System and method for performing access control
View Patent ↗Rather than defining roles in terms of those resources and/or actions pertaining to the resources that are permitted to subjects having that role, it has been found that by instead defining a role by negative permissions, i.e. those resources and/or actions related thereto that are not permitted to subjects in that role, the evolution of a system is more convenient to manage. In this way, the system is only required to track and update the denied resources for particular roles. It has also been recognized that by defining a role in terms of negative permissions, i.e. what subjects in that role cannot do, malicious users can be thwarted from creating false user accounts since selecting functions associated with the resources takes permissions away rather than adds them.
1. A method of providing access control, the method comprising:
enabling creation of a user account for accessing a system by displaying a list of a plurality of resources in the system that the user account has access to, each resource in the list having associated therewith a selection mechanism that, when selected, explicitly denies the corresponding resource to that user account;
enabling submission of a request to create the user account, the request including an indication of each denial selected; and
sending the request to an access control system to enable a set of permissions associated with a specified role to be obtained and the one or more denials subtracted from the set of permissions to generate a new set of permissions associated with the user account, wherein if the request comprises one or more indications, access to the corresponding one or more resources is denied for that user account.
2. The method according to claim 1 , wherein the list of the plurality of resources in the system is displayed in a first user interface after detecting selection of a particular role.
3. The method according to claim 2 , wherein only the list of the plurality of resources in the system that the user account has access to are displayed in the first user interface.
4. The method according to claim 1 , further comprising:
enabling list of a plurality of resources to be subsequently displayed;
displaying those resources previously selected;
detecting a de-selection of at least one selected resource; and
sending an edit request comprising remaining ones of the previously selected resources.
5. The method according to claim 1 , wherein the request is embodied as a hypertext transfer protocol (HTTP) packet.
6. The method according to claim 1 , further comprising:
enabling access to the user account; and
displaying one or more administrative details of the user account without displaying any permissions associated with the user account to prevent modification to the permissions.
7. A non-transitory computer readable medium comprising computer executable instructions for providing access control, the computer executable instructions comprising instructions for:
enabling creation of a user account for accessing a system by displaying a list of a plurality of resources in the system that the user account has access to, each resource in the list having associated therewith a selection mechanism that, when selected, explicitly denies the corresponding resource to that user account;
enabling submission of a request to create the user account, the request including an indication of each denial selected; and
sending the request to an access control system to enable a set of permissions associated with a specified role to be obtained and the one or more denials subtracted from the set of permissions to generate a new set of permissions associated with the user account, wherein if the request comprises one or more indications, access to the corresponding one or more resources is denied for that user account.
8. The non-transitory computer readable medium according to claim 7 , wherein the list of the plurality of resources in the system is displayed in a first user interface after detecting selection of a particular role.
9. The non-transitory computer readable medium according to claim 8 , wherein only the list of the plurality of resources in the system that the user account has access to are displayed in the first user interface.
10. The non-transitory computer readable medium according to claim 7 , further comprising instructions for:
enabling list of a plurality of resources to be subsequently displayed;
displaying those resources previously selected;
detecting a de-selection of at least one selected resource; and
sending an edit request comprising remaining ones of the previously selected resources.
11. The non-transitory computer readable medium according to claim 7 , wherein the request is embodied as a hypertext transfer protocol (HTTP) packet.
12. The non-transitory computer readable medium according to claim 7 , further comprising instructions for:
enabling access to the user account; and
displaying one or more administrative details of the user account without displaying any permissions associated with the user account to prevent modification to the permissions.
13. A method of providing access control, the method comprising:
receiving, by an access control system, a request to create a new user account, the request including an indication of one or more denials selected for the user account, the one or more denials having been selected from a list of a plurality of resources in a system that the user account has access to, each resource in the list having associated therewith a selection mechanism that, when selected, explicitly denies the corresponding resource to that user account; and
creating, by the access control system, the user account according to the request by obtaining a set of permissions associated with a specified role and subtracting the one or more denials from the set of permissions to generate a new set of permissions associated with the user account, wherein if the request comprises one or more indications, access to the corresponding one or more resources are denied for that user account.
14. The method according to claim 13 , further comprising the access control system determining if any indications are included in the request that are not associated with a particular role; and denying the request if an indication has been added that is not associated with the particular role.
15. The method according to claim 13 , further comprising:
receiving an edit request, the edit request comprising a new set of denials obtained by detecting a de-selection of one or more previously selected denials from a user interface; and
subtracting the new set of denials from a set of permissions associated with a specified role, to generate a new set of permissions associated with the user account.
16. An access control system comprising:
a processor and memory, the memory comprising computer executable instructions for providing access control, the computer executable instructions comprising instructions for:
receiving a request to create a new user account, the request including an indication of one or more denials selected for the user account, the one or more denials having been selected from a list of a plurality of resources in the system that the user account has access to, each resource in the list having associated therewith a selection mechanism that, when selected, explicitly denies the corresponding resource to that user account; and
creating the user account according to the request by obtaining a set of permissions associated with a specified role and subtracting the one or more denials from the set of permissions to generate a new set of permissions associated with the user account, wherein if the request comprises one or more indications, access to the corresponding one or more resources are denied for that user account.
17. The access control system according to claim 16 , further comprising instructions for determining if any indications are included in the request that are not associated with a particular role; and denying the request if an indication has been added that is not associated with the particular role.
18. The access control system according to claim 16 , further comprising instructions for:
receiving an edit request, the edit request comprising a new set of denials obtained by detecting a de-selection of one or more previously selected denials from a first user interface; and
subtracting the new set of denials from a set of permissions associated with a specified role, to generate a new set of permissions associated with the user account.