Patent ID: 7640429
Filing Date: 2009-12-29
Classification: G06F

Abstract:
1. A method of implementing role based control of access to a plurality of resources of a network having a plurality of domains, the method comprising: for each domain, storing a plurality of policy statements in one or more policy stores associated with the domain, the policy statements defined to control performance of actions relative to the resources and to associate one or more users of the network with one or more of a plurality of roles defined in the policy statements, the storing including at least one of the following: changing one or more previously stored associations of a user with one or more roles, and deleting one or more previously stored associations of a user with one or more roles; for each domain, associating one or more policy decision entities with the domain; using an enforcement entity corresponding to an application in the network to receive a request, from a user of the application, for use of one of the resources in the application; using the enforcement entity to communicate the resource request and one or more roles of the user of the application to a recipient policy decision entity associated with one of the domains, the communication performed via an application program interface (API) between the enforcement entity of the application and the recipient policy decision entity; using a policy engine of the recipient policy decision entity to evaluate policies defined by the policy statements of the one of the domains relative to the one or more communicated roles and relative to the requested resource; and using the enforcement entity to allow the user to use the requested resource based on the evaluation by the recipient policy decision entity; the method performed by one or more computers of the network.