1. A computer-implemented method for creating a logical security model based on a physical security model defining user access rights to physical data, the method comprising:
for each of the user access rights defined by the physical security model, creating a logical access right definition for a logical model, wherein the logical model comprises a plurality of logical field definitions each comprising a field name, physical field location information identifying a specific field of the physical data and an access method for accessing the specific field of the physical data according to the physical field location information; wherein the access methods of a first portion of the plurality of logical field definitions are of a first type and the access methods of a second portion of the plurality of logical field definitions are of a second type;
applying the logical access right definitions to the logical model so that the logical model reflects the user access rights to the physical data; and
executing, by operation of one or more computer processors, abstract queries composed on the basis of the logical model.
2. The method of claim 1, further comprising:
allowing one or more users to access the physical data through the logical model, wherein the access to physical data is restricted according to the logical access right definitions.
3. The method of claim 1, wherein the physical field location information comprises an identifier of a database table and an identifier of a column of the table.
4. A computer-implemented method for creating a logical security model based on a physical security model, the method comprising:
automatically, by operation of one or more computer processors executing a data crawler, traversing physical data to identify physical access rights rules;
creating a plurality of views defining logical access rights rules for the identified physical access rights rules of the physical data; and
selectively applying the plurality of views to a logical model comprising a plurality of logical field definitions mapping to corresponding physical fields of the physical data, wherein the plurality of logical field definitions each comprise a field name, physical field location information identifying a specific field of the physical data and an access method for accessing the specific field of the physical data according to the physical field location information; wherein the access methods of a first portion of the plurality of logical field definitions are of a first type and the access methods of a second portion of the plurality of logical field definitions are of a second type; wherein the application of the plurality of views to the logical model operates to make selected logical fields unavailable to a user of the logical model, the selected logical fields being those for which logical access rights rules exist, whereby access to the physical data is restricted on the basis of the applied plurality of views.
5. The method of claim 4, wherein the plurality of views comprise expressions each defining a physical location of a field of the physical data for which an identified access rights rule exists.
6. The method of claim 4, wherein automatically traversing physical data to identify the physical access rights rules comprises:
accessing a physical database containing the physical data;
identifying all database tables contained in the physical database, the database tables containing the physical data; and
for each database table, retrieving an associated table access rights specification including the physical access rights rules for the database table.
7. The method of claim 6, wherein automatically traversing physical data to identify the physical access rights rules comprises:
iteratively identifying the physical access rights rules for all database tables of the physical database.
8. The method of claim 4, further comprising creating user profiles each defining one or more of the plurality of views to be applied to a given user, and wherein selectively applying the plurality of views comprises applying only those one or more of the plurality of views of a given user profile to the user for which the user profile is defined.
9. The method of claim 4, further comprising defining a given view of the plurality of views to be applied to a given group of users, and wherein selectively applying the plurality of views comprises applying the given view to users of the given group.
10. The method of claim 4, wherein the physical field location information comprises an identifier of a database table and an identifier of a column of the table.
11. The method of claim 4, wherein at least one of the plurality of logical field definitions comprises a field name that is different from a name of the field of the physical data to which the at least one of the plurality of logical field definitions maps to.
12. A computer-implemented method for creating a logical security model based on a physical security model defining user access rights to physical data, the method comprising:
for each of the user access rights defined by the physical security model, creating a logical access right definition for a logical model, wherein the logical model abstractly describes the physical data and is defined for accessing the physical data; wherein the logical model comprises a plurality of logical field definitions that each comprise a field name, physical field location information identifying a specific field of the physical data and an access method for accessing the specific field of the physical data according to the physical field location information, a respective access method being invoked upon execution of a given abstract query containing a field name corresponding to a logical field definition containing the respective access method; and
applying, by operation of one or more computer processors, the logical access right definitions to the logical model so that the logical model reflects the user access rights to the physical data, wherein applying the logical access right definitions to the logical model results in each of the access rights to the physical data being reflected in the logical model.
13. A computer-readable storage medium containing a program which, when executed by a processor, performs operations for creating a logical security model based on a physical security model defining user access rights to physical data, the operations comprising:
for each of the user access rights defined by the physical security model, creating a logical access right definition for a logical model, wherein the logical model comprises a plurality of logical field definitions each comprising a field name, physical field location information identifying a specific field of the physical data and an access method for accessing the specific field of the physical data; wherein the access methods of a first portion of the plurality of logical field definitions are of a first type and the access methods of a second portion of the plurality of logical field definitions are of a second type;
applying the logical access right definitions to the logical model so that the logical model reflects the user access rights to the physical data; and
executing, by operation of one or more computer processors, abstract queries composed on the basis of the logical model.
14. The computer-readable storage medium of claim 13, wherein the operations further comprise:
allowing one or more users to access the physical data through the logical model, wherein the access to physical data is restricted according to the logical access right definitions.
15. The computer-readable storage medium of claim 13, wherein applying the logical access right definitions to the logical model results in each of the access rights to the physical data being reflected in the logical model.
16. The computer-readable storage medium of claim 13, wherein the physical field location information comprises an identifier of a database table and an identifier of a column of the table.
17. A computer-readable storage medium containing a program which, when executed by a processor, performs operations for creating a logical security model based on a physical security model, the operations comprising:
traversing, by operation of one or more computer processors executing a data crawler, physical data to identify physical access rights rules;
creating a plurality of views defining logical access rights rules for the identified physical access rights rules of the physical data; and
selectively applying the plurality of views to a logical model comprising a plurality of logical field definitions mapping to corresponding physical fields of the physical data, wherein the plurality of logical field definitions each comprise a field name, physical field location information identifying a specific field of the physical data and an access method for accessing the specific field of the physical data according to the physical field location information; wherein the access methods of a first portion of the plurality of logical field definitions are of a first type and the access methods of a second portion of the plurality of logical field definitions are of a second type; wherein the application of the plurality of views to the logical model operates to make selected logical fields unavailable to a user of the logical model, the selected logical fields being those for which logical access rights rules exist, whereby access to the physical data is restricted on the basis of the applied plurality of views.
18. The computer-readable storage medium of claim 17, wherein the plurality of views comprise expressions each defining a physical location of a field of the physical data for which an identified access rights rule exists.
19. The computer-readable storage medium of claim 17, wherein traversing physical data to identify the physical access rights rules comprises:
accessing a physical database containing the physical data;
identifying all database tables contained in the physical database, the database tables containing the physical data; and
for each database table, retrieving an associated table access rights specification including the physical access rights rules for the database table.
20. The computer-readable storage medium of claim 19, wherein traversing physical data to identify the physical access rights rules comprises:
iteratively identifying the physical access rights rules for all database tables of the physical database.
21. The computer-readable storage medium of claim 17, wherein the operations further comprise:
creating user profiles each defining one or more of the plurality of views to be applied to a given user, and wherein selectively applying the plurality of views comprises applying only those one or more of the plurality of views of a given user profile to the user for which the user profile is defined.
22. The computer-readable storage medium of claim 17, wherein the operations further comprise:
defining a given view of the plurality of views to be applied to a given group of users, and wherein selectively applying the plurality of views comprises applying the given view to users of the given group.
23. The computer-readable storage medium of claim 17, wherein the physical field location information comprises an identifier of a database table and an identifier of a column of the table.
24. The computer-readable storage medium of claim 17, wherein at least one of the plurality of logical field definitions comprises a field name that is different from a name of the field of the physical data to which the at least one of the plurality of logical field definitions maps to.
25. A system, comprising:
one or more computer processors;
a physical security model defining user access rights to physical data and stored on a storage medium; and
a logical model security manager for creating a logical security model based on the physical security model, the logical model security manager being configured to:
for each of the user access rights defined by the physical security model, create a logical access right definition for a logical model, wherein the logical model comprises a plurality of logical field definitions each comprising a field name, physical field location information identifying a specific field of the physical data and an access method for accessing the specific field of the physical data according to the physical field location information; wherein the access methods of a first portion of the plurality of logical field definitions are of a first type and the access methods of a second portion of the plurality of logical field definitions are of a second type; and
apply the logical access right definitions to the logical model so that the logical model reflects the user access rights to the physical data.
26. A system, comprising:
one or more computer processors;
a physical security model defining physical access rights rules and stored on a storage medium;
a logical model security manager for creating a logical security model based on the physical security model, the logical model security manager configuring at least one of the one or more computer processors to:
traverse physical data to identify the physical access rights rules;
create a plurality of views defining logical access rights rules for the identified physical access rights rules of the physical data; and
selectively apply the plurality of views to a logical model comprising a plurality of logical field definitions mapping to corresponding physical fields of the physical data, wherein the plurality of logical field definitions each comprise a field name, physical field location information identifying a specific field of the physical data and an access method for accessing the specific field of the physical data according to the physical field location information; wherein the access methods of a first portion of the plurality of logical field definitions are of a first type and the access methods of a second portion of the plurality of logical field definitions are of a second type; wherein the application of the plurality of views to the logical model operates to make selected logical fields unavailable to a user of the logical model, the selected logical fields being those for which logical access rights rules exist, whereby access to the physical data is restricted on the basis of the applied plurality of views.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method, comprising the step of:
allowing through one or more network controllers a second user agent to communicate with a first user agent through employment of a codec format unsupported by the first user agent, wherein the one or more network controllers support a) selectable mode vocoder, b) G.711, c) adaptive differential pulse code modulation, d) enhanced variable rate codec and e) 13 k codec formats;
translating by one or more of the one or more network controllers one or more media packets of the codec format unsupported by the first user agent to one or more media packets of a codec format that is supported by the first user agent;
wherein the one or more network controllers comprise first and second network controllers, and wherein the step of translating by the one or more of the one or more network controllers the one or more media packets of the codec format unsupported by the first user agent to the one or more media packets of the codec format that is supported by the first user agent comprises the steps of:
evaluating by the second network controller one or more characteristics of a signaling message; and
determining based on the one or more characteristics by the second network controller whether to allocate a gateway that serves to translate a subsequent media packet of the one or more media packet of the codec format unsupported by the first user agent to a media packet of the one or more media packets of the codec format that is supported by the first user agent or to send the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to the first network controller to be translated to the media packet of the one or more media packets of the codec format that is supported by the first user agent;
wherein the one or more characteristics of the signaling message comprise the codec format of the subsequent media packet, wherein the step of evaluating by the second network controller the one or more characteristics of the signaling message comprises the steps of:
comparing a first number of bits used to represent the subsequent media packet of the codec format unsupported by the first user agent and a second number of bits used to represent the media packet of the codec format that is supported by the first user agent;
determining to translate by the second network controller the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to the media packet of the one or more media packets of the codec format that is supported by the first user agent if the first number is greater than the second number; and
determining to ignore the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent.
2. The method of claim 1 further comprising the step of:
allowing through one or more of the one or more network controllers the first user agent to communicate with the second user agent through employment of a codec format unsupported by the second user agent.
3. The method of claim 2, wherein the step of allowing through the one or more of the one or more network controllers the first user agent to communicate with the second user agent through employment of the codec format unsupported by the second user agent comprises the step of:
translating by one or more of the one or more network controllers one or more media packets of the codec format unsupported by the second user agent to one or more media packets of a codec format that is supported by the second user agent.
4. The method of claim 1, wherein the step of allowing through the one or more network controllers the second user agent to communicate with the first user agent through employment of the codec format unsupported by the first user agent comprises the steps of:
generating a list of one or more codec formats supported by the first user agent;
appending the list with one or more codec formats supported by the one or more network controllers that are unsupported by the first user agent; and
employing the list to select a codec format unsupported by the first user agent for communication by the second user agent.
5. The method of claim 4, wherein the step of generating the list of one or more codec formats supported by the first user agent comprises the steps of:
arranging an order for the one or more codec formats supported by the first user agent in the list from highest voice quality to lowest voice quality; and
sending the list from the first user agent to one or more of the one or more network controllers.
6. The method of claim 4, wherein the step of employing the list to select the codec format unsupported by the first user agent for communication by the second user agent comprises the steps of:
selecting by the second user agent the codec format from the list of the one or more codec formats supported by the one or more network controllers that are unsupported by the first user agent; and
sending an indication of the codec format selected by the second user agent from the second user agent to one or more of the one or more network controllers.
7. The method of claim 1, wherein the one or more network controllers comprise first and second network controllers, and wherein the step of translating by the one or more of the one or more network controllers the one or more media packets of the codec format unsupported by the first user agent to the one or more media packets of the codec format that is supported by the first user agent comprises the steps of:
sending a signaling message from the second user agent to the second network controller;
sending the signaling message from the second network controller to the first network controller; and
translating by the first network controller a subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to a media packet of the one or more media packets of the codec format that is supported by the first user agent.
8. A method, comprising the step of:
allowing through one or more network controllers a second user agent to communicate with a first user agent through employment of a codec format unsupported by the first user agent, wherein the one or more network controllers support a) selectable mode vocoder, b) G.711, c) adaptive differential pulse code modulation, d) enhanced variable rate codec and e) 13 k codec formats;
translating by one or more of the one or more network controllers one or more media packets of the codec format unsupported by the first user agent to one or more media packets of a codec format that is supported by the first user agent;
wherein the one or more network controllers comprise first and second network controllers, and wherein the step of translating by the one or more of the one or more network controllers the one or more media packets of the codec format unsupported by the first user agent to the one or more media packets of the codec format that is supported by the first user agent comprises the steps of:
evaluating by the second network controller a traffic level or available resources of a network carrying the one or more media packets; and
determining based on the traffic level or the available resources of the network by the second network controller whether to:
allocate a gateway that serves to translate a subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to a media packet of the one or more media packets of the codec format that is supported by the first user agent, or
ignore the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent.
9. The method of claim 8 further comprising the step of:
allowing through one or more of the one or more network controllers the first user agent to communicate with the second user agent through employment of a codec format unsupported by the second user agent.
10. The method of claim 9, wherein the step of allowing through the one or more of the one or more network controllers the first user agent to communicate with the second user agent through employment of the codec format unsupported by the second user agent comprises the step of:
translating by one or more of the one or more network controllers one or more media packets of the codec format unsupported by the second user agent to one or more media packets of a codec format that is supported by the second user agent.
11. The method of claim 8, wherein the step of allowing through the one or more network controllers the second user agent to communicate with the first user agent through employment of the codec format unsupported by the first user agent comprises the steps of:
generating a list of one or more codec formats supported by the first user agent;
appending the list with one or more codec formats supported by the one or more network controllers that are unsupported by the first user agent; and
employing the list to select a codec format unsupported by the first user agent for communication by the second user agent.
12. The method of claim 11, wherein the step of generating the list of one or more codec formats supported by the first user agent comprises the steps of:
arranging an order for the one or more codec formats supported by the first user agent in the list from highest voice quality to lowest voice quality; and
sending the list from the first user agent to one or more of the one or more network controllers.
13. The method of claim 11, wherein the step of employing the list to select the codec format unsupported by the first user agent for communication by the second user agent comprises the steps of:
selecting by the second user agent the codec format from the list of the one or more codec formats supported by the one or more network controllers that are unsupported by the first user agent; and
sending an indication of the codec format selected by the second user agent from the second user agent to one or more of the one or more network controllers.
14. The method of claim 8, wherein the one or more network controllers comprise first and second network controllers, and wherein the step of translating by the one or more of the one or more network controllers the one or more media packets of the codec format unsupported by the first user agent to the one or more media packets of the codec format that is supported by the first user agent comprises the steps of:
sending a signaling message from the second user agent to the second network controller;
sending the signaling message from the second network controller to the first network controller; and
translating by the first network controller a subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to a media packet of the one or more media packets of the codec format that is supported by the first user agent.
15. A method, comprising the step of:
allowing through one or more network controllers a second user agent to communicate with a first user agent through employment of a codec format unsupported by the first user agent;
translating by one or more of the one or more network controllers one or more media packets of the codec format unsupported by the first user agent to one or more media packets of a codec format that is supported by the first user agent;
wherein the one or more network controllers comprise first and second network controllers, and wherein the step of translating by the one or more of the one or more network controllers the one or more media packets of the codec format unsupported by the first user agent to the one or more media packets of the codec format that is supported by the first user agent comprises the steps of:
evaluating by the second network controller one or more characteristics of a signaling message; and
determining based on the one or more characteristics by the second network controller whether to allocate a gateway that serves to translate a subsequent media packet of the one or more media packet of the codec format unsupported by the first user agent to a media packet of the one or more media packets of the codec format that is supported by the first user agent or to send the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to the first network controller to be translated to the media packet of the one or more media packets of the codec format that is supported by the first user agent;
wherein the one or more characteristics of the signaling message comprise the codec format of the subsequent media packet, wherein the step of evaluating by the second network controller the one or more characteristics of the signaling message comprises the steps of:
comparing a first number of bits used to represent the subsequent media packet of the codec format unsupported by the first user agent and a second number of bits used to represent the media packet of the codec format that is supported by the first user agent;
determining to translate by the second network controller the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to the media packet of the one or more media packets of the codec format that is supported by the first user agent if the first number is greater than the second number; and
determining to ignore the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent.
16. A method, comprising the step of:
allowing through one or more network controllers a second user agent to communicate with a first user agent through employment of a codec format unsupported by the first user agent;
translating by one or more of the one or more network controllers one or more media packets of the codec format unsupported by the first user agent to one or more media packets of a codec format that is supported by the first user agent;
wherein the one or more network controllers comprise first and second network controllers, and wherein the step of translating by the one or more of the one or more network controllers the one or more media packets of the codec format unsupported by the first user agent to the one or more media packets of the codec format that is supported by the first user agent comprises the steps of:
evaluating by the second network controller a traffic level or available resources of a network carrying the one or more media packets; and
determining based on the traffic level or the available resources of the network by the second network controller whether to:
allocate a gateway that serves to translate a subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent to a media packet of the one or more media packets of the codec format that is supported by the first user agent, or
ignore the subsequent media packet of the one or more media packets of the codec format unsupported by the first user agent.