Fine-grained attribute access control

• US 7,836,510 B1
• Filed: 04/30/2004
• Issued: 11/16/2010
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Arumugam, Dilli Dorai Minnal, Hsu, Heng-Ming, Simhachalam, Malla, Angal, Rajeev, Cheng, Qingwen
• Primary Examiner(s): Smithers; Matthew B
• Assistant Examiner(s): Callahan; Paul
• Application Number:
  US10/836,991
• Time in Patent Office: 2,391 Days
• Field of Search: 726/4, 726/5, 726/8, 726/27, 713/161, 705/51
• US Class Current: 726/27
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A mechanism is disclosed for enabling an attribute provider service (APS), which provides access to one or more attributes, to control access to the attributes at the attribute level. In one implementation, a request is received, which specifies a particular attribute that is desired to be accessed from an attribute repository. In response to this request, a policy that applies to the particular attribute is accessed. The policy is then processed to determine whether access to the particular attribute is to be allowed or denied. With the above mechanism, it is possible to control access to attributes at the attribute level rather than at the service level. Because access control is exercised at such a low level, an administrator can exercise much tighter and precise control over how attributes provided by an APS are accessed.

Claims

1. An attribute provider service (APS), comprising:

a processor;

a request processing mechanism (RPM), when executed by the processor, configured to;

receive a request for an attribute from a consumer,

forward the request to an attribute provider mechanism (APM) for processing,

receive, from the APM, a response to the request, and

provide the response to the consumer;

the APM, when executed by the processor, configured to;

receive the request from the RPM,

invoke, in response to the request, a policy evaluator to determine whether the consumer is allowed to access the attribute,

receive a response from the policy evaluator indicating whether access to the attribute by the consumer is allowed,

obtain an attribute value corresponding to the attribute from an attribute repository based on the response from the policy evaluator, and

provide the response to the request to the RPM, wherein the response comprises the attribute value when the response from the policy evaluator indicates that access to the attribute by the consumer is allowed; and

the policy evaluator, when executed by the processor, configured to;

identify an attribute level policy corresponding to the attribute, wherein the attribute level policy comprises at least one condition used to determine whether access to the attribute is allowed by the consumer wherein the attribute level policy is associated with application criteria, and wherein the application criteria comprises an attribute specification specifying the attribute, a subject parameter which identifies the consumer, a resource parameter which specifies a service that provides the attribute, and an action parameter which specifies an action that the consumer is allowed to perform on the attribute value, and

determine, using the attribute level policy, whether to allow access to the attribute by the consumer.

2. The APS of claim 1, wherein the policy evaluator, when executed by the processor, is further configured to evaluate the at least one condition to determine whether it is satisfied to determine whether to allow access to the attribute.

3. The APS of claim 1, wherein the request specifies a subject and the attribute, and wherein the policy evaluator, when executed by the processor, is configured to identify the attribute level policy that corresponds to the subject and the attribute.

4. The APS of claim 1, wherein the request specifies a resource and the attribute, and wherein the policy evaluator, when executed by the processor, is configured to identify the attribute level policy that corresponds to the resource and the attribute.

5. The APS of claim 1, wherein the request specifies an action to be performed on the attribute, and wherein the policy evaluator, when executed by the processor, is further configured to identify the attribute level policy that applies to the action and the attribute.

6. The APS of claim 1, wherein the policy evaluator, when executed by the processor, is further configured, when determining whether to allow access to the attribute, to:

determining, based upon the attribute level policy, that access to the attribute is allowed when correct user input is received from the user;

invoking an interaction engine in the APS to request input from the consumer;

receiving, from the interaction engine, the input from the consumer; and

determining, based at least in part on the input from the consumer, whether to allow the consumer to access the attribute.

7. The APS of claim 1, wherein the action parameter specifies at least one selected from a group consisting of get and post.

8. The APS of claim 1, wherein the subject parameter further identifies at least one selected from a group consisting of a role, a group, an organization, which may access the attribute.