Query interface to policy server
View Patent ↗An exemplary scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network is disclosed. Each access filter uses a local copy of an access control data base ( 3845 ) to determine whether an access request is made by a user. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to access policies, which define access in terms of the user groups and information sets. The first access filter in the path performs the access check, encrypts and authenticates the request; the other access filters in the path do not repeat the access check. The interface used by applications to determine whether a user has access to an entity is now an SQL query. The policy server ( 3811 ) assembles the information needed for the response to the query from various information sources, including source external to the policy server.
1. An apparatus for providing information in response to a query of a virtual database table, the apparatus comprising:
a virtual database service comprising the virtual database table, wherein the virtual database table comprises one or more rows and each of the one or more rows comprises one or more fields;
an information source comprising the information to be provided in response to the query of the virtual database table, wherein the information source comprises an access evaluator configured to determine whether a user may have access to an information resource within the information source, the query comprising a field name and an indication of manner for selecting a row, the manner of selecting a row including information identifying the information resource within the information source and the user seeking access to the information resource, the information provided in response to the query including an indication of whether the identified user may access the information resource, the virtual database service configured to:
receive the query;
respond to the field name and the indication of the manner for selecting a row as required to obtain the information to be provided from the information source; and
provide the information as a value of the field indicated by the field name in the selected row, in response to the query; and
an additional information source configured for use as a user profile information source that provides additional information about the user through the use of profile information gathering that indicates to the user profile information source how to gather the profile information, the indication of the manner for selecting a row further including the profile information gathering information, wherein the information provided in response to the query is obtained at least in part from the profile information source, the provided information including the profile information.
2. The apparatus of claim 1 , wherein the indication of the manner of selecting a row further includes a selection value and the information source provides at least one component of the information to be provided in response to a match between the selection value and a pattern that matches a plurality of values and is accessible to the information source.
3. The apparatus of claim 1 , wherein:
the query is an SQL query addressing the virtual database table;
the field name is contained in a SELECT clause in the query; and
the indication of the manner of selecting a row is contained in a WHERE clause in the query.
4. The apparatus of claim 1 , wherein the access evaluator determines whether the user may have access to the information resource by considering one or more access policies, each access policy indicating whether a user group may have access to a set of information resources, the access evaluator configured to allow access by the user to the information resource when the one or more access policies for the user groups to which the user belongs permit access to the sets of information resources to which the information resource belongs and the manner of selecting a row comprises membership information about the user from which membership of the user in a user group may be determined.
5. The apparatus of claim 4 , wherein the access evaluator uses the membership information to determine membership of the user in a user group.
6. The apparatus of claim 5 , wherein:
the access evaluator determines that the membership of the user in the user group permits the user access to the information resource; and
the information provided in response to the query further indicates a method of providing further information about the user in a further query from which the membership of the user in a user group can be determined.
7. The apparatus of claim 6 , wherein the further information includes authentication information that may be used to validate the identity of the user.
8. The apparatus of claim 7 , further comprising an additional information source configured for use as an authenticator, wherein the authentication information is used to validate the identity of the user.
9. The apparatus of claim 8 , wherein a response to the further query provides an indication whether the identity of the user is valid with regard to accessing an information resource.