Patent ID: 7882539
Filing Date: 2011-02-01
Classification: G06F,H04L

Abstract:
1. A method for implementing a computer resource access control policy comprising: receiving an access control policy that includes policy statements, wherein said policy statements are in an abstracted policy language, and wherein the abstracted policy language is not understood by an access check mechanism; identifying predicates in said policy statements, wherein the predicates are in the abstracted policy language transforming, via a computer, the predicates in the abstracted policy language into primitives, wherein the primitives are in a language native to said access check mechanism; configuring permissions at said access control mechanism based on said primitives, wherein said permissions are configured to enable said access check mechanisms to dictate when access is granted, wherein said permissions are configured across multiple access check mechanisms; receiving a query regarding access to resources; and providing results of said query along with reasons, according to said access control policy, why the particular results were provided, said reasons built from said access control policy itself, independent of said multiple access check mechanisms.