Integrated access authorization
First Claim
1. A computer-readable storage medium whose contents cause a computer to:
- receive an authorization query regarding a request to access a resource;
identify a principal requesting to access the resource;
perform an access control check to determine whether to deny authorization to access the resource, the access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules; and
responsive to determining to deny authorization to access the resource, return a deny decision denying authorization to access the resource, and enter an entry into an audit log, the entry recording the denial of authorization, such that the computer instructions are executed as an integral component of an operating system suitable for executing on the computer.
2 Assignments
0 Petitions
Accused Products
Abstract
A facility for performing an access control check as an integral component of an operating system and utilizing a centralized policy store is provided. The facility executes as an integral part of an operating system executing on a computer and receives an authorization query to determine whether a principal has authorization to access a resource. The facility applies a policy maintained in a centralized policy store that is applicable to the principal to determine whether authorization exists to access the resource. If authorization does not exist, the facility denies the authorization query and records an indication of the denial of the authorization in an audit log. The facility may trigger events based on the auditing of authorization queries. The facility may also record an indication of authorization to access the resource in the audit log. The facility may additionally determine whether the authorization query is a request for authorization to perform an inherently dangerous operation, and record an indication of an authorization to perform the inherently dangerous operation in the audit log.
-
Citations
40 Claims
-
1. A computer-readable storage medium whose contents cause a computer to:
-
receive an authorization query regarding a request to access a resource;
identify a principal requesting to access the resource;
perform an access control check to determine whether to deny authorization to access the resource, the access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules; and
responsive to determining to deny authorization to access the resource, return a deny decision denying authorization to access the resource, and enter an entry into an audit log, the entry recording the denial of authorization, such that the computer instructions are executed as an integral component of an operating system suitable for executing on the computer. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A computer-readable storage medium whose contents cause a computer to:
-
receive an authorization query regarding a request to perform an operation on a computer;
identify a principal requesting to perform the operation;
perform an access control check to determine whether to allow authorization to perform the operation, the access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules;
responsive to determining to allow authorization to perform the operation, determine whether the requested operation is an inherently dangerous operation; and
responsive to determining that the requested operation is an inherently dangerous operation, enter an entry into an audit log, the entry recording the authorization to perform an inherently dangerous operation, such that the computer instructions are executed as an integral component of an operating system suitable for executing on the computer. - View Dependent Claims (11)
-
-
12. A computer-readable storage medium whose contents cause a computer to:
-
receive an authorization query regarding a request to access a resource;
identify a principal requesting to access the resource;
perform an access control check to determine whether to deny authorization to access the resource, the access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules; and
responsive to determining to deny authorization to access the resource, identify a rule in the policy that caused the denial of authorization to access the resource and determine whether learning mode is enabled for the identified rule;
responsive to determining that learning mode is enabled for the identified rule, return an allow decision granting authorization to access the resource, and enter an entry into a report log, the entry recording an indication of the rule having the enabled learning mode, such that the computer instructions are executed as an integral component of an operating system suitable for executing on the computer. - View Dependent Claims (13, 14, 15)
-
-
16. A computer-readable storage medium whose contents cause a computer to:
-
receive an authorization query regarding a request to access a resource on a computer;
perform a first access control check to determine whether to allow or deny authorization to access the resource;
responsive to determining to allow authorization to access the resource based on the first access control check;
identify a principal requesting access to the resource;
perform a second access control check to determine whether to allow or deny authorization to access the resource, the second access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules;
responsive to determining to allow authorization to access the resource, return an allow decision granting authorization to access the resource; and
responsive to determining to deny authorization to access the resource, return a deny decision denying authorization to access the resource, such that the computer instructions for the second access control check are executed as an integral component of an operating system suitable for executing on the computer.
-
-
17. One or more computer memories collectively containing a centralized policy store, the centralized policy store comprising at least one policy, the policy comprising at least one rule having an indication of whether to activate learning mode for the rule,
such that the indication of whether to activate learning mode is used to determine whether to apply the rule in processing an access control check to determine whether access to a resource is authorized.
-
18. A method in a computing system for auditing requests to access a resource, the method comprising:
-
identifying a principal requesting to access a resource;
performing an access control check to determine whether to deny or allows authorization to access the resource, the access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules; and
responsive to determining to deny authorization to access the resource, returning a deny decision denying authorization to access the resource, and entering an entry into an audit log, the entry recording the denial of authorization, such that the method is performed by an integral component of an operating system executing on the computing system. - View Dependent Claims (19, 20, 21, 22, 23, 24, 25)
-
-
26. A method in a computing system for fine-tuning a policy, the method comprising:
providing a centralized policy store, the centralized policy store comprising at least one policy, the policy comprising at least one rule having an indication of whether to activate learning mode for the rule, such that;
if the rule fails and causes a denial of authorization to access a resource and learning mode is activated;
granting authorization to access the resource; and
recording the grant of the authorization and the failure of the rule in a log;
if the rule fails and causes the denial of authorization to access the resource and learning mode is not activated;
denying authorization to access the resource, such that the method is performed by an integral component of an operating system executing on the computing system. - View Dependent Claims (27)
-
28. A method in a computing system for performing a tiered access control check, the method comprising:
-
performing a first access control check to determine whether to grant or deny authorization to access a resource;
responsive to determining to grant authorization to access the resource based on the first access control check;
identifying a principal requesting access to the resource;
performing a second access control check to determine whether to grant or deny authorization to access the resource, the second access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules;
responsive to determining to grant authorization to access the resource, returning an allow decision granting authorization to access the resource; and
responsive to determining to deny authorization to access the resource, returning a deny decision denying authorization to access the resource, such that the second access control check is performed by an integral component of an operating system suitable for executing on the computer.
-
-
29. A system for auditing requests for authorization to access a resource provided on a computing system, the system comprising:
-
a centralized policy store having at least one policy, the policy having one or more rules;
an authorization component operable to execute as a component of an operating system suitable for executing on the computing system, the authorization component further operable to;
identify a principal requesting to access a resource;
apply the policy to the principal to determine whether to deny authorization to access the resource; and
responsive to determining to deny authorization to access the resource, return a deny decision denying authorization to access the resource, and record the denial of authorization in an audit log. - View Dependent Claims (30, 31, 32, 33, 34, 35, 36, 37)
-
-
38. A system for fine-tuning a policy comprising:
-
a centralized policy store having at least one policy, the policy comprising at least one rule having an indication of whether to activate learning mode for the rule;
an authorization component operable to execute as a component of an operating system suitable for executing on the computing system, the authorization component also operable to apply the rule to an authorization query to determine whether the rule fails and causes a denial of an authorization, the authorization component further operable to;
responsive to determining that the rule fails, determine whether learning mode is activated for the failed rule;
responsive to determining that learning mode is activated, grant the authorization; and
record the grant of the authorization and the failure of the rule in a log. - View Dependent Claims (39)
-
-
40. A system for performing a tiered access control check, the system comprising:
-
a first access control component operable to determine whether authorization to access a resource should be granted;
a second access control component operable to execute as a component of an operating system suitable for executing on a computing system, the second access control component also operable to determine whether authorization to access the resource should be granted based on an identity of a principal requesting to access the resource and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules;
such that the second control component is executed subsequent to the first access control component determining that authorization to access the resource should be granted.
-
Specification