Dynamic access decision information module

• US 20050004913A1
• Filed: 07/02/2003
• Published: 01/06/2005
• Est. Priority Date: 07/02/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gross, Thomas, Schunter, Matthias, Moran, Anthony Scott, Lovatt, Brook M.
• Granted Patent: US 7,523,200 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99934 Query formulation, input preparation, or translation
• CPC Class Codes: Y10S 707/99935 Query augmenting and refining, e.g. inexact access

Abstract

A dynamic information retrieval service is provided that can be configured to retrieve entitlement information from a plurality of providers. Any application that requires entitlement data may make a request for that information to the dynamic information retrieval service using a single standard interface. A request includes information describing the identity of the user and a list of names representing the entitlement data that are required. The dynamic information retrieval service determines the appropriate provider for the entitlement information, retrieves the entitlement data, and returns the requested entitlement data to the application. The dynamic information retrieval service may also cache the entitlement data. The dynamic information retrieval service may process requests requiring several distinct items of entitlement data to be retrieved in parallel. Therefore, applications may send a single request for entitlement data for a single user, but for several providers.

Claims

1. A method for dynamic access decision information retrieval, the method comprising:

receiving a request for access decision information from an application, wherein the request identifies one or more entitlement information items;

determining an information provider for a given entitlement information item within the one or more entitlement information items;

retrieving the given entitlement information item from the information provider;

forming a response, wherein the response includes the one or more entitlement information items; and

returning the container to the application.

2. The method of claim 1, further comprising:

caching the retrieved given entitlement information item in a local storage.

3. The method of claim 1, further comprising:

identifying a cached entitlement information item within the one or more entitlement information item; and

retrieving the cached entitlement information item from a local storage.

4. The method of claim 3, wherein the cached entitlement information is in the form of a container.

5. The method of claim 1, wherein the step of retrieving the given entitlement information item includes:

generating a retrieval client, wherein the retrieval client retrieves the given entitlement information item from the information provider.

6. The method of claim 5, wherein the retrieval client generates a protocol module and wherein the protocol module retrieves the given entitlement information item from the information provider using a provider specific protocol.

7. The method of claim 5, wherein the retrieved given entitlement information item is in the form of a container.

8. The method of claim 1, wherein the application is an access manager.

9. The method of claim 8, wherein the access manager includes a rules engine.

10. The method of claim 1, wherein the response is an extensible markup language document.

11. An apparatus for dynamic access decision information retrieval, the apparatus comprising:

receipt means for receiving a request for access decision information from an application, wherein the request identifies one or more entitlement information items;

determination means for determining an information provider for a given entitlement information item within the one or more entitlement information items;

retrieval means for retrieving the given entitlement information item from the information provider;

forming means for forming a response, wherein the response includes the one or more entitlement information items; and

returning means for returning the container to the application.

12. The apparatus of claim 11, further comprising:

means for caching the retrieved given entitlement information item in a local storage.

13. The apparatus of claim 11, further comprising:

means for identifying a cached entitlement information item within the one or more entitlement information item; and

means for retrieving the cached entitlement information item from a local storage.

14. The apparatus of claim 13, wherein the cached entitlement information is in the form of a container.

15. The apparatus of claim 11, wherein the retrieval means includes:

means for generating a retrieval client, wherein the retrieval client retrieves the given entitlement information item from the information provider.

16. The apparatus of claim 15, wherein the retrieval client generates a protocol module and wherein the protocol module retrieves the given entitlement information item from the information provider using a provider specific protocol.

17. The apparatus of claim 15, wherein the retrieved given entitlement information item is in the form of a container.

18. The apparatus of claim 11, wherein the application is an access manager.

19. The apparatus of claim 11, wherein the response is an extensible markup language document.

20. A computer program product, in a computer readable medium, for dynamic access decision information retrieval, the computer program product comprising:

instructions for receiving a request for access decision information from an application, wherein the request identifies one or more entitlement information items;

instructions for determining an information provider for a given entitlement information item within the one or more entitlement information items;

instructions for retrieving the given entitlement information item from the information provider;

instructions for forming a response, wherein the response includes the one or more entitlement information items; and

instructions for returning the container to the application.

21. The computer program product of claim 20, further comprising:

instructions for caching the retrieved given entitlement information item in a local storage.

22. The computer program product of claim 20, wherein the instructions for retrieving the given entitlement information item include:

instructions for generating a retrieval client, wherein the retrieval client retrieves the given entitlement information item from the information provider.

23. The computer program product of claim 22, wherein the retrieval client generates a protocol module and wherein the protocol module retrieves the given entitlement information item from the information provider using a provider specific protocol.

24. The computer program product of claim 22, wherein the retrieved given entitlement information item is in the form of a container.

25. The computer program product of claim 20, wherein the response is an extensible markup language document.