Patent ID: 8250628
Filing Date: 2012-08-21
Classification: G06F

Abstract:
1. A method for modifying base permissions of access control lists by evaluating logical expressions on a server to determine permissions for a subject in response to a verification request, comprising: determining, by a server, base permissions for the subject by comparing a name of the subject against access control list entries for an object, in response to the verification request from the subject requesting access to the object; determining, by the server, the access control list entries for the object that comprise logical expression entries; evaluating, by the server, the logical expression entries of the access control list entries for the object with logical expression attributes of the subject, wherein the logical expression entries are evaluated to determine which logical expression entries are true for the logical expression attributes of the subject; for logical expression entries that are true, combining by the server set operators of the logical expression entries to have a single union access control list, a single intersect access control list, and a single replace access control list; wherein a combination of all rights for a union operator type form the union access control list; wherein a combination of all rights for an intersect operator type form the intersect access control list; and wherein a combination of all rights for a replace operator type form the replace access control list; in response to there being the replace access control list, performing by the server a replace operation to replace the base permissions with the replace access control list during an incremental process to determine the permissions for the subject, wherein a result of the replace operation is a first output, and wherein in response to there being no replace access control list, the base permissions are the first output; in response to there being the union access control list, performing by the server a union operation on the first output and the union access control list during the incremental process to determine the permissions for the subject, wherein a result of the union operation is a second output, and wherein in response to there being no union access control list, the first output is the second output; in response to there being the intersect access control list, performing by the server an intersect operation on the second output and the intersect access control list during the incremental process to determine the permissions for the subject, wherein a result of the intersect operation is a third output, and wherein in response to there being no intersect access control list, the second output is the third output; and providing by the server the third output as the permissions for the subject; wherein the replace operation is performed first, the union operation is performed second, and the intersect operation is performed third to define the incremental process to determine the permissions for the subject; and wherein logical expression attributes comprise an IP address, a connection type, an authentication mechanism, an access time, an access date, and an access day.