Patent Document ID: 8458764
Application ID: 12419445

Base Claim:
1. A computer implemented access control system, the system comprising: a database for storing a serialized version of an eXtensible Access Control Markup Language (XACML) permissions hierarchy; a memory for storing an original version of the XACML permissions hierarchy; and an XACML serialization engine configured to convert the XACML permissions hierarchy into the serialized version, wherein the serialized version contains a listing of at least a portion of the predicates possible in the XACML permission hierarchy and the effect on each of the portion of the predicates, and to aggregate the targets of the XACML permissions hierarchy; wherein each target contains a rule and aggregating the targets includes computing predicates from the rules and aggregating the predicates into a permission set and a prohibited set to create a serialized policy; wherein the XACML serialization engine is further configured to serialize each policy in the XACML permission hierarchy and the XACML serialization engine is configured to create a serialized policy set by combining each of the serialized policies, the serialized policy set including a first table including permissions and second table including prohibitions, the second table being separate from the first table; wherein aggregating the targets includes computing predicates from the rules and aggregating the predicates into a permission set and a prohibited set to create a serialized policy, and wherein creating the table includes serializing each policy in the XACML permissions specification.

---

Claim 2:
2. The system of claim 1 , further comprising: a request approval engine configured to receive an access request, examine the serialized version and generate an allow or deny reply based on the examination.