Prefetch of attributes in evaluating access control requests

Patent metadata

Field	Value
Publication number	US-9256757-B2
Application number	US-81794810-A
Country	US
Kind code	B2
Filing date	Jun 17, 2010
Priority date	Jun 17, 2010
Publication date	Feb 9, 2016
Grant date	Feb 9, 2016

Abstract

In an embodiment, a method is provided for prefetching attributes used in access control evaluation. In this method, an access control policy that comprises rules is retrieved. These rules further comprise parameters. At least one of the rules is categorized into a class from multiple classes based on at least one of the parameters. Here, the class is a grouping based on at least one of these parameters. An attribute associated with the at least one of these parameters is identified and this attribute is mapped to the class.

First claim

What is claimed is:

1. A method of prefetching attributes used in access control evaluation, the method comprising:
retrieving an access control policy that comprises a plurality of rules, the plurality of rules further comprising a plurality of parameters;
categorizing at least one of the plurality of rules into a class from a plurality of classes based on at least one of the plurality of parameters, the class being a grouping based on the at least one of the plurality of parameters;
identifying an attribute associated with the at least one of the plurality of parameters;
mapping the attribute to the class from the plurality of classes, at least one of the steps being performed by at least one hardware device; and
providing an access control decision based on the attribute and the access control policy.

2. The method of claim 1 , further comprising:
receiving an access control request that comprises the at least one of the plurality of parameters;
identifying the access control request to match the class from the plurality of classes based on the at least one of the plurality of parameters;
identifying the attribute associated with the class from the mapping; and
transmitting a response to the access control request, the response including a request for the attribute.

3. The method of claim 2 , further comprising:
receiving a further access control request that includes the attribute;
providing a second access control decision based on the attribute and the access control policy; and
transmitting a further response to the further access control request, the further response including the second access control decision.

4. The method of claim 1 , further comprising:
accessing an access control request that comprises the at least one of the plurality of parameters;
identifying the access control request to match the class from the plurality of classes based on the at least one of the plurality of parameters;
identifying the attribute associated with the class from the mapping;
retrieving the attribute;
inserting the attribute into the access control request;
transmitting the access control request having the attribute; and
receiving a response to the access control request, the response including the access control decision.

5. The method of claim 1 , wherein the plurality of parameters comprise at least one of a role, a resource, an action on the resource, or a constraint.

6. The method of claim 1 , wherein at least one of the plurality of parameters includes a constraint, and wherein the identified attribute is associated with the constraint.

7. The method of claim 1 , wherein each class from the plurality of classes is a grouping based on a different set of the plurality of parameters.

8. A computing device comprising:
at least one processor; and
a memory in communication with the at least one processor, the memory being configured to store a prefetch analysis module that is executable by the at least one processor, the prefetch analysis module having instructions that when executed by the at least one processor, cause operations to be performed, the operations comprising:
retrieving an access control policy that comprises a plurality of rules, the plurality of rules further comprising a plurality of parameters;
categorizing at least one of the plurality of rules into a class from a plurality of classes based on at least one of the plurality of parameters, the class being a grouping based on the at least one of the plurality of parameters;
identifying an attribute associated with the at least one of the plurality of parameters;
mapping the attribute to the class from the plurality of classes; and
providing an access control decision based on the attribute and the access control policy.

9. The computing device of claim 8 , wherein the memory is further configured to store a request evaluation module having instructions that when executed by the at least one processor, cause operations to be performed, the operations comprising:
receiving an access control request from a policy enforcement point module, the access control request comprising the at least one of the plurality of parameters;
identifying the attribute associated with the class from the mapping;
identifying the access control request to match the class from the plurality of classes based on the at least one of the plurality of parameters; and
transmitting a response to the policy enforcement point module, the response including a request for the attribute.

10. The computing device of claim 9 , further comprising:
receiving a further access control request from the policy enforcement point module, the further access control request including the attribute;
providing a second access control decision based on the attribute and the access control policy; and
transmitting a further response to policy enforcement point module, the further response including the second access control decision.

11. The computing device of claim 8 , wherein the memory is further configured to store a policy enforcement module having instructions that when executed by the at least one processor, cause operations to be performed, the operations comprising:
accessing an access control request that comprises the at least one of the plurality of parameters;
identifying the access control request to match the class from the plurality of classes based on the at least one of the plurality of parameters;
identifying the attribute associated with the class from the mapping;
retrieving the attribute;
inserting the attribute into the access control request;
transmitting the access control request having the attribute to a policy decision point module; and
receiving a response from the policy decision point module, the response including the access control decision.

12. The computing device of claim 11 , wherein a single access control request is transmitted to the policy decision point module, and wherein a single response is received from the policy decision point module.

13. The computing device of claim 8 , wherein the plurality of parameters comprise at least one of a role, a resource, an action on the resource, or a constraint.

14. The computing device of claim 8 , wherein the at least one of the plurality of parameters includes a constraint, and wherein the identified attribute is associated with the constraint.

15. A non-transitory machine-readable medium that stores instructions,which, when performed by a machine, cause the machine to perform operations comprising:
retrieving an access control policy that comprises a plurality of rules, the plurality of rules further comprising a plurality of parameters;
categorizing at least one of the plurality of rules into a class from a plurality of classes based on at least one of the plurality of parameters, the class being a grouping based on the at least one of the plurality of parameters;
identifying an attribute associated with the at least one of the plurality of parameters;
mapping the attribute to the class from the plurality of classes;and
providing an access control decision based on the attribute and the access control policy.

16. The non-transitory machine-readable medium of claim 15 , further comprising:
receiving an access control request that comprises the at least one of the plurality of parameters;
identifying the access control request to match the class from the plurality of classes based on the at least one of the plurality of parameters;
identifying the attribute associated with the class from the mapping; and
transmitting a respo

Assignees

• Brucker Achim D
• Petritsch Helmut
• Sap Se

Inventors

• Brucker Achim D
• Petritsch Helmut

Classifications

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/102

  Entity profiles · CPC title