Source: http://www.google.com/patents/US8156537?dq=actionscript
Timestamp: 2017-09-26 12:59:46
Document Index: 481603053

Matched Legal Cases: ['§119', 'art/1', 'art/1', 'Application No. 06', 'Application No. 06291907', 'Application No. 06291847', 'Application No. 06291847', 'Application No. 06291847', 'Application No. 06291847', 'Application No. 06291847']

Patent US8156537 - Method and system for access control using resource filters - Google Patents
The present description refers in particular to a method, a system, and a computer program product for access control using resource filters for a strict separation of application and security logic. The computer-implemented method for access control may include receiving at least one access request...http://www.google.com/patents/US8156537?utm_source=gb-gplus-sharePatent US8156537 - Method and system for access control using resource filters
Publication number US8156537 B2
Application number US 11/948,150
Also published as EP1927930A1, US20080263625
Publication number 11948150, 948150, US 8156537 B2, US 8156537B2, US-B2-8156537, US8156537 B2, US8156537B2
Inventors Laurent Gomez, Annett Laube
Patent Citations (12), Non-Patent Citations (27), Referenced by (1), Classifications (8), Legal Events (3)
Method and system for access control using resource filters
US 8156537 B2
1. A computer-implemented method including executing, using at least one processor, instructions recorded on a non-transitory computer-readable storages medium, the method comprising:
This application claims priority under 35 U.S.C. §119 to European Patent Application EP06291847.9, filed Nov. 30, 2006, titled “Method and System for Access Control Using Resource Filters,” which is incorporated herein by reference in its entirety.
This description relates to access control in distributed architectures.
According to one general aspect, a method for access control may include receiving at least one access request to at least one resource from an application; providing a resource hierarchy for the at least one resource, the resource having at least one resource class; providing a policy comprising at least one access control rule for accessing at least one element of the at least one resource class; verifying the at least one access request based on the policy through an authorization service; and processing the at least one access request through a service interface.
FIG. 1 is a block diagram of a system of a service-oriented architecture according to an example embodiment.
According to an example embodiment, the authorization service 23 may find, verify, and evaluate the converted request 104 against the policy 106 as follows: The request 104 from the application 10 may include one or more attributes corresponding to the application 10 and a requested resource. The attributes may have been added to the request message 100 through the client-side intermediary 11 by receiving context information from the client-side information provider 13 such as role information. Only if the policy 106 has a target matching to the one or more attributes in the request 104, the request 104 may be evaluated to make an authorization decision and to return a response 108 to the request 104 in view of the policy 106. The policy 106 may include any number of rules. According to an example embodiment, the key concept of a rule is a condition. If the condition of the rule evaluates to true, then the rule's effect, which is a value of “Permit” or “Deny” that is associated with successful evaluation of the rule, may be returned. Evaluation of a condition may also result in an error (“Indeterminate”) or discovery that the condition does not apply to the request 104 (“NotApplicable”). The authorization decision, which is send to the application 10, may either include a granting decision, i.e., a permission to access to the target resource or a rejection denying access to the target resource.
Accordingly, a resource class may specify a resource and/or an object including at least one set of data of a data type and/or at least one method to manipulate the data, which describe the object. For example, a resource class may implement a customer object including data of data types “customer name” and “customer address” of at least one customer and a method to retrieve a customer name of the at least one customer.
“Only a human resource accountant can access all data of an employee.”
“A manager has access to the data of its employees, except for the sensitive personal data, like birthday, private address and private bank account.”
“An employee has access to the business address of all other employees and to his own private address and bank account. He has no access to his salary information.”
If the resources Employee 510, Customer 530, and Supplier 550 are accessed by another client application, it might be possible, that other policies may be applied.
“A customer can only see the status of his ordered cars (all cars related to his customer number). He can access only the general status of the orders that are currently processed or were finished in the last year and he can review all the characteristics of the car.”
“A car vendor can see the status of all cars that are ordered via his office and related to all his customers (all cars related to his vendor number which are currently assembled). He can see the same data as a customer and additionally details about the production plan.”
“A controller in the car company can access all data.”
In case no resource hierarchy is defined for the one or more client applications, it may not be possible to enforce the policy defined above with common RBAC without changing the abstract class 602 of the service interface. In particular, an enforcement process may take into account a role, one or more time constraints, and a dependency of the one or more client applications.
According to an example embodiment, a first client application 702 such as a physician may need access to the medical data of the patient, i.e., to the resource hierarchy for the patient 700 in case of contact for a house call (S10). Since the medical data may be protected by means of a context-aware access control mechanism, a statement “house call” may be evaluated using context information extracted from one or more health sensors and a proximity may be evaluated from a physical distance between the physician and the at least one patient using GPS data. Accordingly, the first client application 702 may get access only if one or more conditions are fulfilled, for example those defined in Table II as shown below.
Family Doctor Emergency House call Proximity
(context (context (context (context Personal Insurance Sensor
information) information) information) information) Data Data Data Treatments Medication
Yes — — — Yes Yes Yes Yes Yes
No Yes — Far Yes No No No No
No Yes — Near Yes Yes Yes No Yes
No No Yes Far Yes No No No No
No No Yes Near Yes Yes Yes Yes Yes
“A physician can make a prescription for a patient when he is close to the patient.”
“A pharmacist can access the medication and insurance data of a patient, when there is an unprocessed prescription for the patient.”
(context Personal Insurance Sensor Treat- Medica-
information) Data Data Data ments tion
With reference to another access control technique, Yao Hang-bing, et al., “Dynamic Role and Context-Based Access Control for Grid Applications”, TENCON 2005, November 2005, refers to effective access control models for Grid applications. An access control scheme is presented that proposes a dynamic role and context-based access control (RCBAC) framework which extends RBAC with context constraints.
US20040128547 Dec 31, 2002 Jul 1, 2004 Robert Laidlaw Method and system for modular authentication and session management
US20060046691 Aug 29, 2005 Mar 2, 2006 Canon Kabushiki Kaisha Information processing device for authentication processing, information processing method, and control program for executing the method
WO2000079434A1 Jun 21, 2000 Dec 28, 2000 Internet Dynamics, Inc. Query interface to policy server
WO2005125077A1 Jun 16, 2005 Dec 29, 2005 Sxip Networks Srl Graduated authentication in an identity management system
1 "Securing SOAP Messages with WSS4J", http://ws.apache.org/axis2/modules/rampart/1-0/security-module.html (Jun. 20, 2006.
2 "Technical Standard, Authorization (AZN) API", The Open Group, UK, Jan. 2000, 124 pages.
3 "Securing SOAP Messages with WSS4J", http://ws.apache.org/axis2/modules/rampart/1—0/security-module.html (Jun. 20, 2006.
4 Abstract of Article, Karjoth, Gunter "Access control with IBM Tivoli access manager", ACM Transactions on Information and System Security (TISSEC), vol. 6, Issue 2, pp. 232-257, http://portal.acm.org/citation.cfm?id=762476.762479 (May 2003).
5 Bhatti, Rafae, et al. "Access Control in Dynamic XML-based Web-Services with X-RBAC", http://www.sis.pitt.edu/~jjoshi/ICWS-XRBAC-Final-PDF.pdf, (2003).
6 Bhatti, Rafae, et al. "Access Control in Dynamic XML-based Web-Services with X—RBAC", http://www.sis.pitt.edu/˜jjoshi/ICWS—XRBAC—Final—PDF.pdf, (2003).
7 Carr, Harold "Sun's Project Tango" http://web.archive.org/web/20061124051012/http://java.sun.com/developer/technicalArticles/glassfish/ProjectTango/?feed=JSC (Jun. 2006).
8 Damianou, Nicodemos, et al. "Ponder: A Language for Specifying Security and Management Policies for Distributed Systems", The Language Specification, Version 1.11, Imperial College Research Report DoC 2000/01, http://www.doc.ic.ac.uk/research/technicalreports/2000/DTR00-1.pdf (Jan. 18, 2000).
9 Extended European Search Report for Application No. 06 29 1847 dated Jul. 27, 2007.
10 Extended European Search Report for EP Application No. 06291907.1, mailed May 18, 2007, 6 pages.
11 Hendrik, R. "An Introduction to Web Service Security using WSE-Part I", http://web.archive.org/web/20050206002831/www.codeproject.com/webservices/WS-Security.asp (May 17, 2004).
12 Hendrik, R. "An Introduction to Web Service Security using WSE—Part I", http://web.archive.org/web/20050206002831/www.codeproject.com/webservices/WS-Security.asp (May 17, 2004).
13 Ilechko, Paul, et al. "Authorization concepts and solutions for J2EE applications", http://www-128.ibm.com/developerworks/websphere/library/techarticles/0607-ilechko/0607-ilechko.html (Jul. 19, 2006).
14 Ilechko, Paul, et al. "Authorization concepts and solutions for J2EE applications", http://www-128.ibm.com/developerworks/websphere/library/techarticles/0607—ilechko/0607—ilechko.html (Jul. 19, 2006).
15 Minami, Kazuhiro "Secure Context-sensitive Authorization", Dartmouth Technical Report TR2006-571, http://www.ists.dartmouth.edu/library/180.pdf (Feb. 2006).
16 Non-Final Office Action for U.S. Appl. No. 11/903,257, mailed May 27, 2011, 26 pages.
17 Oasis (IBM, Sun, BEA, Entrust et al). eXtensible Access Control Markup Language (XACML). Version 1.1. Committee Specification, http://www.oasis-open.org/committees/xacml/repository/cs-xacml-specification-1.1.pdf (Aug. 7, 2003).
18 Office Action for EP Application No. 06291847.9, mailed Jul. 16, 2009, 10 pages.
19 Office Action for EP Application No. 06291847.9, mailed Oct. 31, 2008, 3 pages.
20 Office Action for U.S. Appl. No. 11/903,257, mailed Feb. 3, 2011, 13 pages.
21 Office Action for U.S. Appl. No. 11/903,257, mailed Sep. 1, 2010, 11 pages.
22 Office Action Response for EP Application No. 06291847.9, filed Dec. 12, 2008, 13 pages.
23 Office Action Response for U.S. Appl. No. 11/903,257, filed Nov. 23, 2010, 11 pages.
24 Response to Summons to Attend Oral Proceedings for EP Application No. 06291847.9, filed May 11, 2009, 9 pages.
25 Summons to Attend Oral Proceedings for EP Application No. 06291847.9, mailed Mar. 6, 2009, 5 pages.
26 Welch, Von, et al. "OGSI Authorization Requirements: Status of This Memo", http://www.ggf.org/documents/GFD.67.pdf (Mar. 26, 2006).
27 Yao, Han-Bing, et al. "Dynamic Role and Context-Based Access Control for Grid Applications", TENCON 2005, IEEE Region 10, pp. 1-7, (Nov. 2005).
U.S. Classification 726/1, 726/2, 726/4
International Classification H04L9/00, H04L9/32, G06F21/62
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GOMEZ, LAURENT;LAUBE, ANNETT;REEL/FRAME:023347/0022;SIGNING DATES FROM 20071126 TO 20071127
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GOMEZ, LAURENT;LAUBE, ANNETT;SIGNING DATES FROM 20071126TO 20071127;REEL/FRAME:023347/0022