Patent ID: 8689352
Filing Date: 2014-04-01
Classification: G06F,G06Q,H04L

Abstract:
1. A computer system comprising: at least one processor; non-transitory computer-readable storage medium including instructions executable by the at least one processor, the instructions configured to implement, a document access pattern manager configured to receive access requests from a plurality of collaboration participants for access to a document instance, the access requests specified using a document schema of the document instance and referencing at least one of a first schema portion for access to a first document instance portion and a second schema portion for access to a second document instance portion; a document authorization manager configured to determine a first common access interest group of the collaboration participants related to the first document instance portion and a second common access interest group of the collaboration participants related to the second document instance portion, based on the access requests and on an access control policy specified in terms of access credentials; and a key manager configured to provide a first control data block to the participants of the first common access interest group, the first control data block including information for generating a first common secret key that is common to the participants of the first common access interest group, the key manager configured to provide a second control data block to the participants of the second common access interest group, the second control data block including information for generating a second common secret key that is common to the participants of the second common access interest group, wherein at least one of the first and second control data blocks includes authority delegation information for authorizing a collaboration participant within a respective common access interest group to operate as a new authority to manage access control of a respective document instance portion, the authority delegation information including a chain of certificates including a certificate from an owner of at least a portion of the document instance that authorizes the collaboration participate to operate as the new authority.