Methods and apparatus for pre-filtered access control in computing systems
First Claim
1. An automated method implemented in a computer system for selecting one or more resources on which a principal is authorized to perform at least one action, the method comprising the steps of:
- selecting a plurality of authorization policies that apply to a given principal;
transforming a first nonempty subset of the plurality of authorization policies based on meta-information associated with the one or more resources so as to form a query against a resource store that selects resources from the resource store;
executing the query to select the resources from the resource store;
removing one or more resources from the selected resources on which the given principal is not permitted to perform the at least one action in accordance with a second nonempty subset of the plurality of authorization policies, so as to select the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action; and
presenting the given principal the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action.
1 Assignment
0 Petitions
Accused Products
Abstract
An automated technique implemented in a computer system for selecting one or more resources on which a principal is authorized to perform at least one action comprises the following steps/operations. First, one or more authorization policies that apply to a given principal are selected. Then, the one or more authorization policies are transformed based on meta-information associated with the one or more resources so as to form a query against a resource store that selects the one or more resources on which the one or more authorization policies allow the given principal to perform the at least one action. The query may then be executed to select the one or more resources from the resource store. In another automated technique, the query may be formed without use of the one or more authorization policies, but where the policies are used to remove unauthorized resources from the superset of resources returned as a result of query execution. The techniques may return no resources on which the user is allowed to perform an action, if, for example, no such resources are stored in the resource store. Also, it may also be that no authorization policy applies to the user.
81 Citations
15 Claims
-
1. An automated method implemented in a computer system for selecting one or more resources on which a principal is authorized to perform at least one action, the method comprising the steps of:
-
selecting a plurality of authorization policies that apply to a given principal; transforming a first nonempty subset of the plurality of authorization policies based on meta-information associated with the one or more resources so as to form a query against a resource store that selects resources from the resource store; executing the query to select the resources from the resource store; removing one or more resources from the selected resources on which the given principal is not permitted to perform the at least one action in accordance with a second nonempty subset of the plurality of authorization policies, so as to select the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action; and presenting the given principal the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. Apparatus implemented in a computer system for selecting one or more resources on which a principal is authorized to perform at least one action, the apparatus comprising:
-
at least one processor operative to;
(i) select a plurality of authorization policies that apply to a given principal;
(ii) transform a first nonempty subset of the plurality of authorization policies based on meta-information associated with the one or more resources so as to form a query against a resource store that selects resources from the resource store;
(iii) execute the query to select the resources from the resource store;
(iv) remove one or more resources from the selected resources on which the given principal is not permitted to perform the at least one action in accordance with a second nonempty subset of the plurality of authorization policies, so as to select the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action; and
(v) present to the given principal the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action; andmemory, coupled to the at least one processor, for maintaining the resource store. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. An article of manufacture for use in accordance with a computer system for selecting one or more resources on which a principal is authorized to perform at least one action, comprising a machine readable medium containing one or more programs which when executed implement the steps of:
-
selecting a plurality of authorization policies that apply to a given principal; transforming a first nonempty subset of the plurality of authorization policies based on meta-information associated with the one or more resources so as to form a query against a resource store that selects resources from the resource store; executing the query to select the resources from the resource store; removing one or more resources from the selected resources on which the given principal is not permitted to perform the at least one action in accordance with a second nonempty subset of the plurality of authorization policies, so as to select the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action; and presenting to the given principal the one or more resources on which the plurality of authorization policies allow the given principal to perform the at least one action.
-
Specification