Patent ID: 8196187
Filing Date: 2012-06-05
Classification: G06F

Abstract:
1. In a computing system, a method of enforcing access control based on a comparison between pre-operation state and post-operation state, the method comprising: an act of a computer system, which includes one or more processors, receiving a request from a principal to perform an operation that modifies at least one attribute of each of one or more objects stored on computer readable media; an act of the computer system determining one or more pre-operation states of the at least one attribute of each of the one or more objects at a time when the operation is requested by the principal; an act of the computer system calculating one or more post-operation states of the at least one attribute of each of the one or more objects if the operation were allowed to succeed on the one or more objects; subsequent to the computer system calculating the one or more post-operation states, an act of the computer system comparing the one or more pre-operation states of the at least one attribute of each of the one or more objects and the one or more post operation states of the at least one attribute of each of the one or more objects to determine one or more changes the operation would make to the at least one attribute of each of the one or more objects if the operation were allowed to succeed; an act of the computer system referencing one or more access control rules, the access control rules controlling access by the principal to the one or more objects based on changes the principle is permitted to make to attributes of the one or more objects; based on the computer system referencing the one or more access control rules, an act of the computer system determining that the one or more access control rules would allow the operation to succeed on behalf of the principal based on the principal being permitted to make the one or more changes to the at least one attribute of each of the one or more objects between the one or more pre-operation states and the one or more post operation states; and based on the computer system determining that the one or more access control rules would allow the operation to succeed on behalf of the principal, an act of the computer system allowing the operation to succeed.