Controlling access to a resource using an attribute based access control list

1. A method for controlling access to a resource, the method comprising:

determining one or more request attributes associated with a request for access to a resource;

accessing an access control list associated with the resource, wherein the access control list comprises one or more access control attributes associated with the resource, wherein the request for access to the resource comprises an indication of a uniform resource identifier uniquely identifying the resource and accessing the access control list comprises using the uniform resource identifier to access the access control list associated with the resource;

determining, by a processor, a permission defining one or more access abilities for the resource at least in part by comparing request attributes to the access control attributes and, for any access control attribute corresponding to a request attribute, including an ability associated with the corresponding access control attribute in the permission, wherein determining the permission comprises determining at least one permission mask and including an ability associated with the corresponding access control attribute in the permission comprises performing a logical OR operation on the ability associated with the corresponding access control attribute and one of the at least one permission mask, thereby accumulating the ability associated with the corresponding access control attribute in the permission, wherein determining at least one permission mask further comprises determining a first permission mask used for accumulation of positive abilities and a second permission mask used for accumulation of negative abilities, and wherein determining the permission further comprises performing a logical AND operation on the first permission mask and the second permission mask; and

determining whether to grant the request based at least in part on the determined permission.

2. The method of claim 1 , wherein the request for access to the resource requires an ability, and wherein determining whether to grant the request comprises:

comparing the ability required for the request to the determined permission to determine whether the ability required for the request is included within the determined permission;

in an instance in which the ability required for the request is included within the determined permission, determining to grant the request; and

in an instance in which the ability required for the request is not included within the determined permission, determining to deny the request.

3. The method of claim 2 , wherein the determined permission comprises a permission mask and comparing the ability required for the request to the determined permission comprises performing a logical AND operation on the ability required for the request and the permission mask to determine whether the ability required for the request is included within the permission mask.

4. The method of claim 1 , wherein in an instance in which an ability associated with an access control attribute corresponding to a request attribute comprises a negative ability, including the ability associated with the corresponding access control attribute in the permission comprises removing the ability from the permission in an instance in which the permission includes the ability.

5. The method of claim 1 , wherein accessing the access control list comprises accessing the access control list from a cached access control model.

6. The method of claim 1 , wherein the request for access to the resource comprises an indication of a uniform resource identifier uniquely identifying the resource and accessing the access control list comprises using the uniform resource identifier to access the access control list associated with the resource.

7. The method of claim 1 , wherein the request for access to the resource is initiated by a user, and wherein the request attributes comprise user attributes associated with the user.

8. The method of claim 1 , wherein the resource is contained in a collection and the access control list associated with the resource further comprises a link to an access control list associated with the collection, and wherein determining a permission defining one or more access abilities for the resource comprises:

comparing a request attribute to one or more access control attributes in the access control list associated with the resource to determine whether the access control list associated with the resource comprises an access control attribute corresponding to the request attribute;

in an instance in which the access control list associated with the resource comprises an access control attribute corresponding to the request attribute, including an ability associated with the corresponding access control attribute in the permission; and

in an instance in which the access control list associated with the resource does not comprise an access control attribute corresponding to the request attribute, using the link to access the access control list associated with the collection and comparing the request attribute to one or more access control attributes in the access control list associated with the collection.

9. The method of claim 8 , wherein the resource is contained within a hierarchy of one or more collection, and wherein:

accessing an access control list associated with the resource comprises accessing the access control list associated with the resource from an access control model comprising a hierarchy of linked access control lists, wherein the hierarchy of linked access control lists comprises the access control list associated with the resource and one or more additional access control lists, wherein each additional access control list is associated with a respective one of the one or more collections, and wherein each access control list in the hierarchy of linked access control lists comprises one or more access control attributes; and

in an instance in which the access control list associated with the resource does not comprise an access control attribute corresponding to the request attribute, determining a permission defining one or more access abilities for the resource further comprises:

iteratively accessing the additional access control lists in the hierarchy of linked access control lists beginning with an access control list associated with a lowest order collection containing the resource and proceeding to an access control list associated with a root collection in the hierarchy of collections and comparing the request attribute to the access control attributes in each accessed access control list until an access control attribute corresponding to the request attribute is found or until the access control list associated with the root collection is reached; and

in an instance in which an access control attribute corresponding to the request attribute is found, accumulating an ability associated with the corresponding access control attribute in the permission.

10. An apparatus for controlling access to a resource, the apparatus comprising at least one processor, wherein the at least one processor causes the apparatus to:

determine one or more request attributes associated with a request for access to a resource;

access an access control list associated with the resource, wherein the access control list comprises one or more access control attributes associated with the resource, wherein the request for access to the resource comprises an indication of a uniform resource identifier uniquely identifying the resource, and wherein the at least one processor is to cause the apparatus to access the access control list by using the uniform resource identifier to access the access control list associated with the resource;

determine a permission defining one or more access abilities for the resource at least in part by comparing the request attributes to the access control attributes and, for any access control attribute corresponding to a request attribute, including an ability associated with the corresponding access control attribute in the permission, wherein determining the permission comprises determining at least one permission mask and including an ability associated with the corresponding access control attribute in the permission comprises performing a logical OR operation on the ability associated with the corresponding access control attribute and one of the at least one permission mask, thereby accumulating the ability associated with the corresponding access control attribute in the permission, wherein determining at least one permission mask further comprises determining a first permission mask used for accumulation of positive abilities and a second permission mask used for accumulation of negative abilities, and wherein determining the permission further comprises performing a logical AND operation on the first permission mask and the second permission mask; and

determine whether to grant the request based at least in part on the determined permission.

11. The apparatus of claim 10 , wherein the request for access to the resource requires an ability, and wherein the at least one processor causes the apparatus to determine whether to grant the request by:

comparing the ability required for the request to the determined permission to determine whether the ability required for the request is included within the determined permission;

in an instance in which the ability required for the request is included within the determined permission, determining to grant the request; and

in an instance in which the ability required for the request is not included within the determined permission, determining to deny the request.

12. The apparatus of claim 10 , wherein the determined permission comprises a permission mask, and wherein the at least one processor is configured to cause the apparatus to compare the ability required for the request to the determined permission by performing a logical AND operation on the ability required for the request and the permission mask to determine whether the ability required for the request is included within the permission mask.

13. The apparatus of claim 10 , wherein in an instance in which an ability associated with an access control attribute corresponding to a request attribute comprises a negative ability, the at least one processor is configured to cause the apparatus to include the ability associated with the corresponding access control attribute in the permission by removing the ability from the permission in an instance in which the permission includes the ability.

14. The apparatus of claim 10 , wherein the at least one processor causes the apparatus to access the access control list by accessing the access control list from a cached access control model.

15. The apparatus of claim 10 , wherein the request for access to the resource comprises an indication of a uniform resource identifier uniquely identifying the resource, and wherein the at least one processor is configured to cause the apparatus to access the access control list by using the uniform resource identifier to access the access control list associated with the resource.

16. The apparatus of claim 10 , wherein the request for access to the resource is initiated by a user, and wherein the request attributes comprise user attributes associated with the user.

17. The apparatus of claim 10 , wherein the resource is contained in a collection and the access control list associated with the resource further comprises a link to an access control list associated with the collection, and wherein the at least one processor is configured to cause the apparatus to determine a permission defining one or more access abilities for the resource at least in part by:

comparing a request attribute to one or more access control attributes in the access control list associated with the resource to determine whether the access control list associated with the resource comprises an access control attribute corresponding to the request attribute;

in an instance in which the access control list associated with the resource comprises an access control attribute corresponding to the request attribute, including an ability associated with the corresponding access control attribute in the permission; and

in an instance in which the access control list associated with the resource does not comprise an access control attribute corresponding to the request attribute, using the link to access the access control list associated with the collection and comparing the request attribute to one or more access control attributes in the access control list associated with the collection.

18. The apparatus of claim 17 , wherein the resource is contained within a hierarchy of one or more collection, and wherein the at least one processor causes the apparatus to:

access an access control list associated with the resource by accessing the access control list associated with the resource from an access control model comprising a hierarchy of linked access control lists, wherein the hierarchy of linked access control lists comprises the access control list associated with the resource and one or more additional access control lists, wherein each additional access control list is associated with a respective one of the one or more collections, and wherein each access control list in the hierarchy of linked access control lists comprises one or more access control attributes; and

in an instance in which the access control list associated with the resource does not comprise an access control attribute corresponding to the request attribute, determine a permission defining one or more access abilities for the resource at least in part by:

iteratively accessing the additional access control lists in the hierarchy of linked access control lists beginning with an access control list associated with a lowest order collection containing the resource and proceeding to an access control list associated with a root collection in the hierarchy of collections and comparing the request attribute to the access control attributes in each accessed access control list until an access control attribute corresponding to the request attribute is found or until the access control list associated with the root collection is reached; and

in an instance in which an access control attribute corresponding to the request attribute is found, accumulating an ability associated with the corresponding access control attribute in the permission.

19. The apparatus of claim 10 , further comprising at least one memory storing instructions that when executed by the at least one processor cause the apparatus to:

determine one or more request attributes associated with a request for access to the resource;

access an access control list associated with the resource, wherein the access control list comprises one or more access control attributes associated with the resource;

determine a permission defining one or more access abilities for the resource at least in part by comparing the request attributes to the access control attributes and, for any access control attribute corresponding to a request attribute, including an ability associated with the corresponding access control attribute in the permission; and

determine whether to grant the request based at least in part on the determined permission.

20. A computer program product for controlling access to a resource, the computer program product comprising at least one non-transitory computer-readable storage medium having computer-readable program instructions stored therein, the computer-readable program instructions comprising:

program instructions to determine one or more request attributes associated with a request for access to a resource;

program instructions to access an access control list associated with the resource, wherein the access control list comprises one or more access control attributes associated with the resource, wherein the request for access to the resource comprises an indication of a uniform resource identifier uniquely identifying the resource, and wherein the at least one processor is to cause the apparatus to access the access control list by using the uniform resource identifier to access the access control list associated with the resource;

program instructions to determine a permission defining one or more access abilities for the resource at least in part by comparing the request attributes to the access control attributes, for any access control attribute corresponding to a request attribute, including an ability associated with the corresponding access control attribute in the permission, wherein determining the permission comprises determining at least one permission mask and including an ability associated with the corresponding access control attribute in the permission comprises performing a logical OR operation on the ability associated with the corresponding access control attribute and one of the at least one permission mask, thereby accumulating the ability associated with the corresponding access control attribute in the permission, wherein determining at least one permission mask further comprises determining a first permission mask used for accumulation of positive abilities and a second permission mask used for accumulation of negative abilities, and wherein determining the permission further comprises performing a logical AND operation on the first permission mask and the second permission mask; and

program instructions to determine whether to grant the request based at least in part on the determined permission.

21. The computer program product of claim 20 , wherein the request for access to the resource requires an ability, and wherein the program instructions configured to determine whether to grant the request comprise:

program instructions to compare the ability required for the request to the determined permission to determine whether the ability required for the request is included within the determined permission;

program instructions, in an instance in which the ability required for the request is included within the determined permission, to determine to grant the request; and

program instructions, in an instance in which the ability required for the request is not included within the determined permission, to determine to deny the request.

22. The computer program product of claim 20 , wherein the resource is contained in a collection and the access control list associated with the resource further comprises a link to an access control list associated with the collection, and wherein the program instructions to determine a permission defining one or more access abilities for the resource comprise:

program instructions to compare a request attribute to one or more access control attributes in the access control list associated with the resource to determine whether the access control list associated with the resource comprises an access control attribute corresponding to the request attribute;

program instructions, in an instance in which the access control list associated with the resource comprises an access control attribute corresponding to the request attribute, to include an ability associated with the corresponding access control attribute in the permission; and

program instructions, in an instance in which the access control list associated with the resource does not comprise an access control attribute corresponding to the request attribute, to use the link to access the access control list associated with the collection and comparing the request attribute to one or more access control attributes in the access control list associated with the collection.