Patent ID: 8365298
Filing Date: 2013-01-29
Classification: G06F,G06Q,H04L

Abstract:
1. An infrastructure services provider having a processor and a memory to implement access control security to both resource services and infrastructure services on behalf of members of a virtual organization separate from the infrastructure services provider, each of the members of the virtual organization connected to the infrastructure services provider via a network, the infrastructure services provider comprising: a first security mechanism coupled with the processor and the memory to: (i) intercept, via the network, a first service call originating from a first member of the virtual organization requesting access to a resource service provided by a second member of the virtual organization, the resource service operable to secure authentication and access control for services offered as resources by the virtual organization to further objectives of the virtual organization, (ii) authenticate the first service call via the first security mechanism within the infrastructure services provider based on access policies specified by the virtual organization, and (iii) forward the first service call to the second member of the virtual organization upon successful authentication; a second security mechanism coupled with the processor and the memory to: (i) intercept, via the network, a second service call originating from the first member of the virtual organization requesting access to an infrastructure service provided by the second member of the virtual organization, the infrastructure service operable to secure authentication and access control for virtual organization management services, (ii) authenticate the second service call via the second security mechanism within the infrastructure services provider based on the access policies specified by the virtual organization, (iii) forward the second service call to the second member of the virtual organization upon successful authentication; and wherein each of the first and second security mechanisms further comprise: a policy enforcement point to prevent the first or second service call respectively, from reaching any of the members of the virtual organization until the security mechanism has made a decision to authorize the service call, and a policy decision point coupled with the policy enforcement point to make the decision to authorize or deny the first or second service call respectively.