Method and system for dynamically associating access rights with a resource
First Claim
1. A method for dynamically associating, by a server, access rights with a resource, the method comprising steps of:
- (a) receiving, by a server, a request for a resource from a client;
(b) generating, by a first component of a policy engine, a dataset responsive to an application of a first policy to the client;
(c) transmitting, by the first component of the policy engine to a second component of the policy engine, the dataset;
(d) applying, by the second component of the policy engine, a second policy to the dataset to identify a plurality of levels of access rights associated with the resource;
(e) requesting, by the server, from the second component of the policy engine, the plurality of levels of access rights to associate with the resource;
(f) signing, by the server, the resource with the plurality of levels of access rights via an extensible rights markup language;
(g) transmitting, by the server, the resource signed with the plurality of levels of access rights to the client;
(h) making, by an application program responsive to receiving from the server the signed resource, an access control decision using the plurality of levels of access rights, the application program executing on the client; and
(i) providing, by the application program, restricted access to the resource responsive to the access control decision.
7 Assignments
0 Petitions
Accused Products
Abstract
A method for dynamically associating, by a server, access rights with a resource includes the step of receiving, by the server, a request for a resource from a client. The server requests, from a policy engine, an identification of a plurality of access rights to associate with the resource, the plurality of access rights identified responsive to an application of a policy to the client. The server associates the resource with the plurality of access rights via a rights markup language. The server transmits the resource to the client with the identification of the associated plurality of access rights. An application program on the client makes an access control decision responsive to the associated plurality of access rights. The application program provides restricted access to the resource responsive to the access control decision.
338 Citations
20 Claims
-
1. A method for dynamically associating, by a server, access rights with a resource, the method comprising steps of:
-
(a) receiving, by a server, a request for a resource from a client; (b) generating, by a first component of a policy engine, a dataset responsive to an application of a first policy to the client; (c) transmitting, by the first component of the policy engine to a second component of the policy engine, the dataset; (d) applying, by the second component of the policy engine, a second policy to the dataset to identify a plurality of levels of access rights associated with the resource; (e) requesting, by the server, from the second component of the policy engine, the plurality of levels of access rights to associate with the resource; (f) signing, by the server, the resource with the plurality of levels of access rights via an extensible rights markup language; (g) transmitting, by the server, the resource signed with the plurality of levels of access rights to the client; (h) making, by an application program responsive to receiving from the server the signed resource, an access control decision using the plurality of levels of access rights, the application program executing on the client; and (i) providing, by the application program, restricted access to the resource responsive to the access control decision. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
-
-
17. A system for dynamically associating access rights with a resource comprising:
-
a server comprising a microprocessor that receives a request for access to a resource from a client; a first component of a policy engine that executes on the microprocessor of the server to cause the microprocessor to; generate a dataset responsive to an application of a first policy to the client; transmit the dataset to a second component of the policy engine; the second component of the policy engine that executes on one or more microprocessors of the server to; apply a second policy to the dataset to identify a plurality of levels of access rights associated with the resource; wherein the server requests from the second component of the policy engine the plurality of levels of access rights to associate with the resource, signs the resource with the plurality of levels of access rights via an extensible rights markup language, and transmits the resource signed with the plurality of levels of access rights to the client; and an application program that executes on at least one microprocessor of the client to; receive, from the server, a copy of the resource signed with the plurality of levels of access rights, make an access control decision in response to receiving the resource signed with the plurality of levels of access rights using the plurality of levels of access rights, and provide restricted access to the resource responsive to the access control decision. - View Dependent Claims (18, 19, 20)
-
Specification