Patent ID: 8533782

Claim:
A method of updating a policy store associated with a policy decision point of an access control system, the policy decision point being arranged to provide, in response to received decision requests, access control decisions in dependence on one or more policies stored in said policy store, each policy specifying a predetermined access control decision to be provided in response to a particular access request made in respect of a particular attribute or combination of attributes, the policy decision point being associated with at least one policy enforcement point arranged to implement access control in accordance with access control decisions provided by said policy decision point in response to decision requests submitted by said policy enforcement point, said policy enforcement point having associated therewith an attribute store providing data relating to attributes in respect of which access requests have previously been made via said policy enforcement point; the method comprising: monitoring decision requests submitted by said policy enforcement point to said policy decision point; identifying, from said monitoring and with reference to the attribute store associated with said policy enforcement point, decision requests using a computer processor, the decision requests being submitted by said policy enforcement point in respect of any attribute for which said attribute store provides no data; and in the event that a decision request is identified in respect of an attribute for which said attribute store provides no data: updating said attribute store with data relating to said attribute; and updating the policy store associated with said policy decision point with one or more policies specifying predetermined access control decisions to be provided in response to access requests made in respect of said attribute.