Patent ID: 7653930
Filing Date: 2010-01-26
Classification: G06F,H04L

Abstract:
1. A method for authorization to adaptively control access to a resource in a hierarchy of resources, comprising the steps of: determining, by a computer system, a first set of one or more roles that are within scope of the resource from one of: 1) the hierarchy of resources; and 2) a first cache; determining, by the computer system, a policy within scope of the resource from one of: 1) the hierarchy of resources; and 2) a second cache, wherein the policy is an association between the resource and a second set of roles, wherein the policy is from a set of policies, each policy in the set of policies associated with a resource in the hierarchy of resources, and wherein a policy is within scope of a resource if the policy is associated with the resource or if the policy is associated with another resource that is hierarchically superior to the resource in the hierarchy of resources; determining, by the computer system, from the first set of roles, a third set of one or more roles that are satisfied by a principal; providing, by the computer system, for an evaluation of the policy based on the third set of one or more roles; determining, by the computer system, whether to grant the principal access to the resource based on the evaluation of the policy; and granting, by the computer system, access to the resource if one or more roles from the third set of roles are in the second set of roles; wherein a role in the first set of roles is retrieved from the first cache if the role was previously retrieved from the hierarchy of resources; and wherein the policy is retrieved from the second cache if the policy was previously retrieved from the hierarchy of resources.