Methods and apparatus for controlling access to a resource

• US 7,185,192 B1
• Filed: 07/07/2000
• Issued: 02/27/2007
• Est. Priority Date: 07/07/2000
• Status: Expired due to Term

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Kahn, Clifford E.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Colin; Carl G.
• Application Number:
  US09/611,913
• Time in Patent Office: 2,426 Days
• Field of Search: 713/155, 713/200, 713/201, 713/211, 713/154, 713/166, 707/10, 707/9, 707/3, 707/102, 709/229
• US Class Current: 713/155
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

An input/output interface receives an access request from a requester. A processor associated with the input/output interface applies a filter operation to select a subset of rules from a master set of rules maintained within an authorization database. Rules can be selected in this manner using filter operations so that all rules in the rule set need not be processed. A rule may include a disregard instruction. The processor further performs at least one rule operation based on the subset of rules to produce an access control decision in the memory system until either a rule operation including a disregard instruction is performed to limit performance of rule operations in the selected set of rules or until all rule operations in the selected set of rules that are applicable to the access control decision are performed.

Claims

1. A method for providing access control in a computing system environment, the method comprising the steps of:

receiving an access request;

selecting, based on the access request, a set of rules containing at least one rule from a master set of rules; and

producing an access control decision based on performing rule operations in a given rule of the selected set of rules by sequentially performing rule operations in the given rule until performing a disregard instruction, the disregard instruction including disregard criteria identifying a type of other rule operations in the selected set of rules to disregard from performing; and

after performing the disregard instruction in the given rule;

i) evaluating the disregard criteria against any remaining unperformed rule operations in other rules of the selected set of rules, the other rules being rules other than the given rule;

ii) marking any remaining unperformed rule operations in the other rules of the selected set of rules that match the disregard criteria to be disregarded from further rule processing; and

iii) executing remaining unmarked rule operations in the other rules in the selected set of rules;

wherein the step of selecting includes the steps of;

determining an identity of a resource in the computing system environment to which access is requested in the access request; and

applying at least one filter operation, using the identity of the resource, for rules in the at least one master set of rules to produce the selected set of rules for use in determining the access control decision to the resource; and

wherein the method further includes the step of determining a role identity of a requestor submitting the access request; and

wherein the step of performing includes sequentially processing each rule operation in the selected set of rules using the role identity of the requestor submitting the access request in combination with the identity of the resource to determine if the requestor using the role identity can access the resource.

2. The method of claim 1 wherein the selected set of rules is arranged hierarchically such that rules containing rule operations that are more specific are performed before rule operations that are more general.

3. The method of claim 1 wherein:

the selected set of rules is arranged hierarchically such that rules containing rule operations that are more specific are performed before rules containing rule operations that are more general such that placement of the disregard instruction in one of the rules in the selected set of rules causes the step of performing to control an amount of access control provided to a requester that submitted the access request for access to a respective resource.

4. The method of claim 1 wherein the disregard instruction is a conditional instruction that has a condition that must be met before the disregard instruction is performed.

5. The method of claim 1 wherein:

at least one rule in the selected set of rules contains a relation that defines a condition based on a group definition; and

wherein at least one of the steps of selecting and performing includes the step of;

performing the relation to determine if at least one of a requestor, an access, and a resource specified in the access request satisfy the condition based on the group definition.

6. A computer system configured to provide access control, the computer system comprising:

at least one input/output interface;

a processor;

a memory system encoded with an authorization program;

at least one authorization database;

an interconnection mechanism coupling the processor, the at least one input/output interface, the memory system, and the at least one authorization database;

based at least in part on the processor executing the authorization program, the processor supporting steps of;

receiving an access request;

selecting, based on the access request, a set of rules containing at least one rule from a master set of rules;

producing an access control decision based on performing rule operations in a given rule of the selected set of rules by sequentially performing rule operations in the given rule until performing a disregard instruction, the disregard instruction including disregard criteria identifying a type of other rule operations in the selected set of rules to disregard from performing; and

after performing the disregard instruction in the given rule;

i) evaluating the disregard criteria against any remaining unperformed rule operations in other rules of the selected set of rules, the other rules being rules other than the given rule;

ii) marking any remaining unperformed rule operations in the other rules of the selected set of rules that match the disregard criteria to be disregarded from further rule processing; and

iii) executing remaining unmarked rule operations in the other rules in the selected set of rules.

7. The computer system of claim 6 wherein the selected set of rules is arranged hierarchically such that when the processor performs the authorization program, rules containing rule operations that are more specific are performed before rule operations that are more general.

8. The computer system of claim 6 wherein when the processor performs the authorization program to select a selected set of rules, the processor:

determines an identity of an resource to which access is requested in the access request; and

applies at least one filter operation, using the identity of the resource, for rules in the at least one master set of rules to produce the selected set of rules for use in determining the access control decision to the resource; and

wherein when the processor performs the authorization program, the processor determines a role identity of a requestor submitting the access request; and

wherein the processor sequentially processes each rule operation in the selected set of rules using the role identity of the requestor submitting the access request in combination with the identity of the resource to determine if the requestor using the role identity can access the resource.

9. The computer system of claim 8 wherein the disregard instruction is a conditional instruction that has a condition that must be met during processing by the processor before the disregard instruction is performed.

10. The computer system of claim 6 wherein:

the selected set of rules is arranged hierarchically such that rules containing rule operations that are more specific are performed by the processor before rules containing rule operations that are more general such that placement of the disregard instruction in one of the at least one rules in the selected set of rules causes the authorization program, when performed on the processor, to control an amount of access control provided to the requestor that submitted the access request for access to the resource.

11. The computer system of claim 6 wherein:

at least one rule in the selected set of rules contains a relation that defines a condition based on a group definition; and

wherein when the processor performs at least one of the operations of selecting and performing, the processor performing the relation to determine if at least one of a requestor, an access, and a resource specified in the access request satisfy the condition based on the group definition.

12. A method for providing access control in a computing system environment, the method comprising the steps of:

receiving an access request;

selecting, based on the access request, a set of rules containing multiple rules from at least one master set of rules, at least one of the multiple rules including multiple rule operations to be performed in sequential order;

for a first rule of the multiple rules;

performing a filter operation associated with the first rule to identify whether to execute any rule operations in the first rule; and

performing multiple operations in the first rule to determine whether to provide access to a storage system in response to receiving the access request, the first rule including a disregard instruction that, when executed, limits performance to fewer than all rule operations in a second rule of the selected set of rules as specified by disregard criteria in the disregard instruction;

wherein the disregard instruction is a conditional disregard instruction, which limits a performance of other rule operations in multiple rules other than the first rule in the selected set of rules depending on occurrence of a corresponding condition as specified by the disregard criteria in the disregard instruction, the method further comprising;

performing at least one other rule operation in the first rule as well as other rules in the selected set of rules after performing the conditional disregard instruction.

13. A method as in claim 12, wherein the filter operation is an IF-THEN operation and performance of the IF-THEN operation provides an indication whether to perform rule operations in the first rule.

14. A method as in claim 13, wherein performance of the IF-THEN operation includes identifying whether an application generating the access request uses a particular resource in the storage system as well as whether a requestor associated with the access request is a member of a particular specified group and, if so, performing the rule operations in the first rule.

15. A method for providing access control in a computing system environment, the method comprising:

receiving an access request;

in response to receiving the access request, selecting a set of rules for processing to determine whether to permit the access request;

during processing of the set of rules, performing a conditional disregard rule operation in the set of rules;

based on performing the conditional disregard rule operation, disregarding execution of at least one rule operation other than the conditional disregard rule operation in the set of rules as specified by the conditional disregard rule operation; and

after performing the conditional disregard rule operation, performing at least one other rule operation in the set of rules not specified by disregard criteria in the conditional disregard rule operation;

wherein a field of data in the conditional disregard rule operation specifically identifies a first type of rule operations that are to be disregarded from execution in the set of rules, execution of the conditional disregard rule operation not having any affect on whether to perform a second type of rule operations in the set of rules.

16. A method as in claim 15 further comprising:

comparing disregard criteria in the field of data associated with the conditional disregard rule operation to data in other rule operations to identify which other rule operations in the selected set of rules to disregard from performance.

17. A method as in claim 15, wherein performing a conditional disregard rule operation further comprises identifying disregard criteria in the conditional disregard rule operation, the method further comprising:

upon performing the conditional disregard rule operation, marking any remaining unperformed rule operations in the set of rules as identified by the disregard criteria; and

continuing performance of rule operations in the set of rules that are not marked to be disregarded.

18. A method as in claim 15 further comprising:

during processing of the set of rules, performing an unconditional disregard rule operation in the set of rules that results in termination of performing any other rule operations in the selected set of rules.

19. A method for providing access control in a computing system environment, the method comprising:

receiving an access request;

in response to receiving the access request, selecting a first set of rules and a second set of rules for processing to determine whether to permit the access request, the first set of rules and the second set of rules each including multiple rule operations;

during processing of the first set of rules, performing a disregard rule operation in the first set of rules; and

based on performing the disregard rule operation, disregarding execution of at least one rule operation in the second set of rules as identified by the disregard rule operation;

after disregarding execution of at least one rule operation in the second set of rules as identified by the disregard rule operation in the first set of rules, performing at least one rule operation in the second set of rules not associated with the disregard rule operation; and

following completion of executing the first set of rules and the second set of rules, generating an access control decision whether to permit the access request.

20. A method as in claim 19, wherein selecting the first set of rules and the second set of rules includes applying a respective first filter and a second filter to identify whether to select the first set of rules and the second set of rules for execution.

21. A method as in claim 19, wherein the disregard rule operation is a conditional disregard rule operation, a field of data in the conditional disregard rule operation specifically identifying a first type of rule operations that are to be disregarded from execution in the first set of rules and the second set of rules, execution of the conditional disregard rule not having any affect on whether to perform a second type of rule operation in the second set of rules.

22. A method as in claim 21, wherein performing a conditional disregard rule operation includes identifying disregard criteria in the conditional disregard rule operation, the method further comprising:

upon performing the conditional disregard rule operation, marking any remaining unperformed rule operations in the first set of rules and the second set of rules as identified by the disregard criteria; and

continuing performance of rule operations in the first set of rules and the second set of rules that are not marked to be disregarded.

23. A method as in claim 21 further comprising:

during processing of the first set of rules, performing an unconditional disregard rule operation that results in termination of performing all other rule operations in the selected first set of rules and the second set of rules.

24. A method for providing access control in a computing system environment, the method comprising:

receiving an access request to access data in the computing system environment;

comparing the access request to a master rule set, each rule in the master rule set including a filter and a corresponding set of rule operations to be performed pending evaluation of the filter condition; and

for each rule containing a filter operation that evaluates to indicate execution of rule operations of that rule, executing the rule operations of that rule;

during execution of rule operations of that rule, executing a first conditional disregard instruction that establishes a first set of pre-conditions that must be met in successive rules in the master rule set in order for those successive rules to be executed after the rule containing the first conditional disregard instruction has been executed; and

executing at least one successive rule in the master rule set for which the access request meets the filters of those successive rules, and for which the first set of pre-conditions established by executing the first conditional disregard instruction are also met.

25. The method of claim 24 wherein executing only the successive rules in the master rule set comprises:

executing a second conditional disregard instruction that establish a second set of pre-conditions that must also be met in addition to the first set of pre-conditions established by the first disregard instruction for any remaining successive rules in the master rule set to be executed.

26. The method of claim 24 wherein pre-conditions established by execution of the conditional disregard instructions indicate a type of data upon which rule operations of successive rules in the master rule set operate that are not to be executed during execution of the successive rules in the master rule set.

27. The method of claim 26 wherein the filter of at least one rule in the master rule set includes a test of whether an application associated with the access request uses a particular resource associated with the request.

28. The method of claim 26 wherein the filter of at least one rule in the master rule set includes a test of whether at least two resources associated with the access request are connected to each other.

29. The method of claim 26 comprising skipping execution of those successive rules in the master rule set for which the access request does not meet the filters of those successive rules, and for which the first and second set of pre-conditions established by executing the first and second disregard instructions are not met.

30. A computer program product having a computer-readable medium including computer program logic encoded thereon that when executed on a computer system provides a method for controlling access to a resource, and wherein when the computer program logic is executed on a processor in the computer system, the computer program logic causes the processor to perform the operations of:

receiving an access request to access data in the computing system environment;

comparing the access request to a master rule set, each rule in the master rule set including a filter and a corresponding set of rule operations to be performed pending evaluation of the filter condition; and

for each rule containing a filter operation that evaluates to indicate execution of rule operations of that rule, executing the rule operations of that rule;

during execution of rule operations of that rule, executing a first conditional disregard instruction that establishes a first set of pre-conditions that must be met in successive rules in the master rule set in order for those successive rules to be executed after the rule containing the first conditional disregard instruction has been executed; and

executing at least one successive rule in the master rule set for which the access request meets the filters of those successive rules, and for which the first set of pre-conditions established by executing the first conditional disregard instruction are also met.