DATA DRIVEN ROLE BASED SECURITY

• US 20140351892A1
• Filed: 08/11/2014
• Published: 11/27/2014
• Est. Priority Date: 05/05/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ivanov, Sergei, Barrows, John August
• Granted Patent: US 9,537,863 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Data driven role based security is provided. At login, the system queries for a data context in connection with access to computing objects of a computing system. When a request for access to computing objects is received by the computing system, one or more control expressions specified for the computing object being accessed are evaluated. The evaluation of the control expressions may reference the user context or the data context previously established, and returns a set of effective permissions. Access to the computing object is then granted if the set of permissions includes an appropriate permission for the request for access.

Claims

1. At a computer system, a method for determining access to a computing object, the method comprising:

accessing a data context in connection with potential access to the computing object by a user identity;

defining a derived role for the user identity based on at least one aspect of the data context;

receiving a request to access the computing object;

forming a set of permissions for the computing object by evaluating a control expression governing access to the computing object based on the derived role; and

determining the user identity'"'"'s access to the computing object in accordance with the set of permissions.