Definition of low-level security rules in terms of high-level security concepts
First Claim
Patent Images
1. One or more computer-readable media comprising computer-executable instructions that, when executed by a processor, direct a the processor to perform acts including:
- receiving a request to perform an operation;
checking whether to access a business logic module in order to generate a result for the requested operation, wherein the business logic module contains problem-solving logic that produces solutions for a particular problem domain, and wherein the business logic module employs interaction-based definitions in which a component which performs an operation associated with the request is defined by a series of request-response interaction definitions that can be satisfied to perform the operation;
obtaining, from the business logic module, a set of zero or more additional tests to be performed in order to generate the result;
performing each additional test in the set of tests if there is at least one test in the set of tests;
checking a set of pluggable rules to determine the result of the requested operation; and
returning, as the result, a failure indication if checking the business logic module or checking the set of pluggable rules indicates that the result is a failure, otherwise returning, as the result, a success indication,wherein the set of pluggable rules includes a plurality of permission assignment objects, wherein each of the permission assignment objects associates a user with a particular role, wherein each particular role is associated with one or more permissions, and wherein each of the one or more permissions identifies a particular operation and context on which the operation is to be performed.
1 Assignment
0 Petitions
Accused Products
Abstract
A set of pluggable rules are used to define low-level security rules in terms of high-level security concepts. The rules are part of a pluggable module that can interact with a business logic to provide different granularities of control.
143 Citations
27 Claims
-
1. One or more computer-readable media comprising computer-executable instructions that, when executed by a processor, direct a the processor to perform acts including:
-
receiving a request to perform an operation; checking whether to access a business logic module in order to generate a result for the requested operation, wherein the business logic module contains problem-solving logic that produces solutions for a particular problem domain, and wherein the business logic module employs interaction-based definitions in which a component which performs an operation associated with the request is defined by a series of request-response interaction definitions that can be satisfied to perform the operation; obtaining, from the business logic module, a set of zero or more additional tests to be performed in order to generate the result; performing each additional test in the set of tests if there is at least one test in the set of tests; checking a set of pluggable rules to determine the result of the requested operation; and returning, as the result, a failure indication if checking the business logic module or checking the set of pluggable rules indicates that the result is a failure, otherwise returning, as the result, a success indication, wherein the set of pluggable rules includes a plurality of permission assignment objects, wherein each of the permission assignment objects associates a user with a particular role, wherein each particular role is associated with one or more permissions, and wherein each of the one or more permissions identifies a particular operation and context on which the operation is to be performed. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. A method comprising:
-
providing high-level permission concepts, including context and operation, for security rules; allowing a set of security rules to be defined using the high-level permission concepts, wherein the set of security rules allows permissions to be assigned to users of an application, in which the set of security rules includes a plurality of permission assignment objects, in which each of the permission assignment objects associates a user with a particular role, in which each particular role is associated with one or more permissions, and in which each of the one or more permissions identifies a particular operation and context on which the operation is to be performed; and determining, based at least in part on a permission assigned to a user, whether to permit an operation based on a request by the user, wherein the determining further comprises determining whether to permit the operation requested by the user based at least in part on accessing a business logic module to identify one or more additional tests to perform to determine if the operation is permitted, and further comprising performing the one or more additional tests, wherein the business logic module contains problem-solving logic that produces solutions for a particular problem domain, and wherein the business logic module employs interaction-based definitions in which a component which performs the operation is defined by a series of request-response interaction definitions that can be satisfied to perform the operation. - View Dependent Claims (14, 15, 16, 17, 18, 19)
-
-
20. A method comprising:
-
receiving a request to perform an operation associated with business logic module, wherein the business logic module contains problem-solving logic that produces solutions for a particular problem domain, and wherein the business logic module employs interaction-based definitions in which a component which performs the operation is defined by a series of request-response interaction definitions that can be satisfied to perform the operation; accessing a set of low-level rules, wherein the low-level rules, including at least one of modifying, deleting, viewing, approving, or creating, are defined in terms of high-level concepts, the low-level rules further include a plurality of permission assignment objects, wherein each of the permission assignment objects associates a user with a particular role, wherein each particular role is associated with one or more permissions, and wherein each of the one or more permissions identifies a particular operation and context on which the operation is to be performed; checking whether a user requesting to perform the operation is entitled to perform the operation based at least in part on the set of low-level rules; and returning an indication of whether the operation is allowed or not allowed, wherein the set of low-level rules can be replaced with another set of low-level rules without altering the business logic module. - View Dependent Claims (21, 22)
-
-
23. An architecture comprising:
-
a plurality of resources including a processor to process requests; a business logic layer to process, based at least in part on the plurality of resources, requests received from a client, wherein the business logic layer contains problem-solving logic that produces solutions for a particular problem domain, and wherein the business logic layer employs interaction-based definitions in which a component which performs an operation corresponding to an individual request is defined by a series of request-response interaction definitions that can be satisfied to perform the operation; and a pluggable security policy enforcement module, separate from the business logic layer, to enforce security restrictions on accessing information stored at the plurality of resources based on the operation corresponding to the individual request, wherein the pluggable security policy enforcement module defines high-level permission concepts for security rules and further defines a set of security rules using the high-level permission concepts which include context and operation. - View Dependent Claims (24, 25, 26, 27)
-
Specification