Application context based access control

• US 8,042,151 B2
• Filed: 12/20/2005
• Issued: 10/18/2011
• Est. Priority Date: 12/20/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Smith, Michael D., Spiesman, Lee C., Olsen, Geir
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US11/312,828
• Publication Number:
  US 20070143823A1
• Time in Patent Office: 2,128 Days
• Field of Search: 726 2- 21, 713182-186
• US Class Current: 726/2
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A context based access control system that includes a set of one or more authorization contexts that are activated in response to selection of different functions or tasks or other functional boundary object of an application program. The authorization contexts are associated with one or more access policies that are invoked in response to activation of the one or more authorization contexts.

Claims

1. A method comprising:

creating a hierarchical structure of user selectable functions or tasks of an application including a hierarchical function or task of the application and a plurality of dependent functions or tasks of the application selectable through the hierarchical function or task of the application through an input device;

assigning at least one authorization context to each of the user selectable functions or tasks in the hierarchical structure such that the at least one authorization context is activated in response to selection of the user selectable function or task;

providing a set of access policies stored on one or more computer storage devices and retrievable via a processing unit, the set of access policies being separate from the authorization contexts assigned to the user selectable functions or tasks of the application and including one or more rules defining access criteria for the user selectable functions or tasks in relation to a user'"'"'s identification or role; and

associating a first one of the access policies with an authorization context assigned to a first one of the dependent functions or tasks, the first one of the access policies being different than a second one of the access policies that is associated with an authorization context assigned to the hierarchical function or task, the second one of the access policies also being associated with an authorization context assigned to a second one of the dependent functions or tasks such that the second access policy is invoked upon selection of the hierarchical function or task and upon selection of the second one of the dependent functions or tasks.

2. The method of claim 1 and further comprising:

receiving a command from the input device to create an association component to associate the one or more authorization contexts to the one or more access policies on the one or more computer storage devices;

creating the association component to associate the one or more authorization contexts to the one or more access policies;

receiving a command from the input device to create an access policy component to invoke the one or more access policies based upon association to the one or more authorization contexts; and

creating the access policy component to invoke the one or more access policies.

3. An application including computer executable instructions stored on the one or more computer storage devices and executable by a processing unit to implement the method of claim 1.

4. The method of claim 1 wherein the one or more access policies are defined from a collection of form access policies.

5. The method of claim 1 wherein providing the one or more access policies comprises:

receiving a command from the input device to create the one or more access policies; and

creating the one or more access policies separate from the one or more authorization contexts in response to the input command.

6. The method of claim 1 wherein the one or more access policies associated with the one or more authorization contexts include different access rules based upon a user'"'"'s function or role.

7. The method of claim 1 and comprising;

storing one or more associations of the one or more authorization contexts with the one or more access policies on the one or more computer storage devices.

8. The method of claim 1, wherein the second one of the dependent functions or tasks accesses different data stored in a database associated with the application program than the hierarchical task or function.

9. An application tool including instructions stored on one or more computer storage media and executable by a processing unit to implement components comprising:

an authorization context tool component configured to provide one or more authorization contexts and a context framework component configured to create an authorization context framework for a hierarchical structure of user tasks or functions of an application that are selectable through one or more user interfaces of the application using an input device, wherein the authorization context framework includes one or more authorization contexts associated with one or more of the user tasks or functions;

an association tool component configured to create an association component to associate one or more access policies defining one or more access rules stored on the one or more computer storage devices to the one or more authorization contexts; and

an access policy tool component configured to provide the one or more access policies including the one or more access rules separate from the one or more authorization contexts and configured to invoke the one or more access policies based upon an association of the one or more access policies with an active authorization context that is associated with a first user task or function of the application, the invoked one or more access policies permitting a particular user to have access to information in the active authorization context that is associated with the first user task or function of the application but denying access to the information to the particular user in an authorization context that is associated with a second user task or function of the application that is different than the first user task or function of the application.

10. The tool of claim 9 wherein the access policy tool component is configured to select one or more access policies from a set of form access policies.

11. The tool of claim 9 wherein the access policy tool component is configured to receive user input to define the one or more access rules for the one or more access policies.

12. The tool of claim 9 wherein the association tool and access policy tool components generate different object orientated programming modules or code to create the association to the one or more access policies to invoke the one or more access policies based upon the active authorization context.

13. The tool of claim 9 wherein the access policies include rules that restrict access to read only access depending upon a user role or function.

14. The tool of claim 9 wherein the one or more authorization contexts are associated with different use tasks or functions and the one or more authorization contexts are associated with different access policies having different access rules depending upon a user'"'"'s role or function.

20. The method of claim 9 wherein the first or second task or function corresponds to a payroll function or task or a customer task or function and the step of activating the first or second authorization context includes the step of determining the first or second authorization context associated with one of the payroll or customer tasks or functions and invoking the one or more access policies associated with the one of the payroll or customer tasks or functions through the first or second authorization context.

15. A method comprising:

receiving a first command to invoke a first task or function of a user interface from an input device;

processing the first command via a processing unit and retrieving a first authorization context assigned to the first task or function;

retrieving one or more access policies including one or more access rules providing access criteria in relation to a user'"'"'s identification or role, associated with the first task or function through the first authorization context following retrieval of the first authorization context;

invoking the one or more access policies associated with the first authorization context and applying the one or more access rules of the one or more access policies;

receiving a second command to invoke a second task or function different from the first task or function from the input device, the first task or function and the second task or function both being associated with and executed by a same application;

processing the second command via the processing unit and retrieving a second authorization context different from the first authorization context assigned to the second task or function;

retrieving the one or more access policies associated with the second task or function through the second authorization context;

invoking the one or more access policies associated with the second active authorization context and applying the one or more access rules of the one or more access policies associated with the second authorization context; and

editing the one or more access policies associated with the first task and the one or more access policies associated with the second task utilizing a security administration console of the same application.

16. The method of claim 15 and comprising:

receiving user function and user role information; and

utilizing the user function and user role information to apply the one or more access rules of the one or more access policies associated with the first or second authorization context.

17. The method of claim 15 wherein, prior to invoking the one or more access policies, the method comprises:

creating the one or more access policies.

18. The method of claim 15 wherein prior to invoking the one or more access policies comprising:

defining the one or more access rules for the one or more access policies.

19. An application program including computer executable instructions stored on one or more computer storage devices and executed by a processing unit to implement the method of claim 15.