Zoned based security administration for data items

Abstract

Administering digital security is disclosed. Data and method items are stored on a computer system in a volume. The volume is divided up into non-overlapping security zones. Each item exists in a security zone. Security rules are granted to principals where the security rules apply to items in a particular zone. The security rules specify what principals have what rights; such as read, write delete and execute; to what items. Administrative rights can be delegated by principals by splitting a security zone to form two security zones. Principals who have administrative rights to the security zone assign additional principals to one of the security zones while maintaining all administrative rights to the other zone. Thus principals can retain certain administrative rights to certain items exclusively to themselves while delegating administrative rights to other items to other principals.

Description

technical field [0001] The present invention generally relates to the field of data security, in particular to the security management of data item groups Background technique [0002] When processing information, it is often desirable to restrict access to a particular portion of the information so that the particular portion is only accessible to certain authorized users. When information is contained in physical documents (eg, printed books or ledgers), these documents can be protected with physical access controls such as locks and document custodians. However, in today's world, vast amounts of information are stored in the form of digital data. Digital data is easily created, modified, copied, transferred, and deleted, which has resulted in the proliferation of large amounts of digital data that exist in numerous locations. Similar to physical documents, it is often desirable to restrict access to portions of digital data. However, the sheer volume of digital data an...

AI Technical Summary

Problems solved by technology

A disadvantage of column-based security clearance assignment is that it may be too coarse-grained for some applications

For example, although most numeric data representing digital address book entries in columns is appropriate for general access, it may be desirable to restrict access to certain numeric data, such as social security numbers or other types of sensitive information

Still, when assigning an ACL to an entire column, the security permissions cannot vary between different items in the column

Therefore, it may not be possible to restrict access to social security numbers without similarly restricting access to addresses and phone numbers

Images