Patent ID: 9430662
Filing Date: 2016-08-30
CPC Classification: G06F,H04L,H04N

Claim Text:
1. A computer-implemented method of provisioning authorization claims, which are enforced to control access of users to objects in a computer system, each authorization claim forming part of a privilege relation associating at least one user, at least one object and at least one permission level, the method comprising the steps: i) receiving, by a policy processor, an attribute-based access control (ABAC) policy depending on attributes and evaluable to one of Permit and possible further values; ii) receiving, by the policy processor, attribute values for a plurality of elements in predefined categories corresponding to users, objects and permission levels in the computer system; viii) selecting, by the policy processor, one of the predefined categories as a final category and, for a vector comprising one element from each of any remaining non-final category, finding all elements in the final category for which the ABAC policy evaluates to Permit; and ix) defining, by an authorization claim generator, an authorization claim and a privilege relation in which the authorization claim associates said one element from each remaining non-final category and the elements in the final category thus found.