Local evaluation of runtime authorization rules derived from externally-derived policy
AssigneeInternational Business Machines Corporation
InventorsRichard James McCarty, Pradeep Kadiyala
Life of this patent
Estimating the term…
Abstract
An application-centric authorization model utilizes locally-evaluated rules derived from non-local policies and provided to the application via an authorization object, preferably in the subject's session context. Preferably, the approach does not involve a runtime determination regarding the policy or policies; rather, one or more existing policies are merely used to derive authorization rules associated with a subject, and which are then evaluated and enforced at runtime in a computationally-efficient manner within the local runtime context of the application or service.
Claims24
A method to perform an authorization in association with an application, comprising:
- receiving from the application a request for which an authorization decision is required;
- in response to receipt of the request, evaluating identity information against one or more authorization rules that are configured according to a local, runtime application context, the one or more authorization rules having been derived by a policy service from a policy;
- and
- returning to the application an authorization decision, wherein the authorization decision is made during runtime execution and based on evaluating the authorization rules in lieu of the policy.
Apparatus, comprising:
- at least one hardware processor;
- computer memory holding computer program instructions executed by the at least one hardware processor to perform an authorization in association with an application, the computer program instructions comprising program code configured to:
- receive from the application a request for which an authorization decision is required,
- in response to receipt of the request, evaluate identity information against one or more authorization rules that are configured according to a local, runtime application context, the one or more authorization rules having been derived by a policy service from a policy;
- and
- return to the application an authorization decision, wherein the authorization decision is made during runtime execution and based on evaluating the authorization rules in lieu of the policy.
A computer program product in a non-transitory computer-readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the data processing system to perform an authorization in association with an application, the computer program instructions comprising program code configured to:
- receive from the application a request for which an authorization decision is required,
- in response to receipt of the request, evaluate identity information against one or more authorization rules that are configured according to a local, runtime application context, the one or more authorization rules having been derived by a policy service from a policy;
- and
- return to the application an authorization decision, wherein the authorization decision is made during runtime execution and based on evaluating the authorization rules in lieu of the policy.
Dependencies are inferred from the claim text.