ACCESS CONTROL DECISION METHOD AND SYSTEM

• US 20090210421A1
• Filed: 02/14/2008
• Published: 08/20/2009
• Est. Priority Date: 02/14/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sheehan, Alexander Brantley
• Granted Patent: US 7,856,448 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

An access control method and system. The method includes enabling, by a computing system for a requester, access to the computing system. The computing system comprises group based access control data and computing resource data organized based on an XML schema that comprises a recursive format used to support a plurality of branch levels in a resource tree. The computing system associates first group data of the group based access control data with the requester. The computing system receives a request from the requester to access the computing resource data. The computing system determines an access control decision associated with the request to access the computing resource data. The computing system presents the access control decision to the requester.

Claims

1. An access control method comprising:

enabling, by a computing system for a requestor, access to said computing system, wherein said computing system comprises a memory system, wherein said memory system comprises group based access control data and computing resource data, wherein said group based access control data and said computing resource data are organized based on an extensible markup language (XML) schema, wherein said XML schema comprises a recursive format used to support a plurality of branch levels in a resource tree, and wherein said computing resource data comprises object identifiers associated with said computing resource data;

associating, by said computing system in response to said enabling, first group data of said group based access control data with said requester;

receiving, by said computing system from said requestor, a first request for accessing said computing resource data;

associating, by said computing system in response to said first request, said first group data with a first group of computing resources of said computing resource data;

generating, by said computing system, a first list comprising attribute values for said first group of computing resources, wherein said attribute values are associated with an XML string that conforms to said XML schema;

determining, by said computing system, an access control decision associated with said first request, said group based access control data, and said requestor;

applying, by said computing system, said access control decision to said first list, wherein said access control decision indicates whether the requested resource data is allowed to be accessed by said requester; and

presenting, by said computing system to said requester, said first access control decision

2. The method of claim 1, wherein said computing resource data is organized using a hierarchal ranking format.

3. The method of claim 1, wherein said first request comprises a request for generating said access control decision.

4. The method of claim 1, wherein said first request for accessing said computing resource data comprises a request for retrieving a list of application resource items.

5. The method of claim 1, wherein said requestor comprises an entity selected from the group consisting of a person and a software application.

6. The method of claim 1, wherein said XML schema defines leaf nodes comprising attributes defined by said attribute values, and wherein said attributes comprise a mandatory ID attribute and a mandatory label attribute.

8. The method of claim 1, wherein said computing system comprises parsing logic, wherein said XML schema defines leaf nodes comprising first attributes defined by said attribute values, wherein said parsing logic performs said associating said first group data with said first group of computing resources, and wherein said first attributes comprise attributes selected from the group consisting of an ID attribute, a label attribute, a description attribute, and a ShortCutKeys attribute.

9. The method of claim 1, wherein said determining comprises comparing a first object identifier of said object identifiers to said first list.

10. The method of claim 1, wherein said computing system comprises Boolean expression evaluation logic and a Boolean expression, and wherein said determining comprises:

inserting, by said computing system, said attribute values into said Boolean expression;

executing said Boolean expression evaluation logic on said Boolean expression comprising said attribute values; and

calculating, by said Boolean expression evaluation logic in response to said executing, a response value associated with said first request, wherein said response value comprises a value of yes/true/1 if said requestor is allowed to access an associated computing resource of said computing resources, and wherein said response value comprises a value of no/false/0 if said requestor is not allowed to access said associated computing resource of said computing resources.

7. The method of claim 7, wherein said attribute values define an optional description attribute and an optional ShortCutKeys attribute.

11. A computing system comprising a processor coupled to a computer-readable memory unit, said memory unit comprising instructions that when executed by the processor implements an access control method, said method comprising:

enabling, by said computing system for a requester, access to said computing system, wherein said memory unit comprises group based access control data and computing resource data, wherein said group based access control data and said computing resource data are organized based on an extensible markup language (XML) schema, wherein said XML schema comprises a recursive format used to support a plurality of branch levels in a resource tree, and wherein said computing resource data comprises object identifiers associated with said computing resource data;

associating, by said computing system in response to said enabling, first group data of said group based access control data with said requestor;

receiving, by said computing system from said requester, a first request for accessing said computing resource data;

associating, by said computing system in response to said first request, said first group data with a first group of computing resources of said computing resource data;

generating, by said computing system, a first list comprising attribute values for said first group of computing resources, wherein said attribute values are associated with an XML string that conforms to said XML schema;

determining, by said computing system, an access control decision associated with said first request, said group based access control data, and said requester;

applying, by said computing system, said access control decision to said first list, wherein said access control decision indicates whether the requested resource data is allowed to be accessed by said requester; and

presenting, by said computing system to said requestor, said first access control decision.

12. The computing system of claim 11, wherein said computing resource data is organized using a hierarchal ranking format.

13. The computing system of claim 11, wherein said first request comprises a request for generating said access control decision.

14. The computing system of claim 11, wherein said first request for accessing said computing resource data comprises a request for retrieving a list of application resource items.

15. The computing system of claim 11, wherein said requestor comprises an entity selected from the group consisting of a person and a software application.

16. The computing system of claim 11, wherein said XML schema defines leaf nodes comprising attributes defined by said attribute values, and wherein said attributes comprise a mandatory ID attribute and a mandatory label attribute.

17. The computing system of claim 11, wherein said computing system comprises parsing logic, wherein said XML schema defines leaf nodes comprising first attributes defined by said attribute values, wherein said parsing logic performs said associating said first group data with said first group of computing resources, and wherein said first attributes comprise attributes selected from the group consisting of an ID attribute, a label attribute, a description attribute, and a ShortCutKeys attribute.

18. The computing system of claim 11, wherein said determining comprises comparing a first object identifier of said object identifiers to said first list.

19. The computing system of claim 11, wherein said computing system comprises Boolean expression evaluation logic and a Boolean expression, and wherein said determining comprises:

inserting, by said computing system, said attribute values into said Boolean expression;

executing said Boolean expression evaluation logic on said Boolean expression comprising said attribute values; and

calculating, by said Boolean expression evaluation logic in response to said executing, a response value associated with said first request, wherein said response value comprises a value of yes/true/1 if said requester is allowed to access an associated computing resource of said computing resources, and wherein said response value comprises a value of no/false/0 if said requester is not allowed to access said associated computing resource of said computing resources.

20. A computer program product, comprising a computer readable medium comprising a computer readable program code embodied therein, said computer readable program code adapted to implement an access control method within a computing system comprising said computer readable medium, said method comprising:

enabling, by said computing system for a requestor, access to said computing system, wherein said computer readable medium comprises group based access control data and computing resource data, wherein said group based access control data and said computing resource data are organized based on an extensible markup language (XML) schema, wherein said XML schema comprises a recursive format used to support a plurality of branch levels in a resource tree, and wherein said computing resource data comprises object identifiers associated with said computing resource data;

associating, by said computing system in response to said enabling, first group data of said group based access control data with said requester;

receiving, by said computing system from said requester, a first request for accessing said computing resource data;

associating, by said computing system in response to said first request, said first group data with a first group of computing resources of said computing resource data;

generating, by said computing system, a first list comprising attribute values for said first group of computing resources, wherein said attribute values are associated with an XML string that conforms to said XML schema;

determining, by said computing system, an access control decision associated with said first request, said group based access control data, and said requester;

applying, by said computing system, said access control decision to said first list, wherein said access control decision indicates whether the requested resource data is allowed to be accessed by said requester; and

presenting, by said computing system to said requester, said first access control decision.

21. The computer program product of claim 20, wherein said determining comprises comparing a first object identifier of said object identifiers to said first list.

22. The computer program product of claim 20, wherein said computing system comprises Boolean expression evaluation logic and a Boolean expression, and wherein said determining comprises:

inserting, by said computing system, said attribute values into said Boolean expression;

executing said Boolean expression evaluation logic on said Boolean expression comprising said attribute values; and

calculating, by said Boolean expression evaluation logic in response to said executing, a response value associated with said first request, wherein said response value comprises a value of yes/true/1 if said requestor is allowed to access an associated computing resource of said computing resources, and wherein said response value comprises a value of no/false/0 if said requestor is not allowed to access said associated computing resource of said computing resources.

23. A process for supporting computer infrastructure, said process comprising providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in a computing system comprising a computer-readable memory unit, wherein the code in combination with the computing system is capable of performing an access control method, said method comprising:

enabling, by said computing system for a requestor, access to said computing system, wherein said computing system comprises a memory system, wherein said memory system comprises group based access control data and computing resource data, wherein said group based access control data and said computing resource data are organized based on an extensible markup language (XML) schema, wherein said XML schema comprises a recursive format used to support a plurality of branch levels in a resource tree, and wherein said computing resource data comprises object identifiers associated with said computing resource data;

associating, by said computing system in response to said enabling, first group data of said group based access control data with said requester;

receiving, by said computing system from said requestor, a first request for accessing said computing resource data;

associating, by said computing system in response to said first request, said first group data with a first group of computing resources of said computing resource data;

generating, by said computing system, a first list comprising attribute values for said first group of computing resources, wherein said attribute values are associated with an XML string that conforms to said XML schema;

determining, by said computing system, an access control decision associated with said first request, said group based access control data, and said requester;

applying, by said computing system, said access control decision to said first list, wherein said access control decision indicates whether the requested resource data is allowed to be accessed by said requestor; and

presenting, by said computing system to said requester, said first access control decision.

24. The process of claim 24, wherein said determining comprises comparing a first object identifier of said object identifiers to said first list.

25. The process of claim 24, wherein said computing system comprises Boolean expression evaluation logic and a Boolean expression, and wherein said determining comprises:

inserting, by said computing system, said attribute values into said Boolean expression;

executing said Boolean expression evaluation logic on said Boolean expression comprising said attribute values; and

calculating, by said Boolean expression evaluation logic in response to said executing, a response value associated with said first request, wherein said response value comprises a value of yes/true/1 if said requestor is allowed to access an associated computing resource of said computing resources, and wherein said response value comprises a value of no/false/0 if said requester is not allowed to access said associated computing resource of said computing resources.