Patent ID: 8799986

Claim:
A computer system operable to control distribution of an access control policy to permit or deny access to one or more protected alternatives using partial evaluation, said system comprising: a computer including a memory, a database operable to store all access control policy functions for all protected alternatives, a guard operable to guard access to the protected alternative and to construct an access control request comprising attributes regarding the protected alternative, a policy decider connected to the guard and operable to receive the access control request from the guard, a policy distributor that is connected to the database and to the policy decider, and a computer program product that is loaded into the memory and that is comprised of software code portions for performing steps to control the distribution of the access control policy to permit or deny access to one or more of the protected alternatives using partial evaluation, when the product is run on the computer, whereby the computer is programmed to perform the steps of: receiving from the policy decider static attributes of the protected alternative at a policy distributor; constructing, at the policy distributor, a partial access control request from the static attributes of the protected alternative; performing, at the policy distributor, a partial evaluation against the access control policy function stored in the database by substituting the static attributes of the protected alternative, which are present in the partial control request, into the access control policy function, so as to generate a simplified access control policy function; and sending, from the policy distributor, the simplified access control policy function from the policy distributor to the policy decider, thereby enabling the policy decider to use the simplified access control policy function to evaluate access control requests regarding the protected alternative, and to return a permit or deny response to the guard, and wherein each protected alternative is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.