Permission control

• US 9,542,570 B2
• Filed: 11/10/2014
• Issued: 01/10/2017
• Est. Priority Date: 11/10/2014
• Status: Active Grant

• Current Assignee: Successfactors Incorporated (SAP SE)
• Original Assignee: Successfactors Incorporated (SAP SE)
• Inventors: Peng, Yang
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US14/536,935
• Publication Number:
  US 20160132686A1
• Time in Patent Office: 792 Days
• Field of Search: 726/28
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

In some example implementations, there is provided a method including determining, from a received request, one or more attributes; sending, by a permission controller, a query to a use case database, the query including the determined attributes to enable an identification by the use case database of a matching use case stored in the use case database; approving, by the permission controller, the requested access to the data, when a response to the query indicates the matching use case was found in the use case database; rejecting, by the permission controller, the requested access to the data, when the response to the query indicates the matching use case was not found in the use case database.

Claims

1. A computer-readable medium containing instructions to configure at least one processor to cause operations comprising:

receiving a request to access data;

determining, from the request, one or more attributes representative of an identity of an entity making the request and a type of the data;

sending, by a permission controller, a query to a use case database, the query including the determined one or more attributes to enable an identification by the use case database of a matching use case stored in the use case database;

approving, by the permission controller, the requested access to the data, when a response to the query indicates the matching use case was found in the use case database;

rejecting, by the permission controller, the requested access to the data, when the response to the query indicates the matching use case was not found in the use case database;

sending, by the permission controller, a conflict request to an arbitrator, the conflict request representing a request to add another use case to the use case database, the conflict request including the one or more attributes, the one or more attributes including the identity of the entity making the request, the type of the data, and an owner of the data, when the response to the query indicates the matching use case was not found in the use case database;

receiving, from the arbitrator, an indication of whether the conflict request resulted in an approval to access the data; and

sending, by the permission controller when the indication represents the approval, another query to the use case database, the other query including the identity of the entity making the request, the type of the data, and the owner of the data, wherein the use case database includes, as a result of an update provided by the arbitrator, a corresponding matching use case for the other query.

2. The computer-readable medium of claim 1, wherein the request to access data represents an access to at least one of an application, a service, a feature, or a data item.

3. The computer-readable medium of claim 1, wherein the determining further comprises:

determining the owner of the data.

4. The computer-readable medium of claim 3 further comprising:

forming the query to include the one or more attributes, the one or more attributes including the identity of the entity making the request, the type of the data, and the owner of the data.

5. The computer-readable medium of claim 1 further comprising:

receiving, from the use case database, the response to the query.

6. The computer-readable medium of claim 1 further comprising:

receiving, by the permission controller, an access denied message, when the indication does not represent the approval.

7. The computer-readable medium of claim 1, wherein the matching use case matches the one or more attributes.

8. A system comprising:

at least one processor; and

at least one memory including program code which when executed by the at least one processor causes operations comprising;

receiving a request to access data;

determining, from the request, one or more attributes representative of an identity of an entity making the request and a type of the data;

sending, by a permission controller, a query to a use case database, the query including the determined attributes to enable an identification by the use case database of a matching use case stored in the use case database;

approving, by the permission controller, the requested access to the data, when a response to the query indicates the matching use case was found in the use case database;

rejecting, by the permission controller, the requested access to the data, when the response to the query indicates the matching use case was not found in the use case database;

sending, by the permission controller, a conflict request to an arbitrator, the conflict request representing a request to add another use case to the use case database, the conflict request including the one or more attributes, the one or more attributes including the identity of the entity making the request, the type of the data, and an owner of the data, when the response to the query indicates the matching use case was not found in the use case database;

receiving, from the arbitrator, an indication of whether the conflict request resulted in an approval to access the data; and

sending, by the permission controller when the indication represents the approval, another query to the use case database, the other query including the identity of the entity making the request, the type of the data, and the owner of the data, wherein the use case database includes, as a result of an update provided by the arbitrator, a corresponding matching use case for the other query.

9. The system of claim 8, wherein the request to access data represents an access to at least one of an application, a service, a feature, or a data item.

10. The system of claim 8, wherein the determining further comprises:

determining the owner of the data.

11. The system of claim 10 further comprising:

forming the query to include the attributes, the one or more attributes including the identity of the entity making the request, the type of the data, and the owner of the data.

12. The system of claim 11 further comprising:

receiving, from the use case database, the response to the query.

13. The system of claim 8 further comprising:

receiving, from the arbitrator, an indication of whether the conflict request resulted in an approval to access the data.

14. A method comprising:

at least one processor that causes operations comprising;

receiving a request to access data;

determining, from the request, one or more attributes representative of an identity of an entity making the request and a type of the data;

sending, by a permission controller, a query to a use case database, the query including the determined attributes to enable an identification by the use case database of a matching use case stored in the use case database;

approving, by the permission controller, the requested access to the data, when a response to the query indicates the matching use case was found in the use case database;

rejecting, by the permission controller, the requested access to the data, when the response to the query indicates the matching use case was not found in the use case database;

sending, by the permission controller, a conflict request to an arbitrator, the conflict request representing a request to add another use case to the use case database, the conflict request including the one or more attributes, the one or more attributes including the identity of the entity making the request, the type of the data, and an owner of the data, when the response to the query indicates the matching use case was not found in the use case database;

receiving, from the arbitrator, an indication of whether the conflict request resulted in an approval to access the data; and

sending, by the permission controller when the indication represents the approval, another query to the use case database, the other query including the identity of the entity making the request, the type of the data, and the owner of the data, wherein the use case database includes, as a result of an update provided by the arbitrator, a corresponding matching use case for the other query.

15. The method of claim 14, wherein the request to access data represents an access to at least one of an application, a service, a feature, or a data item.

16. The method of claim 14, wherein the determining further comprises:

determining an owner of the data.

17. The method of claim 16 further comprising:

forming the query to include the one or more attributes, the attributes including the identity of the entity making the request, the type of the data, and the owner of the data.

18. The method of claim 14 further comprising:

receiving, from the use case database, the response to the query.

19. The method of claim 14 further comprising:

receiving, by the permission controller, an access denied message, when the indication does not represent the approval.

20. The method of claim 14, wherein the matching use case matches the one or more attributes.