Control of access to resources of data objects

1 . An access control node for controlling access to resources of data objects exposed by at least one computing device, wherein the data objects conform to an object model that specifies, for a given object name of a data object, one or more resources which may be associated with instances of a data object of that object name, the access control node comprising processing circuitry configured to:

receive an access request to access a resource of a data object instance;

determine a compatibility of the access request with an access rule; and

perform at least one of allowing or denying the access request in accordance with the determined compatibility, wherein

the access request identifies the resource at an identification abstraction level,

the access request comprises an object type identifier identifying an object type, an instance identifier identifying one or more instances of the object type, and a resource identifier identifying the resource,

the access rule specifies one or more limitations on access to resources at a semantic abstraction level that indicates a semantic content of a data object or resource, the one or more limitations comprising a limitation that is conditional upon a value of at least one resource fulfilling a criterion, and

determining the compatibility of the access request with the access rule comprises using a mapping between the identification abstraction level and the semantic abstraction level.

2 . The access control node of claim 1 , wherein the semantic content of data objects and resources is defined by the object model to which they conform, and wherein the mapping between the identification abstraction level and the semantic abstraction level references the data model to which the data objects conform.

3 . The access control node of claim 1 , wherein the one or more limitations upon access to resources that are specified in the access rule identify a resource by the semantic content of its name or the name of the data object with which it is associated.

4 . The access control node of claim 1 , wherein the one or more limitations upon access to resources that are specified in the access rule comprises a limitation that is conditional upon a characteristic of the access requested.

5 . The access control node of claim 1 , wherein the one or more limitations upon access to resources that are specified in the access rule comprises a limitation that is conditional upon a role of an entity from which the access request to access a resource of a data object instance is received.

6 . The access control node of claim 1 , wherein the access request to access the resource of the data object instance identifies the resource using at least one of a Unique Resource Identifier, URI, or an address of the computing device hosting the data object with which the resource is associated and a path that points to the specific resource on the device.

7 . The access control node of claim 1 , wherein the processing circuitry is configured to determine a compatibility of the access request with an access rule using the mapping between the identification and semantic abstraction levels by performing at least one of:

translating the received access request to access a resource of a data object instance to the semantic abstraction level using the mapping and comparing the translated access request to the access rule; and

obtaining a translation of the access rule into the identification abstraction level, wherein the translation is generated using the mapping, and comparing the received access request to the translated access rule.

8 . The access control node of claim 7 , wherein the processing circuitry is configured to obtain a translation of the access rule into the identification abstraction level, wherein the translation is generated using the mapping, by performing at least one of:

translating the access rule into the identification abstraction level using the mapping; and

receiving, from an access policy node, a translation of the access rule into the identification abstraction level, wherein the translation has been generated by the access policy node using the mapping.

9 . An intrusion prevention system comprising:

the access control node of claim 1 ; and

an access policy node for managing access rules for controlling access to resources of data objects hosted on at least one computing device, wherein the data objects conform to an object model that specifies, for a given object name of a data object, one or more resources which may be associated with instances of a data object of that object name, the access policy node comprising processing circuitry configured to:

receive configuration information defining an access rule; and

store the access rule in a memory, wherein

the access rule specifies one or more limitations upon access to resources at a semantic abstraction level that indicates a semantic content of a data object or resource.

10 . An access control node for controlling access to resources of data objects exposed by at least one computing device, wherein the data objects conform to an object model that specifies, for a given object name of a data object, one or more resources which may be associated with instances of a data object of that object name, the access control node comprising processing circuitry configured to:

receive an access request to access a resource of a data object instance;

determine a compatibility of the access request with an access rule; and

perform at least one of allowing or denying the access request in accordance with the determined compatibility, wherein

the access request identifies the resource at an identification abstraction level,

the access request comprises an object type identifier identifying an object type, an instance identifier identifying one or more instances of the object type, and a resource identifier identifying the resource,

the access rule specifies one or more limitations on access to resources at a semantic abstraction level that indicates a semantic content of a data object or resource, the one or more limitations comprising a limitation that is conditional upon a value of at least one resource fulfilling a criterion,

determining the compatibility of the access request with the access rule comprises using a mapping between the identification abstraction level and the semantic abstraction level, and

the mapping between the identification abstraction level and the semantic abstraction level comprises a mapping between a semantic term and at least one data object or resource the semantic content of which includes the semantic term.

11 . The access control node of claim 10 , wherein the mapping between the identification abstraction level and the semantic abstraction level further comprises an association between the at least one data object or resource the semantic content of which includes the semantic term and another data item that is specified in an object model or ontology as being related to the at least one data object or resource the semantic content of which includes the semantic term.

12 . The access control node of claim 11 , wherein the relation between the at least one data object or resource the semantic content of which includes the semantic term and the other data item comprises at least one of an equivalency relation, an inclusion relation or a control relation.

13 . The access control node of claim 11 , wherein the other data item comprises at least one of an object or resource specified in an object model or a term specified in an ontology.

14 . The access control node of claim 10 , wherein the resource to which access is requested is comprised within a system, and wherein the mapping between the identification abstraction level and the semantic abstraction level further comprises an association between at least one resource the semantic content of which includes the semantic term and another resource in the system that has been specified by a system administrator as being related to the at least one resource the semantic content of which includes the semantic term.

15 . The access control node of claim 10 , wherein the mapping between the identification abstraction level and the semantic abstraction level further comprises a mapping between a semantic term and at least one request type to which the semantic term corresponds.

16 . The access control node of claim 10 , wherein the mapping between the identification abstraction level and the semantic abstraction level further comprises a mapping between a role and an identifier of at least one entity to which the role has been assigned, wherein the entity is operable to request access to a resource.

17 . An object model node for maintaining an object model that specifies, for a given object name of a data object, one or more resources which may be associated with instances of a data object of that object name, the object model node comprising processing circuitry configured to:

extract semantic content of a data object or resource in the object model, wherein the extracted semantic content comprises a semantic term;

identify a data item that is specified in an object model or ontology and comprises semantic content that matches the extracted semantic content;

identify a relation between the identified data item and the data object or resource in the object model; and

update the data model to specify a relation between the identified data item and the data object or resource, wherein the relation between the identified data item and the data object or resource comprises:

(i) an equivalency relation indicating the identified data item and the data object or resource have identical semantics,

(ii) an inclusion relation indicating (a) a subset of functionalities of the data object or resource comprises the identified data item or (b) a subset of functionalities of the identified data item comprises the data object or resource, and/or

(iii) a control relation indicating (a) the data object or resource has control over the identified data item or (b) the identified data item has control over the data object or resource.

18 . The object model node of claim 17 , wherein the other data item comprises at least one of an object or resource specified in an object model or a term specified in an ontology.

19 . The intrusion prevention system of claim 9 , wherein the access policy node is further configured to provide the stored access rule to the access control node.