CN1859402B - XML Document Management System and Its Method and XML Document Access Control Method - Google Patents

Abstract

The present invention relates to the entrusted management of XML documents, aiming at realizing the entrustment of XDM, an XML document management method comprising steps: (1) XML document management client sends XML document management operation request to XML document management server; (2) XML document management server sends XML document management operation request; The document management server receives the XML document operation request from the XML document management client and judges whether the request of the XML document management client satisfies the effective conditions of the entrusted authorization rules for the XML document management operation; (3) when the request of the XML document management client satisfies When the entrusted authorization rules for XML document management operations take effect, the XML document management operations stipulated in the rules are executed; otherwise, the non-authorized delegation process is executed. The invention also discloses an XML document management system, an XML document management client and an XML document management server. The invention effectively realizes the entrusted management operation of the XML document, and can be widely used in the management of the XML document.

Description

XML Document Management System and Its Method and XML Document Access Control Method

technical field

The present invention relates to the management of XML documents, in particular to an XML document management method, an XML document management system, an XML document management server, and an XML document management client.

Background technique

XML (Extensible Markup Language) Document Management (XDM) system is a common engine for various services, and can store and manage data of various engines. The XDM system mainly includes the following functional entities:

1. XDM client (XDMC): The XDM client is an entity that provides access to different XDM servers. XDM clients may be terminal or server entities. An XDM client is an entity that accesses XCAP resources in an XDM server. XCAP resources correspond to elements and attributes of an XML document. XCAP resources are identified by an HTTP URI. XDM clients consume XML documents through HTTP operations. The XDM client should construct the RequestedURI based on the usage method of the application. The following operations can be performed: create or replace a document; delete a document; get a document; create or replace an element; delete an element; get an element; create or replace an attribute; delete an attribute; get an attribute.

2. Shared XDM server (XDMS): The shared XDM server provides authentication, management and notification functions. Shared XDM server supports URI list. URI lists include groups, accept lists, and deny lists that are reused by different service engines.

3. Engine-specific functional bodies, including:

1) Engine-specific XDM server, the engine-specific XDM server mainly provides the following functions:

Authentication of SIP or XCAP requests;

Manage engine-specific XML documents;

Aggregate change notifications for multiple documents in an engine-specific XDM server;

Subscribers are notified of changes to such engine-specific XML documents stored in the network.

2) The engine-specific server is the service server of each service engine.

4. Aggregation proxy: The XDM client implements the contact point of accessing the XML document on the XDM server on the user device, which is called the aggregation proxy. Aggregation agents perform the following functions:

1) Perform authentication on the XDM client.

2) Route the XCAP request to the correct XDM server.

3) Support billing. (optional)

4) Support compression/decompression on the wireless interface.

5. SIP/IP core: SIP/IP core is the Internet of servers such as agents and registration machines, which provide various services for the XDM document management system, such as routing, authentication, compression, etc.

In the prior art solutions, the configuration information must be set by the XDM client itself, and there is no delegation mechanism. As shown in Figure 1, a typical configuration information setting system mainly consists of the following devices:

A) XDM client: It is an entity that accesses different XDM servers, which may be a terminal or a server. When the XDM client is a terminal, it interacts with the XDM server through the aggregation proxy; otherwise, the XDM client directly interacts with the XDM server. The XDM client uses the XCAP protocol to manage the corresponding XML documents stored on an XDM server.

B) Aggregation proxy: When the XDM client is a user equipment terminal, the XCAP request of the XDM client is forwarded to the appropriate XDM server by the aggregation proxy. The main functions of the aggregation proxy are routing, authentication, or billing, and compression.

C) XDM server: The XDM server stores and manages XML documents for multiple XDM clients, and provides notification messages for clients who have subscribed to certain document changes when the corresponding documents change. The XDM server also provides authentication functions.

The disadvantage of this system is that the XDM client can only operate by itself when operating the XML document stored on the XDM server. When the XDM client is inconvenient to operate by itself, it cannot entrust other entities to operate for it. bring inconvenience.

However, in many cases, a proxy mechanism is needed to allow a client to delegate operations such as storage and management of XML documents to other clients, that is, let other XDM clients store or manage their XML documents for them. Moreover, there is no mechanism for controlling access to XML documents in the prior art.

Contents of the invention

One of the objectives of the present invention is to provide a method for enabling an XDM client to entrust other entities to perform XDM operations, so that the XDM client can conveniently perform XDM operations.

In order to achieve the above object, the technical solution adopted by the present invention is to provide an XML document management method, comprising steps: (1) the XML document management client sends an XML document management operation request to the XML document management server; (2) the XML document The management server receives the XML document management operation request from the XML document management client and judges whether the XML document management client's request satisfies the effective conditions of the delegated authorization rule for the XML document management operation, and the delegated authorization rule for the XML document management operation The effective conditions include at least the identity information conditions of the XML document access client; (3) When the request of the XML document management client meets the effective conditions of the entrusted authorization rules for XML document management operations, execute the XML document management operations specified in the rules, otherwise execute unauthorized Delegate processing.

Preferably, the XML document management operations specified by the rules include: specific management operations on specific parts of the XML document.

Another object of the present invention is to provide a system enabling an XDM client to entrust other entities to perform XDM operations.

In order to achieve the above object, the technical solution adopted by the present invention is to provide an XML document management system, including an XML document management client and an XML document management server, the XML document management client is connected to the XML document management server, and in the XML An XML document management operation entrusted inspection and processing device is also provided between the document management client and the XML document management server, and the XML document management operation entrusted inspection and processing device verifies whether the XML document operation requested by the XML document management client is Authorize the delegation mode, and execute the corresponding processing of the XML document management operation requested by the XML document management client.

Preferably, the XML document management operation delegation check and processing device includes: a commission check module, used to check whether the XML document management operation requested by the XML document management client is in a delegated mode; an authorization processing module, used to judge whether the delegated operation Check whether the delegation method determined by the module is an authorized delegation method, and when the delegation method is an authorized delegation method, perform a specific management operation on a specific part of the XML document according to the delegation authorization rule.

The third object of the present invention is to provide a method for implementing XML access control corresponding to the above-mentioned XML document management method and XML document management system.

In order to achieve the above object, the technical solution adopted by the present invention is an XML document access control method, including: Step A: judging whether the identity of the XML document access client requesting to access the XML document meets the requirements other than the owner of the XML document; The XML document access client ID of the effective condition of the entrusted authorization rule of the XML document management operation matches, if then execute B, otherwise exit this process, the effective condition of the entrusted authorization rule of the XML document management operation includes at least the XML document The identity information condition of the access client; Step B: Execute the XML document access client according to the access operation to a specific part of the XML document performed by the XML document access client that satisfies the effective conditions of the entrusted authorization rules for XML document management operations A specified XML document access operation requested to be performed on a specific portion of said XML document.

Technical effect of the present invention has the following aspects:

1. The present invention realizes the entrusted management operation of the XML document by entrusting the management client different from the owner of the XML document, making the management operation of the XML document more flexible and convenient;

2. Since the present invention enables entrusted management of XML documents, the management and sharing of XML documents can be effectively realized;

3. The present invention enables an XML document access client that meets the XML document access conditions to perform specified operations on a specific part of the XML document, thereby realizing precise access control to the XML document.

Description of drawings

FIG. 1 is a schematic diagram of an XML document management system in the prior art;

Fig. 2 is the schematic diagram of the XML document management system of an embodiment of the present invention;

Fig. 3 is a flow chart of the XML document entrusted management operation of the XML document management method of another embodiment of the present invention;

Fig. 4 is a flow chart of the entrusted mode inspection of the XML document management method of the embodiment in Fig. 3;

Fig. 5 is a message flow chart of the XML document management method of the third embodiment of the present invention.

Detailed ways

Fig. 2 is a schematic diagram of an XML document management system according to an embodiment of the present invention.

As shown in the figure, the XML document management system includes an XML document management (XDMC) agent, an aggregation agent, and an XML document management server (XDMS). On the XDMS side, there is also an entrusted inspection and processing device, between the XDMC agent and the aggregation agent, and the aggregation Subscription/notification messages between the agent and the entrusted inspection and processing device and XDMS are realized through SIP/IP Core.

The XDMC agent sends the XCAP request to the aggregation agent, and the aggregation agent forwards the request to XDMS, and the entrusted inspection and processing device in XDMS verifies whether the XML document operation request is in the authorized delegation mode, and executes the XML document management operation requested by the XML document management client For corresponding processing, the XDMS sends a confirmation message to the aggregation agent, and the aggregation agent returns the confirmation message to the XDMC agent.

The XML document management operation entrusted inspection and processing device may include: an entrusted inspection module, used to check whether the XML document management operation requested by the XML document management client is entrusted; Whether the mode is an authorized delegation mode, and when the delegation mode is an authorized delegation mode, perform a specific management operation on a specific part of the XML document according to the delegation authorization rules.

The above-mentioned document management system may also include an XML document owner client, which is a kind of XML document management client, which is the actual owner of the XML document and is connected to the XDMS. The XML document owner client formulates delegated authorization rules and sends the delegated authorization rule document to XDMS, and the delegated authorization rules authorize the XDMC agent to perform specified management operations on a specific part of the XML document.

In addition, the delegated authorization rule document can also be formulated, stored and run by XDMS.

The delegated authorization rule includes: a requester identification field, used to identify the sender of the XML management operation request corresponding to the rule; an operation object field, used to identify the XML document corresponding to the XML management operation or a specific element or attribute in it; the operation The type field is used to identify the type of the XML management operation; the action field is used to identify the action taken by the server after the rule is matched.

XDM delegated authorization rules are stored in an XML document, which contains several rules, and each rule specifies who can act on behalf of the delegator on which or which elements in the corresponding document.

The format of the XDM Delegated Authorization Rules document can adopt a structure similar to that of existing mechanisms (see reference [COMMONPOL]). The document contains a root element <ruleset>, and the root element <ruleset> contains several <rule> child elements representing a rule, and each <rule> element contains three elements <condition>, <action>, <transformation>. Among them, the <condition> element determines the effective conditions of this rule, and the <action> element determines the action taken when this rule takes effect, such as allowing, denying, waiting for confirmation, etc., and <transformation> indicates the processing of information, which is used here to specify access control The content of the XML document.

The <condition> element mainly includes:

A) Identity: user identity mark, such as sip:zhangsan@huawei.com

B)Domain: domain, such as @example.com

C) Validity: validity period, such as 2005-8-18:00～2005-8-918:00

D) Sphere: location, such as home, work

The extension to the <action> element is as follows:

The <action> element includes at least but not limited to one of the following:

The <get> element defines the action for the GET operation;

The <put> element defines the action for the PUT operation;

The <delete> element defines actions for DELETE operations;

The <post> element defines the action for the POST operation;

These actions can include: "allow", "deny", and "confirm", respectively expressing permission, denial and confirmation required.

The <transformation> element contains several <xpath> sub-elements. The value of the <xpath> element is an XPATH expression. These <xpath> elements are in a logical OR (OR) relationship, specifying the part of the XML document that the visitor can access.

In addition, the authorization rule document can also have another structure:

Like [COMMON_POLICY], documents contain a <ruleset> root element, which contains several <rule> elements.

The <rule> element contains three sub-elements <condition>, <action> and <transformation>.

On this basis, this embodiment adds a sub-element <method> to the <condition> element, and the value of the <method> element includes at least but not limited to one of GET, PUT, and DELETE; adds a sub-element < xpath>, indicating which part of the XML controlled by this rule, its value is an XPATH expression, the <transformation> element can have several <xpath> sub-elements, and the combination of the parts of the XML document described by these <xpath> elements Sets express rules governing which parts of an XML document.

Fig. 3 is a flow chart of the XML document entrusted management operation of the XML document management method according to another embodiment of the present invention.

As shown in Figure 3, after XDM S receives the XDM operation request, it judges the delegation mode, checks whether the message sender ID matches the owner ID of the document being operated, if it matches, it is the general mode, otherwise it is the delegation mode. If it is a general method, it will be processed according to the process of the prior art; if it is a delegation method, it will obtain the XDM delegation authorization rule, and judge whether the XDM operation requested by the delegatee satisfies the effective conditions of the delegation authorization rule. If the XDM operation request satisfies the rules, it is an authorization delegation mode, and the XDMS performs corresponding authorization delegation management operations according to the XDM operation request.

The following example illustrates the situation where various rules are described in the XDM delegated authorization document:

Suppose the identity of delegator A is: sip:userA@example.com, and the identity of delegator B is sip:userB@example.com.

Assume that client A has the following XML document stored in XDMS:

http://xcap.example.com/services/resource-lists/users/sip:userA@exampl

e.com/friends.xml

<? xml version="1.0" encoding="UTF-8"? >

<resource-lists xmlns="urn:ietf:params:xml:ns:resource-lists">

<list name="My-Close-friends">

<entry uri=″sip:Andy@example.com″>

<display-name>Andy</display-name>

</entry>

<entry uri=″sip:Simon@example.com″>

<display-name>Simon</display-name>

</entry>

</list>

<list name="My_Middle_School_Classmates">

<entry uri=″sip:friend1@example.com″>

<display-name>Friend1</display-name>

</entry>

<entry uri=″sip:friend2@example.com″>

<display-name>Friend1</display-name>

</entry>

<entry uri=″sip:friend3@example.com″>

<display-name>Friend1</display-name>

</entry>

</list>

</resource-lists>

The above XML document describes two lists of client A, one named "My-Close-Friends" and one named "My-Middle-School-Classmates". Assume that A allows delegatee B to read or modify the contents of the list "My-Middle-School-Classmates". but:

1) The child element <identity> in the <condition> element is:

<identity>

<one id=″userB@example.com″scheme=″sip″/>

</identity>

2) The <transformation> element contains the following sub-elements

<xpath>

/resource-lists/list[@name="My_Middle_School_Classmates"]

</xpath>

3) The <action> element is:

<operation>

<get>allow</get>

<put>deny</put>

<delete>deny</delete>

</operation>

The corresponding XDM delegation authorization rules are as follows:

Include the identity of user B in the <condition> element, indicating that the rule applies when the sender of the message is B;

There are four sub-elements in the <action> element. The first description allows read (GET) operations, the second description prohibits write (PUT) operations, the third description prohibits deletion (DELETE) operations, and the fourth description Prohibit POST operation;

Include an <xpath> element in the <transformation> element, and use the XPATH expression to specify which part of the corresponding XML document this rule applies to, and here it applies to the operation of the list named "My_Middle_School_Classmates" in the corresponding XML document.

http://xcap.example.com/services/resource-lists/users/sip:userA@exampl

e.com/xdm_delegation_rules.xml

<? xml version="1.0" encoding="UTF-8"? >

<ruleset xmlns="urn:ietf:params:xml:ns:common-policy">

<rule id="f3g44r3">

<condition>

<identity>

<one id=″userB@example.com″scheme=″sip″/>

</identity>

</condition>

<action>

<get>allow</get>

<put>deny</put>

<delete>deny</delete>

<post>deny</post>

</action>

<transformation>

<xpath>/resource-lists/list[@name=″

My_Middle_School_Classmates″]

</xpath>

</transformation>

</rule>

</ruleset>

In judging the delegation mode, a flag field may also be added in the message to indicate whether it is a delegation mode. The flag field is placed in the message header, and when the message is received, the delegation check processing module obtains the flag field, and judges whether it is a delegation mode or not.

FIG. 4 is a flow chart of the entrusted mode checking of the XML document management method of the embodiment in FIG. 3 .

As shown in Figure 4, the process includes obtaining the user ID of the message publisher; obtaining the owner ID of the operated document; if the above two IDs match, it is a general method, otherwise it is a delegated method.

In addition, in the qualification judgment of the entrusted party, such a method can also be adopted: the XML document management server sends the information related to the identity characteristics of the XML document management client to the XML document owner client to request confirmation, and the XML document owner client After confirmation, the confirmation information is returned to the XML document management server. If the confirmation result is authorization, the XML document management client is an authorized entrusted XML document management client, otherwise it is an unauthorized entrusted XML document management client.

The XDMS can also determine whether the XML document management client is the owner of the XML document, and if the XML document management client is the owner of the XML document, then perform common XML document management operations in the prior art, which will not be described in detail here. If the XML document management client is neither the owner of the XML document nor the authorized entrusted manager, the management operation of the XML document management client on the XML document is rejected.

In the above solution, if there is no description, it is taken as an example that the entrusting party or the entrusted party's XDMC is located in the user equipment. In addition, no matter the entrusting party or the entrusted party, when its XDMC is located in the application server, it can directly send the request to the corresponding XDMS without passing through the aggregation proxy; if its XDMC is located in the user terminal, it can forward the request to the corresponding XDMS through the aggregation proxy.

Fig. 5 is a message flow chart of the XML document management method of the third embodiment of the present invention.

User A entrusts the alumni server S to maintain friend information for him. When a classmate B of user A joins the alumni record of A's class, the server maintains a friend list stored in an XDMS for user A, and adds user B to the friend list.

(1) User A sets the XDM delegation authorization rules of the alumni server S in the XDMS where the friend list is stored through the XCAP protocol, allowing the alumni server to add friends to its friend list "MyClassmates".

(2) After user B joins the alumni record of A's class, in order to add user B to user A's friend list, the alumni record server S sends an XDM operation request to this XDMS.

(3) The XDMS executes the process of judging the aforementioned entrustment mode, obtains the identity of the message publisher, that is, the alumni server S, and the identity of the operation object owner A from the message, compares them, and determines the entrustment mode according to the comparison result.

(4) According to the message publisher ID, operation object and operation type obtained from the message, the XDMS determines that the alumni server S has the right to perform the XDM operation on behalf of user A in comparison with the XDM authorization rules stored by A in this XDMS, and then sends Add user B as a friend to user A's friend list.

In step (1), user A sends the following message to the corresponding XDMS when setting the XDM delegation authorization rules on the corresponding XDMS:

Among them, the <cr:rule id=ck81> element describes a defined rule, and the three sub-elements:

<cr:conditions> indicates the applicable conditions of the rule, that is, this rule applies when the message requester is the alumni server specified in the <cr:id> element.

The <cr:action> element describes the corresponding action of the XDM server when the rules apply. Among them, the first sub-element indicates that the GET operation is allowed, the second sub-element indicates that the PUT operation is allowed, and the third sub-element indicates that the DELETE is not allowed Operation; It should be noted that it does not specify whether to allow the POST operation. In practice, the XDM server can have a default action, and the commonly used default action here is deny, that is, the server refuses to execute the operation that is not defined.

The <cr:transformation> element specifies the operation object of the operation described in this rule, here the list named "My_Middle_School_Classmates" in the corresponding XML document.

PUT

http://xcap.example.com/services/shared-xdms/users/sip:userA@example.com

/xdm_delegation_rules.xml HTTP/1.1

Content-Type: application/auth-policy+xml

Content-Length: (...)

<? xml version="1.0" encoding="UTF-8"? >

<cr:ruleset

xmlns:op="urn:oma:params:xml:ns:pres-rules"

xmlns:pr="urn:ietf:params:xml:ns:pres-rules"

xmlns:cr="urn:ietf:params:xml:ns:common-policy"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<cr:rule id="ck81">

<cr:conditions>

<cr:identity>

<cr:id>sip:alumin@exampleservice.com</cr:id>

</cr:identity>

</cr:conditions>

<cr:actions>

<get>allow</get>

<put>allow></put>

<delete>deny</delete>

</cr:actions>

<cr:transformations>

<xpath>/resource-lists/list[@name="My_Middle_School_Classmates"]

</xpath>

</cr:transformations>

</cr:rule>

</cr:ruleset>

Assume that the sip address of the alumni server S is: sip:alumni@exampleservice.com, and the HTTP URI of the XDM delegation authorization document of user A is

http://xcap.example.com/services/shared-xdms/users/sip:userA@example.com

/xdm_delegation_auth.xml.

in:

sip:alumni@exampleservice.com is the identifier of the authorization object, indicating that this authorization rule defines access control to the alumni server;

<get>allow</get>, means that the alumni server is allowed to read, <put>allow</put> means that the alumni server is allowed to perform PUT operations, <delete>deny</delete> means that the alumni server is not allowed to execute DELETE operate;

<xpath>/resource-lists/list[@name="My_Middle_School_Classmates"]</xpath> indicates that the alumni server is allowed to operate the My_Middel_School_Classmates list.

After the corresponding XDMS receives this message, it creates an XDM delegation authorization rule.

Among them, in step 5), when the alumni record server adds user B to A's friend list, the message sent to the corresponding XDMS is:

PUT

http://xcap.example.com/services/shared-lists/users/sip:userA@example.com/

friends.xml/~~/resource-lists/list[@name="My_friends"]/entry[@uri="sip:frie

nd2@example.com″]HTTP/1.1

Content-Type: application/xcap-el+xml

Content-Length: (...)

<? xml version="1.0" encoding="UTF-8"? >

<entry uri="sip:friend2@example.com">

<display-name>Friend2</display-name>

</entry>

The entrusted checking and processing module in XDMS obtains the identifier "sip:alumni@exampleservice.com" of the message publisher and the identifier "sip:userA@example.com" of the owner of the operation object from this message, and the result of comparing the two identifiers is different , it is determined that the XDM operation request is in the delegation mode. Then refer to the XDM entrusted authorization rule set in step 1), confirm that the alumni server S is authorized to perform this operation, and then perform this XDM operation through XDMS.

The fourth embodiment of the present invention is an XML document access control method, comprising:

Step A: Determine whether the XML document access client requesting to access the XML document satisfies the XML document access condition, if so, execute B, otherwise exit the process;

Step B: According to the specified XML document access operation executed by the XML document access client satisfying the XML document access conditions, the specified XML document access operation requested by the XML document access client for the specific part of the XML document is executed.

In step A, the identity of the XML document management operation client can be compared with the predetermined XML document access client identity that satisfies the XML document access conditions according to the method of the above-mentioned embodiment, and if the two match, the XML document access client Satisfy the XML document access conditions, otherwise the XML document access client does not meet the XML document access conditions. The predetermined XML document access client identity that meets the XML document access conditions can be the identity of the owner of the XML document itself, or it can be The identity of other access clients who are scheduled to access the XML document. When the XML document access client matches the identity of the owner of the XML document, it means that the XML document access client is the owner of the XML document By itself, at this time, the XML document access client has greater access and operation rights, and can perform the access operation of the XML document according to the general XML document access process, and can also perform the access operation of the XML document according to the provisions of this method. When XML When the identity of the document access client matches the identity of other access clients that are scheduled to access the XML document, it means that the XML document access client is the entrusted client that can access the XML document.

In addition, in step A, an instant confirmation method can also be adopted, that is, the relevant information of the XML document access client requesting to access the XML document is sent to the XML document owner client for confirmation, and the XML document owner receives In the confirmation information returned by the client, if the confirmation result is that the XML document access client meets the XML document access condition, the XML document access client meets the XML document access condition, otherwise it does not meet the XML document access condition. This process is easy to implement with prior art and with reference to the above-mentioned embodiments, and details will not be repeated here.

The XML document access condition in step A at least includes but not limited to one of the following: the identity information condition of the XML document access client; the specified validity period condition; the requester's location information condition. For example, Identity, Domain, Validity, and Sphere listed in the first embodiment above.

The stipulation in step B includes: the XML document that meets the XML document access condition accesses a specific part of the XML document that the client can perform an access operation on. Specific parts of an XML document can be identified by XCAP URIs. Available access operations can be HTTP GET for read operations, HTTP PUT for write operations, HTTP DELETE for delete operations, HTTP POST for retrieval operations, etc.

Step B may further include: sending the execution result information "200 OK" to the XML document access client.

The above-mentioned examples are only used to illustrate specific implementations of the present invention, and are not intended to limit the scope of protection of the present invention. Those skilled in the art can make various modifications or improvements according to the basic idea of the present invention or the above-mentioned contents, as long as they fall within the scope of protection defined by the claims of the present invention or their equivalents, they should all be covered by the present invention .

Claims (22)

1. XML document management method may further comprise the steps:

Step 1:XML document management client is sent the XML document management operation request to the XML document management server;

Step 2:XML document management server receives the XML document management operation request of described XML document administrative client and judges whether the request of XML document administrative client satisfies the effective term of the delegable rule of described XML document bookkeeping, and the effective term of the delegable rule of described XML document bookkeeping comprises the identity information condition of XML document access client at least;

Step 3: when the effective term of delegable rule of XML document bookkeeping is satisfied in the request of XML document administrative client, the XML document bookkeeping of executing rule regulation.

2. XML document management method as claimed in claim 1 is characterized in that, wherein said step 2 comprises:

Identity information according to this XML document administrative client of acquisition request of XML document administrative client;

The identity information condition of the XML document access client in the effective term of the identity information of the XML document administrative client that obtained and described delegable rule is compared, if the two coupling, the identity of then described XML document administrative client satisfies the identity information condition of XML document access client of the effective term of described delegable rule.

3. XML document management method as claimed in claim 1 is characterized in that, the XML document bookkeeping of wherein said regular defined comprises:

Cura specialis operation to the XML document specific part.

4. XML document management method as claimed in claim 3 is characterized in that, the regulation of wherein said cura specialis operation to the XML document specific part one of comprises in following at least:

Carry out or do not carry out read operation to the XML document specific part;

Carry out or do not carry out write operation to the XML document specific part;

Carry out or do not carry out deletion action to the XML document specific part;

Carry out or do not carry out search operaqtion to the XML document specific part.

5. XML document management method as claimed in claim 4, it is characterized in that, the specific part of described XML document identifies with XCAP URI, described read operation is HTTP GET operation, said write is operating as HTTP PUT operation, described deletion action is HTTP DELETE operation, and described search operaqtion is HTTP POST operation.

6. XML document management method as claimed in claim 1 is characterized in that, wherein also comprises step before described step 1:

Formulate and on the XML document management server, store and move the delegable rule of described XML document bookkeeping.

7. XML document management method as claimed in claim 6 is characterized in that, wherein said rule is formulated by XML document owner client, and sends to described XML document management server by described XML document owner's client.

8. XML document management method as claimed in claim 6 is characterized in that, wherein said rule is formulated by the XML document management server.

9. XML document management method as claimed in claim 1 is characterized in that,

Also comprising step before the described step 1: the delegable rule of formulating and on the XML document management server, store and move described XML document bookkeeping;

The effective term of the delegable rule of described XML document bookkeeping comprises the identity information condition of XML document access client at least;

Described step 2 comprises: according to the identity information of this XML document administrative client of acquisition request of XML document administrative client; The identity information condition of the XML document access client in the effective term of the identity information of the XML document administrative client that obtained and described delegable rule is compared, if the two coupling, the identity of then described XML document administrative client satisfies the identity information condition of XML document access client of the effective term of described delegable rule;

The XML document bookkeeping of described regular defined one of comprises in following at least:

Carry out or do not carry out read operation to the XML document specific part;

Carry out or do not carry out write operation to the XML document specific part;

Carry out or do not carry out deletion action to the XML document specific part;

Carry out or do not carry out search operaqtion to the XML document specific part,

The specific part of wherein said XML document is with XCAP URI sign, and described read operation is operating as HTTP PUT operation for HTTP GET operation, said write, and described deletion action is the HTTPDELETE operation, and described search operaqtion is HTTP POST operation.

10. as each described XML document management method in the claim 1 to 9, it is characterized in that, wherein in described step 3, when the effective term of delegable rule of XML document bookkeeping is not satisfied in the request of XML document administrative client, carry out unauthorized trust processing procedure, comprising:

Judge whether described XML document administrative client is this XML document owner, if this XML document administrative client is this XML document owner, then carry out general XML document bookkeeping, otherwise refuse the bookkeeping of this XML document administrative client described XML document.

11. XML document management method as claimed in claim 10 is characterized in that, described XML document administrative client is the subscriber equipment terminal, its with described XML document management server between be connected by Aggregation Proxy and realize.

12. XML document management method as claimed in claim 11 is characterized in that it also comprises:

Step 4: described XML document management server sends to described XML document administrative client with XML document bookkeeping execution result information.

13. XML document management system, comprise XML document administrative client and XML document management server, described XML document administrative client is connected with the XML document management server, it is characterized in that, between described XML document administrative client and XML document management server, also be provided with the XML document bookkeeping and entrust inspection and processing unit, whether the XML document operation that this XML document bookkeeping entrusts inspection and processing unit to verify that described XML document administrative client is asked is the authorization trust formula, and the XML document bookkeeping that execution XML document administrative client is asked is handled accordingly.

14. XML document management system as claimed in claim 13 is characterized in that, wherein said XML document bookkeeping entrusts inspection and processing unit to comprise:

Entrust and check module, be used to check whether the XML document bookkeeping that the XML document administrative client is asked is way of bailment;

Authorization handler module is used to judge whether the way of bailment of entrusting the inspection module to determine is the way of bailment of mandate, and according to regular execution of delegable the cura specialis of XML document specific part is operated when way of bailment is the way of bailment of authorizing.

15. XML document management system as claimed in claim 14 is characterized in that, the specific part of wherein said XML document is with XCAP URI sign, and described cura specialis operation one of comprises in following at least:

Read operation HTTP GET;

Write operation HTTP PUT;

Deletion action HTTP DELETE;

Search operaqtion HTTP POST.

16. XML document management system as claimed in claim 15, it is characterized in that, it also comprises XML document owner client, this XML document owner client is connected with described XML document management server, the user sends the corresponding XML document delegable rule of this XML document owner document by described XML document owner's client to described XML document management server, sets up the bookkeeping delegable rule of this XML document.

17. as each described XML document management system in the claim 13 to 16, it is characterized in that, it also comprises Aggregation Proxy and SIP/IP Core, transmit information by described Aggregation Proxy between described XML document administrative client and the XML document management server, described SIP/IP Core is used to handle the subscribing message between described XML document administrative client and the described XML document management server.

18. an XML document access control method comprises:

Steps A: the XML document access client identify label of judging request visit XML document whether with described XML document owner outside the XML document access client identify label of effective term of the delegable rule that satisfies the XML document bookkeeping be complementary, if then carry out B, otherwise withdraw from this processing procedure, the effective term of the delegable rule of described XML document bookkeeping comprises the identity information condition of XML document access client at least;

Step B: the accessing operation that the XML document access client of the effective term of the delegable rule that satisfies the XML document bookkeeping is according to the rules carried out to the XML document specific part, carry out the XML document accessing operation of described XML document access client to the regulation of the specific part request execution of described XML document.

19. XML document access control method as claimed in claim 18 is characterized in that, wherein the effective term of the delegable rule of the XML document bookkeeping described in the steps A one of comprises in following at least:

The term of validity condition of described regulation;

Requestor's positional information condition.

20. XML document access control method as claimed in claim 19 is characterized in that, wherein the regulation described in the step B comprises:

Can the conduct interviews specific part of XML document of operation of the XML document access client of effective term that satisfies the delegable rule of XML document bookkeeping;

Described XML document access client is to the executable accessing operation of the specific part of described XML document, one of comprises at least in following:

Read operation;

Write operation;

Deletion action;

Search operaqtion.

21. XML document access control method as claimed in claim 20 is characterized in that, wherein step B also comprises:

Execution result information is sent described XML document access client.

22. as claim 20 or 21 described XML document access control methods, it is characterized in that, the specific part of described XML document identifies with XCAP URI, described read operation is the HTTPGET operation, said write is operating as HTTP PUT operation, described deletion action is the HTTPDELETE operation, and described search operaqtion is HTTP POST operation.

Images