Abstract evaluation of access control policies for efficient evaluation of constraints

Patent metadata

Field	Value
Publication number	US-9537893-B2
Application number	US-201414326660-A
Country	US
Kind code	B2
Filing date	Jul 9, 2014
Priority date	Jul 9, 2014
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for evaluating access control constraints and include actions of receiving an access control request, obtaining a set of attributes based on an abstract evaluation of a policy, the set of attributes including one or more attributes that could be required to evaluate the access control request, requesting respective values of the one or more attributes in a batch request, receiving the respective values, and providing an access control decision based on the respective values and the policy.

First claim

What is claimed is:

1. A computer-implemented method for evaluating access control constraints, the method being executed using one or more processors and comprising:
receiving, by the one or more processors, an access control request to retrieve respective values of a plurality of attributes in a batch request to reduce a response time of an access control decision by reducing a communication overhead;
obtaining, by the one or more processors, a set of attributes by using a model of a policy that specifies the access control constraints and performs an abstract evaluation of the policy, the abstract evaluation of the policy comprising providing an abstract attribute for each attribute of the set of attributes, such that the set of attributes comprises the plurality of attributes that could be required by a policy decision point (PDP) to provide the access control decision;
requesting, by the one or more processors, the respective values of the plurality of attributes in the batch request;
receiving, by the one or more processors, the respective values; and
providing within the response time, by the one or more processors, the access control decision based on the respective values and the policy.

2. The method of claim 1 , wherein the abstract attribute comprises a placeholder for each attribute of the set of attributes that cannot be resolved during policy evaluation.

3. The method of claim 1 , wherein the abstract policy evaluation comprises determining that one or more of a rule, a policy and a policy set includes an abstract sub-element, and in response indicating that the one or more of the rule, the policy and the policy set is abstract.

4. The method of claim 1 , wherein the abstract policy evaluation comprises determining that a combining algorithm uses an abstract attribute, and in response evaluating all sub-elements of the policy.

5. The method of claim 1 , wherein a minimum number of attributes are included in the set of attributes, such that only attributes that could be used for the abstract evaluation of the policy are included in the set of attributes.

6. The method of claim 1 , wherein the access control request is received by a policy decision point (PDP) from a policy enforcement point (PEP), the PEP transmitting the access control request in response to an access request submitted by a user.

7. The method of claim 1 , wherein the one or more attributes comprise a service attribute, a value of which is provided by a service.

8. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for evaluating access control constraints, the operations comprising:
receiving an access control request to retrieve respective values of a plurality of attributes in a batch request to reduce a response time of an access control decision by reducing a communication overhead;
obtaining a set of attributes by using a model of a policy that specifies the access control constraints and performs an abstract evaluation of the policy, the abstract evaluation of the policy comprising providing an abstract attribute for each attribute of the set of attributes, such that the set of attributes comprises the plurality of attributes that could be required by a policy decision point (PDP) to provide the access control decision;
requesting the respective values of the plurality of attributes in the batch request;
receiving the respective values; and
providing within the response time the access control decision based on the respective values and the policy.

9. The computer-readable storage medium of claim 8 , wherein the abstract attribute comprises a placeholder for each attribute of the set of attributes that cannot be resolved during policy evaluation.

10. The computer-readable storage medium of claim 8 , wherein the abstract policy evaluation comprises determining that one or more of a rule, a policy and a policy set includes an abstract sub-element, and in response indicating that the one or more of the rule, the policy and the policy set is abstract.

11. The computer-readable storage medium of claim 8 , wherein the abstract policy evaluation comprises determining that a combining algorithm uses an abstract attribute, and in response evaluating all sub-elements of the policy.

12. The computer-readable storage medium of claim 8 , wherein a minimum number of attributes are included in the set of attributes.

13. The computer-readable storage medium of claim 8 , wherein the access control request is received by a policy decision point (PDP) from a policy enforcement point (PEP), the PEP transmitting the access control request in response to an access request submitted by a user.

14. The computer-readable storage medium of claim 8 , wherein the one or more attributes comprise a service attribute, a value of which is provided by a service.

15. A system, comprising:
a client-side computing device; and
a computer-readable storage device coupled to the client-side computing device and having instructions stored thereon which, when executed by the client-side computing device, cause the client-side computing device to perform operations for evaluating access control constraints, the operations comprising:
receiving an access control request to retrieve respective values of a plurality of attributes in a batch request to reduce a response time of an access control decision by reducing a communication overhead;
obtaining a set of attributes by using a model of a policy that specifies the access control constraints and performs an abstract evaluation of the policy, the abstract evaluation of the policy comprising providing an abstract attribute for each attribute of the set of attributes, such that the set of attributes comprises the plurality of attributes that could be required by a policy decision point (PDP) to provide the access control decision;
requesting the respective values of the plurality of attributes in the batch request;
receiving the respective values; and
providing within the response time the access control decision based on the respective values and the policy.

16. The system of claim 15 , wherein the abstract attribute comprises a placeholder for each attribute of the set of attributes of the policy that cannot be resolved during policy evaluation.

17. The system of claim 15 , wherein the abstract policy evaluation comprises determining that one or more of a rule, a policy and a policy set includes an abstract sub-element, and in response indicating that the one or more of the rule, the policy and the policy set is abstract.

18. The system of claim 15 , wherein the abstract policy evaluation comprises determining that a combining algorithm uses an abstract attribute, and in response evaluating all sub-elements of the policy.

19. The system of claim 15 , wherein a minimum number of attributes are included in the set of attributes.

20. The system of claim 15 , wherein the access control request is received by a policy decision point (PDP) from a policy enforcement point (PEP), the PEP transmitting the access control request in response to an access request submitted by a user.

Assignees

• Brucker Achim D
• Petritsch Helmut
• Sap Se

Inventors

• Brucker Achim D
• Petritsch Helmut

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/102

  Entity profiles · CPC title