# US 10,375,113 B2 · Method of managing access control in a cloud network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,113 B2 - Document ID: US10375113B2 - Status: Granted - Kind: B2 - Application number: 14/752,237 - Filed: 2015-06-26 - Published: 2015-12-31 - Granted: 2019-08-06 - Earliest claimed: 2014-06-27 - Assignees: Orange - Applicants: Orange - Inventors: Ruan He; Yu Zhou - Web page: https://patentgrep.com/patent/US10375113B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/101: {Access control lists [ACL]} - H04L 63/105: {Multiple levels of security} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method which makes it possible to manage access control between a first entity and a second entity belonging to two security domains in a cloud network is disclosed. In one aspect the method comprises, if the entities belong to security domains implementing different access control policies, determining whether there exists a first access control rule between the first entity and a virtual entity within the security domain of the first entity, and a second access control second rule between the second entity and the virtual entity within the security domain of the second entity. If so, the method may comprise controlling access between the first and second entities as a function of the first and second rules. ## Claims ### Claim 1 A method of defining, in a cloud network, an access control rule between a first entity and a second entity, the first and second entities belonging respectively to first and second security domains that implement different access control policies, the method comprising: creating a virtual entity visible to each of the first and second security domains, the virtual entity functioning as a resource within the first security domain of the first entity and functioning as a user within the second security domain of the second entity; creating a first access control rule between said first entity and said virtual entity within the first security domain of the first entity, the first access control rule defining access rights for the first entity to access the virtual entity; creating a second access control rule between said second entity and said virtual entity within the second security domain of the second entity, the second access control rule defining access rights for the virtual entity to access the second entity; and defining and storing a relationship between said first and second security domains via said virtual entity. ### Claim 2 (depends on 1) A method according to claim 1, wherein said access control policies are selected from the group consisting of RBAC, OrBAC, ABAC, and MLS. ### Claim 3 An access control management method between a first entity and a second entity in a cloud network, the method comprising: determining whether the first and second entities belong to security domains that implement different access control policies; if the first and second entities belong to security domains implementing different access control policies, determining whether there exists a virtual entity establishing a relationship between said security domains by functioning as a resource within a first security domain of the first entity and functioning as a user within a second security domain of the second entity, a first access control rule between said first entity and said virtual entity within the first security domain of said first entity, the first access control rule defining access rights for the first entity to access the virtual entity, and a second access control rule between said second entity and said virtual entity within the second security domain of said second entity, the second access control rule defining access rights for the virtual entity to access the second entity; and if so: controlling access between said first and second entities as a function of said first and second access control rules. ### Claim 4 (depends on 3) An access control management method according to claim 3, wherein, if said first and second entities belong to security domains implementing the same access control policy, the method further comprises performing an access control step between said first and second entities as a function of said same access control policy. ### Claim 5 (depends on 3) A method according to claim 3 wherein said access control policies are selected from the group consisting of RBAC, OrBAC, ABAC, and MLS. ### Claim 6 A processor configured to manage access control between a first entity and a second entity in a cloud network, wherein said processor is configured to: determine whether said first and second entities belong to security domains implementing different access control policies; if the first and second entities belong to security domains implementing different access control policies, determining whether there exists a virtual entity establishing a relationship between said security domains by functioning as a resource within a first security domain of the first entity and functioning as a user within a second security domain of the second entity, a first access control rule between said first entity and said virtual entity within the first security domain of said first entity, the first access control rule defining access rights for the first entity to access the virtual entity, and a second access control rule between said second entity and said virtual entity within the second security domain of said second entity, the second access control rule defining access rights for the virtual entity to access the second entity; and if so: control access between said first and second entities as a function of said first and second access control rules. ### Claim 7 (depends on 3) A computer having stored thereon a program including instructions for executing the access control management method according to claim 3. ### Claim 8 (depends on 3) A non-transitory computer readable data medium having stored thereon instructions for executing the access control method according to claim 3 when said instructions are executed by a computer. ### Claim 9 (depends on 1) A method according to claim 1, wherein the first entity is a user of the first security domain and the second entity is a resource of the second security domain. ### Claim 10 (depends on 3) A method according to claim 3, wherein the first entity is a user of the first security domain and the second entity is a resource of the second security domain. ### Claim 11 (depends on 6) A processor according to claim 6, wherein the first entity is a user of the first security domain and the second entity is a resource of the second security domain. ### Claim 12 (depends on 1) A method according to claim 1, wherein the first access control rule enables the first entity to access the virtual resource within the first security domain, and the second access control rule enables the virtual resource to access the second entity within the second security domain. ### Claim 13 (depends on 3) A method according to claim 3, wherein the first access control rule enables the first entity to access the virtual resource within the first security domain, and the second access control rule enables the virtual resource to access the second entity within the second security domain. ### Claim 14 (depends on 6) A processor according to claim 6, wherein the first access control rule enables the first entity to access the virtual resource within the first security domain, and the second access control rule enables the virtual resource to access the second entity within the second security domain. ### Claim 15 (depends on 6) A processor according to claim 6, wherein said access control policies are selected from the group consisting of RBAC, OrBAC, ABAC, and MLS. ### Claim 16 (depends on 6) A processor according to claim 6, wherein the processor is further configured, if said first and second entities belong to security domains implementing the same access control policy, to perform an access control step between said first and second entities as a function of said same access control policy. ### Claim 17 (depends on 1) A computer having stored thereon a program including instructions for executing the method according to claim 1. ### Claim 18 (depends on 1) A non-transitory computer readable data medium having stored thereon instructions for executing the method according to claim 1 when said instructions are executed by a computer. ### Claim 19 (depends on 3) A method according to claim 3, wherein the access control policies are incompatible. ### Claim 20 (depends on 6) A processor according to claim 6, wherein the access control policies are incompatible.