Ensuring compliance regulations in systems with dynamic access control

Patent metadata

Field	Value
Publication number	US-10248796-B2
Application number	US-201414325551-A
Country	US
Kind code	B2
Filing date	Jul 8, 2014
Priority date	Jul 8, 2014
Publication date	Apr 2, 2019
Grant date	Apr 2, 2019

Abstract

Methods, systems, and computer-readable storage media for enforcing dynamic access control constraints of a plurality of access control policies, and actions include receiving a set of ordered policies, determining a set of active policies including one or more policies in the set of ordered policies, determining an access control decision based on at least a first policy in the set of active policies, the access control decision being based on determining whether one of a permit decision and a deny decision is inherited from a second policy in the set of ordered policies, and transmitting the access control decision for enforcement of the access control policy.

First claim

What is claimed is:

1. A computer-implemented method for enforcing dynamic access control constraints of a plurality of access control policies, the method being executed using one or more processors and comprising:
receiving, by the one or more processors, a set of ordered policies that are ordered according to a policy lattice defining a hierarchy from most restrictive policies to least restrictive policies, the policy lattice combining an access control algorithm, a deny cache storing previously denied requests, and a permit cache storing previous access control requests, the policy lattice enabling access control overriding for a first portion of policies that are controlled in a fine-grained manner and providing an explicit access control specification for a second portion of policies that are enforceable at any time;
determining, by the one or more processors, a set of active policies comprising one or more policies in the set of ordered policies, the set of active policies being used in evaluating an access control request during a particular time period;
determining, by the one or more processors, an access control decision based on at least a first policy in the set of active policies, the access control decision being based on operations comprising:
determining whether one of a permit decision and a deny decision is inherited from a second policy in the set of ordered policies that extends from the first policy in the set of active policies based on the policy lattice, the permit decision being inherited if the second policy is active and the deny decision being inherited regardless whether the second policy is active, and
in response to determining that the permit decision and the deny decision are not inherited from the second policy, evaluating the first policy in the set of active policies based on the policy lattice; and

transmitting, by the one or more processors, the access control decision for enforcement of the access control policy.

2. The method of claim 1 , wherein determining an access control decision comprises determining that a permit decision is not inherited, and in response inducing evaluation of an access control request based on the first policy.

3. The method of claim 2 , further comprising determining that the access control request evaluates a permit decision, and in response, determining whether a deny decision is inherited.

4. The method of claim 3 , wherein, in response to determining that a deny decision is inherited, setting the access control decision to deny.

5. The method of claim 1 , wherein the second policy is an inactive policy.

6. The method of claim 1 , wherein the most restrictive policies define impermissible actions that would violate legal constraints and the least restrictive policies define permissions grantable to users with associated obligations.

7. The method of claim 1 , further comprising receiving an access control request from a policy enforcement point.

8. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for enforcing dynamic access control constraints of a plurality of access control policies, the operations comprising:
receiving a set of ordered policies that are ordered according to a policy lattice defining a hierarchy from most restrictive policies to least restrictive policies, the policy lattice combining an access control algorithm, a deny cache storing previously denied requests, and a permit cache storing previous access control requests, the policy lattice enabling access control overriding for a first portion of policies that are controlled in a fine-grained manner and providing an explicit access control specification for a second portion of policies that are enforceable at any time;
determining a set of active policies comprising one or more policies in the set of ordered policies, the set of active policies being used in evaluating an access control request during a particular time period;
determining an access control decision based on at least a first policy in the set of active policies, the access control decision being based on operations comprising:
determining whether one of a permit decision and a deny decision is inherited from a second policy in the set of ordered policies that extends from the first policy in the set of active policies based on the policy lattice, the permit decision being inherited if the second policy is active and the deny decision being inherited regardless whether the second policy is active, and

in response to determining that the permit decision and the deny decision are not inherited from the second policy, evaluating the first policy in the set of active policies based on the policy lattice; and
transmitting the access control decision for enforcement of the access control policy.

9. The computer-readable storage medium of claim 8 , wherein determining an access control decision comprises determining that a permit decision is not inherited, and in response inducing evaluation of an access control request based on the first policy.

10. The computer-readable storage medium of claim 9 , wherein operations further comprise determining that the access control request evaluates to a permit decision, and in response, determining whether a deny decision is inherited.

11. The computer-readable storage medium of claim 10 , wherein, in response to determining that a deny decision is inherited, setting the access control decision to deny.

12. The computer-readable storage medium of claim 8 , wherein the second policy is an inactive policy.

13. The computer-readable storage medium of claim 8 , wherein policies in the set of ordered policies are ordered from most restrictive to least restrictive.

14. The computer-readable storage medium of claim 8 , wherein operations further comprise receiving an access control request from a policy enforcement point.

15. A system, comprising:
a computing device; and
a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for determining weights for enforcing dynamic access control constraints of a plurality of access control policies, the operations comprising:
receiving a set of ordered policies that are ordered according to a policy lattice defining a hierarchy from most restrictive policies to least restrictive policies, the policy lattice combining an access control algorithm, a deny cache storing previously denied requests, and a permit cache storing previous access control requests, the policy lattice enabling access control overriding for a first portion of policies that are controlled in a fine-grained manner and providing an explicit access control specification for a second portion of policies that are enforceable at any time;
determining a set of active policies comprising one or more policies in the set of ordered policies, the set of active policies being used in evaluating an access control request during a particular time period;
determining an access control decision based on at least a first policy in the set of active policies, the access control decision being based on operations comprising:
determining whether one of a permit decision and a deny decision is inherited from a second policy in the set of ordered policies that extends from the first policy in the set of active policies based on the policy lattice, the permit decision being in

Assignees

• Brucker Achim D
• Petritsch Helmut
• Sap Se

Inventors

• Brucker Achim D
• Petritsch Helmut

Classifications

• G16H10/60

  for patient-specific data, e.g. for electronic patient records · CPC title

• G06F21/41 Primary

  where a single sign-on provides access to a plurality of computers · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title