part hereof, and which is shown by way of illustration a specific embodiment in which the invention may be practiced. It is to be understood that other embodiments may be utilized as structural changes may be made without departing from the scope of the present invention.

Hardware Environment

FIG. 1 schematically illustrates the hardware environment of a preferred embodiment of the present invention, and more particularly, illustrates a typical distributed computer system using the network 100 to connect client computers 102 executing client applications to a Digital Library server computer 104 executing software and other computer programs, and to connect the server system 104 to data sources 106 . A data source 106 may comprise, for example, a multi-media database. A typical combination of resources may include client computers 102 that are personal computers or workstations, and a Digital Library server computer 104 that is a personal computer, workstation, minicomputer, or mainframe. These systems are coupled to one another by various networks, including LANs, WANs, SNA networks, and the Internet.

A client computer 102 typically executes a client application and is coupled to a Digital Library server computer 104 executing server software. The client application is typically a software program such as a workflow application. The server software is typically a program such as IBM's Digital Library server software. The Digital Library server computer 104 also uses a data source interface and, possibly, other computer programs, for connecting to the data sources 106 . The client computer 102 is bi-directionally coupled with the Digital Library server computer 104 over a line or via a wireless system. In turn, the Digital Library server computer 104 is bi-directionally coupled with data sources 106 .

The data source interface may be connected to a Database Management System (DBMS), which supports access to a data source 106 by executing RDBMS software. The interface and DBMS may be located on the same server as the Digital Library server computer 104 or may be located on a separate machine. The data sources 106 may be geographically distributed.

Those skilled in the art will recognize many modifications may be made to this configuration without departing from the scope of the present invention.

An Object-Oriented Framework for Managing Access Control in a Multimedia Database

An embodiment of the present invention provides an object-oriented framework for managing access control in a multimedia database and is illustrated in FIG. 2 . As one skilled in the art will recognize, this object-oriented framework is portrayed using the Object Modeling Technique (OMT) Notations developed by James Rumbaugh. The sample class structure and objects provided below are in the C++ programming language, but one skilled in the art will recognize that the object-oriented framework presented in FIG. 2 can be represented in C++, Java, ActiveX or another programming language with suitable object-oriented programming capabilities.

With reference to FIG. 2, an access control class 200 is an abstract class of access control, and is termed the dkAccessControl class in the sample class below. Access control class 200 defines the base class for access control and provides a set of common methods for different access control mechanisms which are provided for controlling access to the respective datastores. A datastore access control class 202 is based on the access control class 200 , and inherits the properties of the access control class 200 . In the example below the datastore access control class 202 is termed DKAccessControlDL and represents an access control class for a Digital Library datastore. It will be understood that one or more datastore access control objects can be instantiated from the datastore access control class 202 , with each instantiated object inheriting the properties of the access control class 200 and controlling access to a different Digital Library datastore.

It will be further understood that other datastore access classes may be defined, such as DKAccessControlV4 for a VisualInfo 400 datastore. The access control class 202 includes multiple methods for the manipulation of an access control list. For example, a datastore access control object of the datastore access control class 202 can add a new access control list by specifying a name or other identifier for that list and then providing the textual information to be inserted into the new access control list. The datastore access control object can then manipulate that access control list by, for example, updating it with new information such as adding a new user, granting a current user additional access privileges or deleting a user from an access control list.

In a preferred embodiment, the datastore access control object manages one or more objects based on an access control list class 204 . In other words, each access control list is itself an object. In the example provided below, this access control list class is termed DKAccessControlListDL. The access control list class includes multiple methods for the manipulation of the list. For example, an access control list object of the access control list class can set a name of a new access control list, set a description of the new list, and then update the list when new information is provided to it. Also in the preferred embodiment, the access control list object consists of one or more access data objects based on an access data class 206 . Each access data object corresponds to a row of access data in the access control list.

The following is a sample class structure for an access control class 200 :

This sample class provides for class Constructors and Destructors in the form of:

dkAccessControl(const char * access_contro_type

const char * access_control_name=″″);

virtual˜kAccessControl( );

The dkAccessControl constructor has two parameters: (1) access_control_type indicates the type of access control; and (2) access_control_name identifies the name of access control.

The access control class includes the following methods to manipulate an object of the access control class:

setDatastore

virtual void setDatastore(dkDatastore ds);

Sets the datastore.

getDatastore

virtual dkDatastore * getDatastore( );

Returns the datastore.

type

virtual DKString type( ) const;

Returns the type of access control.

getName

virtual DKString getName( ) const;

Returns the name of access control.

setName

virtual void setName(const char * access_control_name);

Sets the name of access control.

addAccessControlList

virtual void addAccessControlList(const char * acl_name,

const char * description,

dkCollection * access_data);

Adds an access control list with a name, a description, and access data.

updateAccessControlList

virtual void updateAccessControlList (const char * acl_name,

const char * description);

Updates an access control list with a name, a description, and access data.

deleteAccessControlList

virtual void deleteAccessControlList(const char * acl_name);

Deletes the access control list specified by the user.

listAccessControlLists

virtual dkCollection * listAccessControlLists( );

Lists all the access control lists in the system.

list Privileges

virtual dkCollection * listprivileges( );

Lists all the privileges in the system.

listUsers

virtual dkCollection * listUsers( );

Lists all the users in the system.

listGroups

virtual dkCollection * listgroups( );

Lists all the groups in the system.

listPrivilegeString

virtual DKString listPrivilegeString(const char * privilege_name)

Lists the privilege string of the specified privilege name.

A datastore access control object is an instance of the DKAccessControlDL class 202 , which is derived from its base class dkAccessControl. This DKAccessControlDL class is the concrete implementation of the abstract base class dkAccessControl for access control provided in the digital library.

The following is a sample class structure for a datastore access control class 202 :

This sample class provides for class Constructors and Destructors in the form of:

DKAccessControlKL(DKDatastoreDL * ds);

˜DKAccessControlDL( );

The DKAccessControlDL constructor has a parameter that is a pointer to a Digital Library datastore for requesting access control functions.

The datastore access control object includes the following methods to manipulate an object of the access control list class:

addAccessControlList

void addAccessControlList(const char * acl_name,

const char * description,

dkCollection * access_data);

Adds an access control list into the system. The parameter acl_name specifies the name of access control list. The parameter description provides the textual information of the access control list. The parameter access_data specifies the access data entries of the access control list. Each access_data entry is an object of DKAccessDataDL, which is defined below.

updateAccessControlList

void updateAccessControlList(const char * acl_name,

const char * description,

dkCollection * access_data);

Updates an access control list in the system. The parameter acl_name specifies the name of access control list. The parameter description provides the textual information of the access control list. The parameter access_data specifies the access data entries of the access control list. Each access data entry is an object of the access data class, identified as DKAccessDataDL, which is defined below.

deleteAccessControlList

void deleteAccessControlList(const char *acl_name);

Deletes an access control list in the system. The parameter acl_name specifies the name of access control list.

listAccessControllists

dkCollection * listAccessControlLists( );

Returns a collection of DKAccessControlListDL objects defined in the system.

listAccessControlList

DKAccessControlList * listAccessControlList(const char * acl_name);

Returns a DKAccessControlListDL object with the specified name.

getItemACL

DKString getItemACL(const char * itemID);

Returns the name of access control list of the specified item ID.

SetItem ACL

void setitemACL(const char * itemID, const char * acl_name);

Associates an access control list with the specified item ID.

listPrivileges

dkCollection * listprivileges( );

Returns a collection of DKString objects containing the name of privilege sets defined in the system.

listPrivilege

DKString listPrivilege(const char * user_name);

Returns the privilege name of the specified user.

listUsers

dkCollection * listUsers( );

Returns a collection of DKString objects containing the name of users defined in the system.

listUsers with 1 parameter

dkCollection * listUsers(const char * group_name);

Returns a collection of DKString objects containing the name of users defined in a group.

listGroups

dkCollection * listGroups( );

Returns a collection of DKString objects containing the name of groups defined in the system.

listGroups with 1 parameter

dkCollection * listgroups(const char * user_name);

Returns a collection of DKString objects containing the name of groups that the specified user is member of.

listPrivilegeString

DKString listPrivilegeString(const char * privilege_name);

Returns the privilege string of the specified privilege name.

isAuthorized

DKBoolean isAuthorized(const char * privilege_string, long authority);

Returns a value of TRUE if the specified authority is granted in the privilege string, otherwise returns a value of FALSE.

isAccessControlList

DKBoolean isAccessControlList(const char * acl_name);

Returns a value of TRUE if the specified name is a valid access control list, otherwise it returns a value of FALSE.

isPrivilege

DKBoolean isprivilege(const char * privilege_name);

Returns a value of TRUE if the specified name is a valid privilege, otherwise it returns a value of FALSE.

isUser

DKBoolean isUser(const char * user_name);

Returns a value of TRUE if the specified name is a valid user, otherwise it returns a value of FALSE.

isGroup

DKBoolean isgroup(const char*group_name);

Returns a value of TRUE if the specified name is a valid group, otherwise it returns a value of FALSE.

An access control list class 204 is represented by the sample class termed DKAccessControlListDL which is an object-oriented representation of an access control list in a digital library. It provides get/set methods and add/update/delete/retrieve methods.

The following is a sample class structure for an access control list class 204 :

This sample class provides for class Constructors and Destructors in the form of:

DKAccessControlListDL(const char * name);

DKAccessControlListDL( );

DKAccessControlListDL( );

The first constructor with one parameter is used to retrieve an existing access control list in the memory. The second constructor without a parameter is used to create a new access control list in the memory.

The access control list object includes the following methods to manipulate an object of the access data class:

setName

void setName(const char * name);

Sets the name of the access control list.

setDescription

void setdescription(const char * description);

Sets the description of the access control list.

setAccessData

void setAccessData(dkCollection * access_data);

Sets the access data for the access control list. access_data is a collection of DKAccessDataDL objects.

getName

DKString getName( );

Returns the name of the access control list.

get Description

DKString getDescription( );

Returns the description of the access control list.

getAccessData

dkCollection * getAccessData( );

Returns a collection ofDKAccessDataDL objects containing the access data oft he access control list.

retrieve

void retrieve( );

Retrieves the access control list from the persistent storage to main memory. add

void add( );

Adds the access control list into the persistent storage.

update

void update( );

Updates the access control list in the persistent storage.

del

void del( );

Deletes the access control list from the persistent storage.

An access data class 206 , is represented by the sample class DKAccessDataDL class which is an object-oriented representation of an access data associating with an access control list. It provides get/set methods. This class defines the entries in an access control list.

The following is a sample class structure for an access data object 206 :

This sample class provides for class Constructors and Destructors in the form of:

DKAccessDataDL (long command,

long patron_type.

const char * patron,

const char * privilege_name);

DKAccessDataDL( );

˜DKAccessDataDL( );

The first DKAccessDataDL constructor has four parameters:

command indicates the command for this object.

patron_type indicates the type of a user.

patron specifies the name of a user.

privilege_name indicates the textual name of a privilege set.

The command parameter sets the command of this access data. A valid command can be one of the following:

DK_ACTION_ADD—add the access data in the access control list

DK_ACTION_UPDATE—update the access data in the access control list

DK_ACTION_DELETE—delete the access data from the access control list

A valid patron type can be one of the following:

DK_PATRON_TYPE_GROUP—group access

DK_PATRON_TYPE_OWNER—owner access

DK_PATRON_TYPE_PUBLIC—public access

DK_PATRON_TYPE_USER—user access

The second constructor without parameters is used to create an empty DKAccessDataDL.

The access data class includes the following methods to manipulate an object of the access data class:

getcommand

long getcommand( );

Returns the command of this access data.

getPatronType

long getPatronType( );

Returns the type of the patron.

getPatron

DKString getpatron( );

Returns the user ID of the patron.

getPrivilegeName

DKString getPrivilegeName( );

Returns the name of the privilege set.

setCommand

void setcommand(long command);

Sets the command of this access data. The valid commands are described above.

setPatron Type

void setPatron Type(long patron_type);

Sets the type of the patron. The valid patron types are described above.

setPatron

void setpatron(const char * patron);

Sets the user ID of the patron.

setPrivilegeName

void setPrivilegeName(const char * privilege_name);

Sets the name of the privilege set.

FIG. 3 is a flow diagram that illustrates the use of the object oriented framework. As shown in FIG. 3, block 300 , a computer receives an instruction from a user to instantiate a datastore access control object. The computer then instantiates the object, which inherits all of the characteristics of the access control class from which it is derived, as is shown in block 302 . (See also FIG. 2) Next, the user could use the datastore access control object to manipulate an access control list object using the methods provided in the datastore access control object as shown in block 304 . For example, the user could update the access control list object using the update method explained above.

A more detailed illustration of some of the processes that may be performed in block 304 is provided in FIG. 4, which is a flow diagram illustrating some operations that may be performed by a datastore access control object of the present invention. First, as shown in block 400 , the computer determines if the user is seeking to create a new access control list to be manipulated by the datastore access control object, or whether the user is seeking to manipulate an old list. If the user is going to create a new access control list, the computer will instantiate a new access control list object, as shown in block 402 . After performing this function the computer will return to block 400 to await further instructions.

If the user will be adding new data, or otherwise manipulating a current access control list the computer moves to block 404 . In block 404 , the computer determines whether the user wants to add data to an access control list or perform some other manipulation.

If the user is adding data the computer carries out the functions of block 406 by instantiating a new access data object and writing the provided data into the object. This new access data object is, in essence, a new row in the access control list and it therefore comprises a part of the access control list object. In other words, the access control list object is composed of one or more access data objects. After performing this function, the computer awaits new instructions and returns to block 400 .

If at block 404 the user chooses to perform some function other than adding data, the computer determines whether that function will be a modification or some other manipulation. If the instruction is to modify the access control list, control flows to block 410 . If the user seeks to perform some other modification, that processing is done. The ellipse indicates that further processing takes place.

In block 410 , the computer passes the necessary parameters to the proper access control list object. Next, in block 412 , the computer determines whether the function can be fully performed and if the requested data is accessible at the access control list object level. If it can be, the access control list object is manipulated 414 . The computer may then perform other processing, or return to block 400 to respond to a new user instruction. If the instruction cannot be fully processed, the access control list object returns an error message to the user as shown in block 416 . If an error is detected, the computer may then perform user specified error handling.

This concludes the description of the preferred embodiment of the invention. The following describes some alternative embodiments for accomplishing the present invention. For example, any type of computer, such as a mainframe, minicomputer, or personal computer, or computer configuration, such as a timesharing mainframe, local area network, or standalone personal computer, could be used with the present invention. Additionally it will be understood that the object-oriented framework for providing access control can be used to provide access control to various types of multimedia datastores, and is not limited to a digital library. It will also be understood that the functions and methods described in the sample classes above can be varied and modified as necessary without departing from the present invention.

The foregoing description of the preferred embodiment of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto.