Role-Based Authorization Management Framework

• US 20090260056A1
• Filed: 06/03/2009
• Published: 10/15/2009
• Est. Priority Date: 10/25/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Garg, Praerit, Van Dyke, Cliff, McKay, Everett, McPherson, Dave
• Granted Patent: US 8,533,772 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A role-based authorization management system maintains an authorization policy store that represents user authorizations to perform operations associated with an application. When a user attempts to perform a function associated with an application, the authorization management system verifies that the user is authorized to perform the requested function. The authorization management system also provides an interface for an application administrator to update role-based user authorization policies associated with one or more applications.

Claims

1. A method comprising:

initializing an authorization policy store to maintain an application object that represents an application;

associating with the application object an operation object that represents an operation that can be performed using the application;

associating with the application object an application group object that represents a user that can be granted access to the application; and

associating a role object with the operation object and the application group object to represent authorization for the user to perform the operation.