Patent ID: 7895639
Filing Date: 2011-02-22
Classification: G06F

Abstract:
1. In a system having a plurality of server computing devices providing, to one or more principals, access to protected objects, a method of specifying and facilitating the consistent enforcement of access control policies associated with the protected objects, the method comprising: (a) storing, at a server computing device, an access control list comprising a time-invariant list of group identifiers, each identified group in the access control list specifying an immutable access privilege to, or access control policy for, a protected object and at least one of the identified groups in the access control list having a mutable and monotonic membership, the monotonicity of the membership permitting the membership to change in only one direction without ever reversing direction; (b) enforcing, by the server computing device, i) the immutability of the privilege or policy specified by each identified group in the access control list and ii) the monotonicity of the membership of the at least one identified group in the access control list having the mutable and monotonic membership; (c) receiving, at the server computing device, a request from a principal to access a protected object, the protected object associated with the access control list; (d) evaluating, by the server computing device, the transitive closure of the access control list associated with the protected object to identify at least one principal authorized to access the protected object; (e) determining, by the server computing device, that the requesting principal is represented in the closure of the access control list; and (f) providing, by the server computing device to the requesting principal, access to the protected object.