Hybrid access control resource management

A method for implementing hybrid access control management for stored resources, the method comprising:

• receiving a request from a user account to access an access-controlled resource;
• determining a protection mechanism of the access-controlled resource, wherein the protection mechanism is an attribute-based protection mechanism or a role-based protection mechanism;
• validating the request from the user account based on the determination of the protection mechanism, wherein validating the request comprises:
• in response to determining that the protection mechanism is a role-based protection mechanism:
• determining a role of the user account, wherein the role of the user account is assigned automatically based on data of the user account, and wherein the role of the user account is updated dynamically as the data of the user account is updated;
• and
• validating the role of the user account against a role-based access control policy describing one or more roles permitted to access the access-controlled resource;
• and
• in response to determining that the protection mechanism is an attribute-based protection mechanism:
• retrieving attributes associated with an attribute-based access control policy describing attribute values permitted to access the access-controlled resource;
• and
• validating the retrieved attributes against the attribute-based access control policy, wherein the attributes and the data of the user account for determining the role of the user account are stored in a policy information point database;
• and
• permitting the user account to access the access-controlled resource upon successful validation of the request.

A computing system for implementing hybrid access control management, the computing system comprising:

• a processing circuitry coupled to memory that stores instructions, which, upon execution by the processing circuitry, cause the processing circuitry to:
• receive a first request to access an attribute-based managed resource;
• retrieve attributes associated with an attribute-based access control policy describing attributes permitted to access the attribute-based managed resource;
• permit access to the attribute-based managed resource upon validation of the retrieved attributes against the attribute-based access control policy;
• receive a second request to access a role-based managed resource;
• determine a role of a user account providing the second request, wherein the role of the user account is assigned automatically based on data of the user account, wherein the role of the user account is updated dynamically as the data of the user account is updated, and wherein the attributes and the data of the user account for determining the role of the user account are stored in a policy information point database;
• and
• permit access to the role-based managed resource upon validation of the determined role against a role-based access policy describing one or more roles permitted to access the role-based managed resource.