Method and system for metadata-driven document management and access control
A system is provided to facilitate tag-based organization of documents. During operation, the system receives an original user query. The system extends the query to include documents with an IN-tag and exclude documents with an OUT-tag. The system then performs a search based on the extended query to indicate a collection of documents which satisfy the extended query. The system further allows a user to add a document to the collection of documents or remove a document from the collection of documents. Next, the system modifies a tagging property of the document.
1. A method for facilitating tag-based document access control, the method comprising:
providing at a computer system a user interface to allow a recipient of a document to create an access-control tag that specifies an access-control scheme for a part of the document, wherein the access-control tag comprises:
a condition part that specifies the conditions for enforcing access control policies, and
a policy part that specifies the access control policies to be enforced and specifies the part of the document over which the access control policies are applied; and
applying the access-control scheme at the computer system to the part of the document based on the access-control tag, wherein applying the access-control scheme involves:
issuing a warning in response to receiving a command from the recipient of the document that conflicts with the access-control scheme; and
allowing the recipient of the document to remove the access-control tag.
2. The method of claim 1 , wherein the access-control tag specifies one or more of:
a time at which the access-control scheme is activated or deactivated; and
a period of time during which the access-control scheme is effective.
3. The method of claim 1 ,
wherein the access-control tag specifies an event upon the occurrence of which the access-control scheme is activated or deactivated.
4. The method of claim 1 ,
wherein the access-control scheme specifies one or more users or user groups to whom access to the part of the document is denied or allowed.
5. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating tag-based document access control, the method comprising:
providing at a computer system a user interface to allow a recipient of a document to create an access-control tag that specifies an access-control scheme for a part of the document, wherein the access-control tag comprises:
a condition part that specifies the conditions for enforcing access control policies, and
a policy part that specifies the access control policies to be enforced and specifies the part of the document over which the access control policies are applied; and
applying the access-control scheme at the computer system to the part of the document based on the access-control tag, wherein applying the access-control scheme involves:
issuing a warning in response to receiving a command from the recipient of the document that conflicts with the access-control scheme; and
allowing the recipient of the document to remove the access-control tag.
6. The storage medium of claim 5 , wherein the access-control tag specifies one or more of:
a time at which the access-control scheme is activated or deactivated; and
a period of time during which the access-control scheme is effective.
7. The storage medium of claim 5 ,
wherein the access-control tag specifies an event upon the occurrence of which the access-control scheme is activated or deactivated.
8. The storage medium of claim 5 ,
wherein the access-control scheme specifies one or more users or user groups to whom access to the part of the document is denied or allowed.
9. A system for facilitating tag-based document access control, the method comprising:
a processor;
a user interface configured to allow a recipient of a document to create an access-control tag that specifies an access-control scheme for a part of the document, wherein the access-control tag comprises:
a condition part that specifies the conditions for enforcing access control policies, and
a policy part that specifies the access control policies to be enforced and specifies the part of the document over which the access control policies are applied; and
an access-control mechanism configured to apply the access-control scheme at the computer system to the part of the document based on the access-control tag, wherein, while applying the access-control scheme, the access-control mechanism is configured to:
issue a warning in response to receiving a command from the recipient of the document that conflicts with the access-control scheme; and
allow the recipient of the document to remove the access-control tag.
10. The system of claim 9 , wherein the access-control tag specifies one or more of:
a time at which the access-control scheme is activated or deactivated; and
a period of time during which the access-control scheme is effective.
11. The system of claim 9 ,
wherein the access-control tag specifies an event upon the occurrence of which the access-control scheme is activated or deactivated.
12. The system of claim 9 ,
wherein the access-control scheme specifies one or more users or user groups to whom access to the part of the document is denied or allowed.