Method and apparatus for efficiently caching a system-wide access control list

An apparatus for efficiently caching a system-wide access control entry for a subject requesting an action on an object associated with an application, comprising:

• a security-class retrieval mechanism configured to retrieve a security class associated with the application;
• a cache lookup mechanism configured to determine if a constrained system-wide access control entry associated with the subject, the requested action, and the security class exists in a cache and then retrieve the constrained system-wide access control entry from the cache;
• a system-wide retrieval mechanism configured to retrieve a system-wide access control entry associated with the subject and the requested action;
• a local retrieval mechanism configured to retrieve a local access control entry associated with the subject, the object, the requested action, and the security class;
• a constraining mechanism configured to constrain the system-wide access control entry with the local access control entry;
• and
• a caching mechanism configured to cache the constrained system-wide access control entry so that the constrained system-wide access control entry is associated with the subject, the requested action, and the security class.

A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for efficiently caching a system-wide access control entry for a subject requesting an action on an object which is associated with an application, the method comprising:

• retrieving a security class associated with the application;
• if a constrained system-wide access control entry associated with the subject, the requested action, and the security class exists in a cache, retrieving the constrained system-wide access control entry from the cache;
• otherwise,
• retrieving a system-wide access control entry associated with the subject and the requested action;
• retrieving a local access control entry associated with the subject, the object, the requested action, and the security class;
• constraining the system-wide access control entry with the local access control entry;
• and
• caching the constrained system-wide access control entry so that the constrained system-wide access control entry is associated with the subject, the requested action, and the security class.