Scope-centric access control model

1. A computer-controlled method comprising:

maintaining, by a computer, a plurality of association tuples, wherein each association tuple is associated with an access-control-policy (ACP)-defining container which corresponds to one or more resources and is associated with an access control policy;

receiving a request to access a resource for a user, the request including a supplier reference to the resource, wherein the resource belongs to multiple ACP-defining containers having different explicit access control policies;

identifying a container which contains the requested resource, wherein the access control policy associated with the identified container grants the user access to the requested resource; and

granting the user access to the resource.

2. The computer-controlled method of claim 1 , wherein the request further includes a client reference to a client entity used by the user to access the resource; and

wherein said client reference is a client-proxy identifier, said supplier reference is a supplier-proxy identifier, and said effective supplier reference is an effective supplier-proxy identifier.

3. The computer-controlled method of claim 1 , wherein said container is identified by a container-proxy identifier, and each of said set of said plurality of association tuples contains said container proxy-identifier.

4. The computer-controlled method of claim 1 , wherein the retrieving determining further comprises adding a new association tuple to said set of said plurality of association tuples.

5. The computer-controlled method of claim 1 , wherein the determining comprises:

matching said supplier reference with one of said plurality of association tuples in said set of said plurality of association tuples; and

using said supplier reference as said effective supplier-proxy identifier.

6. The computer-controlled method of claim 1 , wherein the determining comprises:

matching said supplier reference with an aliased supplier reference from said set of said plurality of association tuples; and

using said aliased supplier reference as said effective supplier reference.

7. The computer-controlled method of claim 2 , wherein the determining further comprises:

determining that said client reference matches a parent entity of said supplier reference; and

adding a new association tuple to said association graph, said new association tuple referencing said supplier reference and said identified container.

8. The computer-controlled method of claim 2 , wherein the determining further comprises:

determining that said client reference does not match a parent entity of the supplier reference;

creating a new alias supplier proxy for the resource; and

adding a new association tuple to said association graph, said new association tuple referencing said new alias supplier proxy.

9. The computer-controlled method of claim 1 , further comprising:

creating a proxy to the resource, said proxy identified by a proxy identifier;

making the resource immutable; and

providing said proxy identifier as said supplier reference.

10. The computer-controlled method of claim 1 , further comprising:

determining a right of the user to said effective supplier reference responsive to returning the effective supplier reference; and

enabling an operation by the user on said supplier reference responsive to said right.

11. An apparatus comprising:

a processor;

a memory;

a storage mechanism that maintains a plurality of association tuples, wherein each association tuple is associated with an access-control-policy (ACP)-defining container which corresponds to one or more resources and is associated with an access control policy;

a receiving logic that receives a request to access a resource for a user, wherein the request includes a supplier reference to the resource, wherein the resource belongs to multiple ACP-defining containers having different explicit access control policies;

an identification logic that identifies a container which contains the requested resource, wherein the access control policy associated with the identified container grants the user access to the requested resource; and

granting the user access to the resource.

12. The apparatus of claim 11 , wherein the request further includes a client reference to a client entity used by the user to access the resource; and

wherein said client reference is a client-proxy identifier, said supplier reference is a supplier-proxy identifier, and said effective supplier reference is an effective supplier-proxy identifier.

13. The apparatus of claim 11 , wherein said container is identified by a container proxy-identifier, and each of said set of said plurality of association tuples contains said container proxy-identifier.

14. The apparatus of claim 11 , wherein the retrieving logic further comprises an insertion logic that adds a new association tuple to said set of said plurality of association tuples.

15. The apparatus of claim 11 , wherein the retrieving logic further comprises:

a search logic that matches said supplier reference with one of said plurality of association tuples in said set of said plurality of association tuples; and

a selection logic that, responsive to the search logic, selects said supplier reference as said effective supplier-proxy identifier.

16. The apparatus of claim 11 , wherein the retrieving logic further comprises:

a search logic that matches said supplier reference with an aliased supplier reference from said set of said plurality of association tuples; and

a selection logic that, responsive to the search logic, selects said aliased supplier reference as said effective supplier reference.

17. The apparatus of claim 12 , wherein the retrieving logic further comprises:

a matching logic that determines that said client reference matches a parent entity of said supplier reference; and

a tuple insertion logic that, responsive to the identification logic, adds a new association tuple to said association graph, said new association tuple referencing said supplier reference and said identified container.

18. The apparatus of claim 12 , wherein the retrieving logic further comprises:

a matching logic that determines that said client reference does not match a parent entity of the supplier reference;

an instantiation logic that creates a new alias supplier proxy for the resource; and

a tuple insertion logic that, responsive to the identification logic and the instantiation logic, adds a new association tuple to said association graph, said new association tuple referencing said new alias supplier proxy.

19. The apparatus of claim 11 , further comprising:

an instantiation logic that creates a proxy to the resource, said proxy identified by a proxy identifier;

a fixation logic that makes the resource immutable; and

a specification logic that provides said proxy identifier as said supplier reference.

20. The apparatus of claim 11 , further comprising:

a rights determination logic that, responsive to the presenting logic returning the effective supplier reference, determines a right of the user to said effective supplier reference; and

an enablement logic that enables an operation by the user on said supplier reference responsive to said right.

21. A computer program product comprising:

a non-transitory computer-readable medium storing instructions that, when executed by a computer, cause said computer to perform a method, the method comprising:

maintaining a plurality of association tuples, wherein each association tuple is associated with an access-control-policy (ACP)-defining container which corresponds to one or more resources and is associated with an access control policy;

receiving a request to access a resource for a user, the request including a supplier reference to the resource, wherein the resource belongs to multiple ACP-defining containers having different explicit access control policies;

identifying a container which contains the requested resource, wherein the access control policy associated with the identified container grants the user access to the requested resource; and

granting the user access to the resource.

22. The computer program product of claim 21 , wherein the request further includes a client reference to a client entity used by the user to access the resource; and

wherein said client reference is a client-proxy identifier, said supplier reference is a supplier-proxy identifier, and said effective supplier reference is an effective supplier-proxy identifier.

23. The computer program product of claim 21 , wherein said container is identified by a container proxy-identifier, and each of said set of said plurality of association tuples contains said container proxy-identifier.

24. The computer program product of claim 21 , wherein the determining further comprises adding a new association tuple to said set of said plurality of association tuples.

25. The computer program product of claim 21 , wherein the determining comprises:

matching said supplier reference with one of said plurality of association tuples in said set of said plurality of association tuples; and

using said supplier reference as said effective supplier-proxy identifier.

26. The computer program product of claim 21 , wherein the determining comprises:

matching said supplier reference with an aliased supplier reference from said set of said plurality of association tuples; and

using said aliased supplier reference as said effective supplier reference.

27. The computer program product of claim 22 , wherein the determining further comprises:

determining that said client reference matches a parent entity of said supplier reference; and

adding a new association tuple to said association graph, said new association tuple referencing said supplier reference and said container.

28. The computer program product of claim 22 , wherein the determining further comprises:

determining that said client reference does not match a parent entity of the supplier reference;

creating a new alias supplier proxy for the resource; and

adding a new association tuple to said association graph, said new association tuple referencing said new alias supplier proxy.

29. The computer program product of claim 21 , further comprising:

creating a proxy to the resource, said proxy identified by a proxy identifier;

making the resource immutable; and

providing said proxy identifier as said supplier reference.

30. The computer program product of claim 21 , further comprising:

determining a right of the user to said effective supplier reference responsive to returning the effective supplier reference; and

enabling an operation by the user on the supplier reference responsive to said right.