Policy store

• US 7,908,642 B2
• Filed: 04/18/2007
• Issued: 03/15/2011
• Est. Priority Date: 04/18/2007
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Bajo, Allison Kowell B., Rubio, Ramon, Tsao, Yeongtau Louis
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Reza; Mohammad W
• Application Number:
  US11/736,957
• Publication Number:
  US 20080263635A1
• Time in Patent Office: 1,427 Days
• Field of Search: 713/182, 713/161, 713/166, 713/168, 725/25, 726/1, 726/2, 726/27
• US Class Current: 726/2
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A method for obtaining resource restriction information of a client application'"'"'s resource includes: receiving authentication information from one of a plurality of authentication modules; identifying a client application'"'"'s resource and authentication module based on the received authentication information; locating a policy store that is associated with the identified client application'"'"'s resource, the policy store containing resource restriction information for each of the plurality of authentication modules; and obtaining the resource restriction information associated with the identified authentication module from the policy store.

Claims

1. A method for obtaining resource restriction information of a client application'"'"'s resource, the method comprising:

receiving resource-specific authentication information from one of a plurality of authentication modules;

identifying the client application'"'"'s resource and method of authentication from the plurality of authentication modules to acquire authentication information;

locating a policy store that is associated with the identified client application'"'"'s resource, wherein the policy store contains the resource restriction information for each of the plurality of authentication modules;

wherein the authentication information includes identification information which is associated with an access level and wherein the resource restriction information is obtained based on the access level associated with the identification information; and

determining whether a resource restriction information is available for the identified authentication module,

wherein if it is determined that the resource restriction information is available, the resource restriction information associated with the identified authentication module from the policy store is obtained, and

wherein if it is determined that a resource restriction information is not available, a default resource restriction information defined by an owner of the resource is obtained.

2. The method according to claim 1, wherein the policy store is an access control list.

3. The method according to claim 1, wherein the policy store is stored at a remote location.

4. The method according to claim 1, wherein the policy store is managed by an owner remotely using a web service application.

5. The method according to claim 1, wherein the policy store is managed by an owner locally at a device.

6. A non-transitory computer-readable medium having stored thereon computer-executable instructions for performing a method comprising:

receiving resource-specific authentication information from one of a plurality of authentication modules;

identifying the client application'"'"'s resource and method of authentication from the plurality of authentication modules to acquire authentication information;

locating a policy store that is associated with the identified client application'"'"'s resource,

wherein the policy store contains the resource restriction information for each of the plurality of authentication modules;

wherein the authentication information includes identification information which is associated with an access level and wherein the resource restriction information is obtained based on the access level associated with the identification information; and

determining whether a resource restriction information is available for the identified authentication module,

wherein if it is determined that the resource restriction information is available, the resource restriction information associated with the identified authentication module from the policy store is obtained, and

wherein if it is determined that a resource restriction information is not available, a default resource restriction information defined by an owner of the resource is obtained.

7. A system for obtaining resource restriction information of a client application'"'"'s resource, the system comprising:

a receiving unit configured to receive resource-specific authentication information from one of a plurality of authentication modules;

an identifying unit configured to identify the client application'"'"'s resource and method of authentication from the plurality of authentication modules to acquire authentication information;

a locating unit configured to locate a policy store that is associated with the identified client application'"'"'s resource,

wherein the policy store contains the resource restriction information for each of the plurality of authentication modules;

wherein the authentication information includes identification information which is associated with an access level and wherein the resource restriction information is obtained based on the access level associated with the identification information; and

a determining unit configured to determine whether a resource restriction information is available for the identified authentication module,

wherein if it is determined that the resource restriction information is available, the resource restriction information associated with the identified authentication module from the policy store is obtained, and

wherein if it is determined that a resource restriction information is not available, a default resource restriction information defined by an owner of the resource is obtained.

8. The system according to claim 7, wherein the policy store is an access control list.

9. The system according to claim 7, wherein the policy store is stored at a remote location.

10. The system according to claim 7, wherein the policy store is managed by an owner remotely using a web service application.

11. The system according to claim 7, wherein the policy store is managed by an owner locally at a device.