Hierarchical Access Control for Content Management Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing document and object access in content management systems is a time-consuming operation due to the large volume of documents and varying user permissions, making it difficult to efficiently control access across multiple users and devices.
Innovation Solution
A method for controlling document/object access in a content management system involves displaying and receiving multiple layers of access control configuration information, determining user rights based on type of access permission, and using an access controller to manage user roles, groups, and document attributes, allowing for state/role field level overrides.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual access control configuration is implemented for each user and document, then access security can be precisely controlled, but the time and effort required for management increases significantly
Solution Approach 1:
The patent segments access control into multiple hierarchical layers (user level, group level, document level, field level). Each layer operates independently but contributes to the overall access decision, allowing administrators to configure access rights at different granularities without managing every individual user-document pair manually.
Solution Approach 2:
The patent implements multi-layer access control where a single configuration system handles multiple types of access permissions across different layers (user profiles, group memberships, document permissions, field-level security). This universal system replaces numerous separate manual configuration tasks with one integrated access control mechanism.
2Measurement precision
If multiple layers of access control are implemented for different permission types, then access precision and security are improved, but the system complexity increases
Solution Approach 1:
The patent divides the access control system into distinct hierarchical layers (user layer, group layer, document layer, field layer), where each layer handles specific aspects of access control. This segmentation allows precise permission management at each level while keeping the overall system structure organized and manageable through clear separation of concerns.
Solution Approach 2:
The patent adds hierarchical dimensionality to access control by implementing multiple layers of permission configuration. Instead of a single flat permission system, access control is extended across multiple dimensions (user→group→document→field), enabling precise control while maintaining system organization through hierarchical structuring.
3Productivity
If automated user group generation and document matching is implemented, then productivity and efficiency are improved, but the algorithm complexity and processing requirements increase
Solution Approach 1:
The patent implements preliminary action by automatically generating user groups and matching documents with appropriate access controls in advance, before users need to access them. The system pre-processes user profiles, group memberships, and document permissions, so that when access is requested, the authorization decision can be made quickly based on pre-computed configurations rather than real-time complex calculations.
Solution Approach 2:
The patent enables self-service automation where the system automatically performs user group generation, document matching, and access control configuration without requiring manual intervention for each task. The automated processes analyze user profiles and document attributes independently, assigning appropriate permissions based on predefined rules and criteria.
Data Source
AI summary
Systems and methods for controlling object/document access in a content management system. The content management system may have several layers of access controls, which may include a layer of access control at the object level, a layer of access control at the row level and a layer of access control at the field level. Access may be controlled at the object level by a user's security profile, at the object record level (or row level) by the user's role, and/or at the object field level by the user's role or a state in a document lifecycle. In other words, the object level access control may grant access (e.g., Create, Read, Edit and Delete) on objects, the object record level access control may grant access (e.g., Read, Edit and Delete) on object records, and field level access control may grant access (e.g., Read, Edit and Hidden) on object field level.