Patent ID: 8056114
Filing Date: 2011-11-08
Classification: G06F,G06Q

Abstract:
1. A method of controlling access to resources of a distributed system, the method comprising: defining a plurality of authorization requirements for access to a plurality of resources of the distributed system, the distributed system having one or more processors and memory and a plurality of heterogeneous access control mechanisms for controlling user access to the resources of the distributed system, the heterogeneous access control mechanisms associated with a plurality of different access control platforms; based on a use case diagram that abstractly describes access control behavior of the heterogeneous access control mechanisms by a “permit” use case and a “deny” use case, obtaining a model expressing contents of access control policies as would be consulted by a policy decision point, the model expressing a policy content as specifying a constraint on a decision by the policy decision point as to an action requested by a user relative to the resources, the constraints expressing the authorization requirements as conditions under which the policy decision point is to permit or deny the action; expressing the policy contents from the model in an access control markup language that provides a single expression of policy adaptable across the different access control platforms for enforcement in the heterogeneous access control mechanisms; using one or more adapters, obtaining from the single expression of policy a plurality of heterogeneous representations of the single expression of policy, the heterogeneous representations corresponding to the heterogeneous access control mechanisms; integrating the heterogeneous representations with the corresponding heterogeneous access control mechanisms to implement the single expression of policy through the heterogeneous access control mechanisms; and using the heterogeneous access control mechanisms, controlling access by users of the distributed system to the resources in accordance with the single expression of policy.