Patent ID: 7594256
Filing Date: 2009-09-22
Classification: G06F,H04L

Abstract:
1. A method of controlling access to resources, said method comprising: receiving, by a server, a first request for a resource, said first request comprising a first requestor identifying information, wherein said first requestor identifying information identifies a first requestor; referring, by said server, said first request to a remote source, wherein said remote source evaluates said first request in response to said referring to generate a first policy decision, wherein said first policy decision is based on a policy definition governing access to said resource and based on said first requestor identify information; receiving, by said server, said first policy decision from said remote source, wherein said first policy decision is for said first requestor; storing said first policy decision for said resource in local memory, wherein said local memory further comprises a second policy decision, wherein said second policy decision is based on a second requestor identifying information, and wherein said second policy decision is for a second requestor identified by said second requestor identifying information; receiving, subsequent to said first request, a second request for access to said resource, said second request comprising said first requestor identifying information; evaluating said second request using said first policy decision in said local memory; receiving a notification from said remote source of a change in said policy definition, said notification identifying said first policy decision; marking said first policy decision based on said notification, wherein said marking identifies that an updated policy decision must be requested when a subsequent request from said first requestor is received for said resource; receiving, subsequent to said second request, a third request for access to said resource, said third request comprising said second requestor identifying information, wherein said second requestor identifying information identifies said second requestor; evaluating said third request using said second policy decision in said local memory based on said second policy decision being unmarked, wherein said first policy decision is marked and said second policy decision is unmarked in local memory when said third request is evaluated; receiving, by said server and subsequent to said third request, a fourth request for said resource after said third request is received, said fourth request comprising said first requestor identifying information, wherein said fourth requestor identifying information identifies said first requestor; identifying, by said server in response to said fourth request, said first policy decision as marked; referring, by said server, said fourth request to said remote source based on said first policy decision being marked, wherein said remote source evaluates said fourth request in response to said referring to generate a third policy decision; receiving, by said server, said third policy decision from said remote source; and evaluating said fourth request based on said third policy decision.