Methods for granting access to resources modifiable by users in a computer environment, and resources structured therefore
View Patent ↗Method for accessing a resource in a data-processing environment. The resource includes a set of objects. The data-processing environment is capable of storing in association with at least one object of the resource at least one modified object. The data-processing environment is capable of storing in association with such an object information of degree of elaboration. The method performs the steps of identifying, for each object of the resource to which corresponds at least a modified object, by using the information of degree of elaboration, at least a most elaborate version of said object, and assembling the objects thus identified for them to be displayed in the resource.
1. A method for making accessible to different users having respective access rights within a data-processing environment, a resource containing a plurality of objects which can be modified by the users to obtain different versions of said objects, comprising the following steps:
for at least certain ones of said different versions of said objects, assigning to different versions of said objects different ciphering/deciphering keys according to the access rights,
providing versions of said objects ciphered with the different keys,
including in said resource, the different versions of said objects ciphered with the different ciphering keys,
propagating said resource from user to user in a communications chain,
when the resource is accessed by a user in said communications chain, carrying out the deciphering of ciphered object versions included in the resource by means of respective deciphering keys associated to the access rights of said user,
wherein object versions of said resource, for third party users having different access rights, are propagated in the same chain without being accessible by intermediate users in said communications chain.
2. A method according to claim 1 , further comprising, when an object is modified by a user a step of generating a new version of the object, to which a new key is selectively assigned according to key change rules providing for a change of key only if access rights by the users to the modified object have to be changed.
3. A method according to claim 2 , wherein the key change rules provide for a change of key only if a certain duration has elapsed since a previous key change.
4. A method according to claim 1 , wherein different pairs of public/private keys are assigned to the modified objects, selectively allowing a read-only access or a write access to these objects.
5. A method according to claim 1 , comprising a step of selectively providing the keys for deciphering the objects to the users depending on authorization information for said users.
6. A method according to claim 5 , wherein the authorizations are managed user group by user group, with two users of the same user group having the same rights.
7. A method according to claim 6 , wherein the versions of an object are made of versions with different contents of said object, simultaneously coexisting and reserved for different user groups, and in that a communication of such an object by a user of a first user group to a user of a second user group comprises:
providing to the user of the second user group, by any appropriate channel, of a multi-versions object containing the contents of the object reserved for the second user group, in a ciphered state, and
independently providing to the user of the second user group, from a key server, a deciphering key allowing to decipher said contents of the object reserved for the second user group.
8. A method according to claim 7 , further comprising separating the multi-versions object in parts which are homogeneous from the standpoint of access rights, each part containing positioning information allowing its replacement in the structure, whereby manipulations handling can be made on the multi-version object in the absence of access rights for the entirety of its versions.
9. A method according to claim 1 , wherein the versions of an object are made of successive updates of said object in client stations of the data-processing environment, and in that the step of generating a new key when a new version of the object is generated is carried out in the client station, wherein a subsequent step of transmission of the new key to a key server is provided.