Abstracting security policy from, and transforming to, native representations of access check mechanisms
View Patent ↗Abstracting access control policy from access check mechanisms allows for richer expression of policy, using a declarative model with semantics, than what is permitted by the access check mechanisms. Further, abstracting access control policy allows for uniform expression of policy across multiple access check mechanisms. Proof-like reasons for any access query are provided, such as who has access to what resource, built from the policy statements themselves, independent of the access check mechanism that provide access. Access is audited and policy-based reasons for access are provided based on the access control policy.
1. A method for implementing a computer resource access control policy comprising:
receiving an access control policy that includes policy statements, wherein said policy statements are in an abstracted policy language, and wherein the abstracted policy language is not understood by an access check mechanism;
identifying predicates in said policy statements, wherein the predicates are in the abstracted policy language transforming, via a computer, the predicates in the abstracted policy language into primitives, wherein the primitives are in a language native to said access check mechanism;
configuring permissions at said access control mechanism based on said primitives, wherein said permissions are configured to enable said access check mechanisms to dictate when access is granted, wherein said permissions are configured across multiple access check mechanisms;
receiving a query regarding access to resources; and
providing results of said query along with reasons, according to said access control policy, why the particular results were provided, said reasons built from said access control policy itself, independent of said multiple access check mechanisms.
2. The method of claim 1 further comprising:
querying said access control policy to determine an impact of changing said access control policy; and
providing information detailing said impact of changing said access control policy without changing said access check configurations.
3. The method of claim 2 further comprising:
auditing a resource access; and
providing reasons, according to said access control policy, why a particular audited access was allowed, said reasons built from said access control policy itself, independent of said multiple access check mechanisms.
4. The method of claim 3 further comprising: identifying resource access attempts that are discordant with said access security policy based on said access control policy itself, independent of said multiple access check mechanisms.
5. A non-transitory computer readable storage medium having instructions thereon for implementing a computer resource access control policy comprising:
receiving an access control policy that includes policy statements, wherein said policy statements are in an abstracted policy language, and wherein the abstracted policy language is not understood by an access check mechanism;
identifying predicates in said policy statements, wherein the predicates are in the abstracted policy language;
transforming, via a computer, the predicates in the abstracted policy language into primitives, wherein the primitives are in a language native to said access check mechanism;
configuring permissions at said access control mechanism based on said primitives, wherein said permissions are configured to enable said access check mechanisms to dictate when access is granted, wherein said permissions are configured across multiple access check mechanisms;
receiving a query regarding access to resources; and
providing results of said query along with reasons, according to said access control policy, why the particular results were provided, said reasons built from said access control policy itself, independent of said multiple access check mechanisms.
6. The non-transitory computer readable storage medium claim 5 further comprising:
querying the access control policy to determine an impact of changing the access control policy; and
providing information detailing said impact of changing the access control policy without changing the access check configurations.
7. The non-transitory computer readable storage medium claim 6 further comprising:
auditing a resource access; and
providing reasons, according to the access control policy, why a particular audited access was allowed, said reasons built from the access control policy itself, independent of said multiple access check mechanisms.
8. The non-transitory computer readable storage medium of claim 7 further comprising:
identifying resource access attempts that are discordant with said access security policy based on said access control policy itself, independent of said multiple access check mechanisms.
9. A system for implementing a computer resource access control policy comprising:
a processor for executing computer-executable instructions, the computer-executable instructions comprising instructions for:
receiving an access control policy that includes policy statements, wherein said policy statements are in an abstracted policy language, and wherein the abstracted policy language is not understood by an access check mechanism;
identifying predicates in said policy statements, wherein the predicates are in the abstracted policy language;
transforming the predicates in the abstracted policy language into primitives, wherein the primitives are in a language native to said access check mechanism; and
configuring permissions at said access control mechanism based on said primitives, wherein said permissions are configured to enable said access check mechanisms to dictate when access is granted, wherein said permissions are configured across multiple access check mechanisms;
receiving a query regarding access to resources; and
providing results of said query along with reasons, according to said access control policy, why the particular results were provided, said reasons built from said access control policy itself, independent of said multiple access check mechanisms.