# US 2013/0160108 A1 · Extensible and/or distributed authorization system and/or methods of providing the same

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2013/0160108 A1
- Document ID: US20130160108A1
- Status: Published application
- Kind: A1
- Application number: 13/328,209
- Filed: 2011-12-16
- Published: 2013-06-20
- Earliest claimed: 2011-12-16
- Assignees: Software AG
- Inventors: Michael STACHEL
- Web page: https://patentgrep.com/patent/US20130160108A1

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/31: User authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In certain example embodiments, an extensible and/or distributed security system is provided. In certain example embodiments the security system provides authorization to a resource of a first application. In the first application, a security context is created and a client is authenticated to the first application. A request is accepted in the first application to access at least on resource. The first application communicates with an authorization application to determine authorization to the at least one resource. In the authorization application, an authorization process is executed which communicates with another application that defines a step of the authorization process for this resource. Based on that step, it is determined whether the first application allows access to the at least one resource for the client.

## Claims

### Claim 1

A computer-implemented method of providing distributed authorization in a processing system including at least one processor and a memory for executing plural software applications, the method comprising:
creating a security context for a client of a first application executable in the processing system;
in the first application:
accepting a connection from the client to the first application;
authenticating the client to the first application;
accepting a request from the client to access at least one resource of the first application executable in the processing system;
in response to the request, communicating with a second application to determine whether the authenticated client is authorized to access the at least one resource;
in the second application:
executing, via the at least one processor of the processing system, an authorization process based on the communication from the first application and the created security context; and
for at least one step within the authorization process, communicating with another application that is not the second application, in order to determine whether the client is allowed to access the at least one resource,
wherein the first application allows access to the at least one resource based on a result of the authorization process executed within the second application.

### Claim 2 (depends on 1)

The method of claim 1, wherein the another application is the first application.

### Claim 3 (depends on 1)

The method of claim 1, wherein the another application is a third application that is different from the first application.

### Claim 4 (depends on 3)

The method of claim 3, wherein the first application is not directly linked to, and does not directly communicate with, the another application.

### Claim 5 (depends on 4)

The method of claim 4, wherein the another application is directly linked to, and communicates directly with, only the second application.

### Claim 6 (depends on 5)

The method of claim 5, wherein the second application is programmed to receive a plurality of authorization requests for resources within the processing system from a plurality of different software applications.

### Claim 7

An authorization system for granting access to a resource of a computing application, the system comprising:
a storage medium that is configured to store a three part permission structure that is associated with the resource, the three part permission structure including:
a first part that includes a domain or type of the resource,
a second part that defines at least one action that is done on the resource, and
a third part that includes a regular expression that, upon evaluation, produces output including an indication of the resource; and
a processing system that includes at least one processor, the processing system being configured to evaluate an authorization request to the resource based on the three part permission structure.

### Claim 8 (depends on 7)

The system of claim 7, wherein the third part includes an identifier of another, second resource.

### Claim 9 (depends on 7)

The system of claim 7, wherein the first, second, and/or third part(s) of the three part permission structure includes an identifier that allows for any matches associated with the respective part that includes the identifier.

### Claim 10 (depends on 7)

The system of claim 7, wherein the third part of the three part permission structure includes an identifier that indicates no resource identifiers are allowed.

### Claim 11

A computer implemented method of evaluating an authorization request in an authorization application on a processing system including at least one processor and a memory, where the authorization request is made from a first computing application, the method comprising:
receiving the authorization request from the first computing application;
creating a security context based on the authorization request, the security context including information on: a requesting client; a resource associated with the request, and at least one permission associated with the resource;
retrieving at least one rule that is associated with a callback function that calls an authentication process that is defined in a second computing application;
building an abstract syntax tree based on the security context and the at least one rule;
evaluating the abstract syntax tree;
performing a callback to the authentication process defined in the second computing application during the evaluation of the abstract syntax tree;
returning a result of the authorization request based on the evaluation of the abstract syntax tree to the first computing application.

### Claim 12 (depends on 11)

The method of claim 11, wherein the second computing application and the first computing application are the same application.

### Claim 13 (depends on 11)

The method of claim 11, wherein the second computing application is different from the first computing application.

### Claim 14 (depends on 13)

The method of claim 13, wherein the first computing application is not directly linked to, and does not directly communicate with, the second computing application.

### Claim 15 (depends on 14)

The method of claim 14, wherein the second computing application is directly linked to, and communicates directly with, only the authorization application.

### Claim 16 (depends on 15)

The method of claim 15, further comprising receiving a plurality of authorization requests related to resources within the processing system from a plurality of different software applications.

### Claim 17 (depends on 11)

The method of claim 11, wherein the at least one permission associated with the resource is defined in a three-part permission structure that includes:
a first part that includes a domain or type of the resource,
a second part that defines at least one action that the requesting client is to perform on the resource, and
a third part that includes a regular expression that, upon evaluation, produces output including an indication of the resource.

### Claim 18 (depends on 17)

The method of claim 17, wherein the third part includes an identifier of another, second resource.

### Claim 19 (depends on 18)

The method of claim 18, wherein the first, second, and/or third part of the three part permission structure includes an identifier that allows for any matches associated with the respective part that includes the identifier.

### Claim 20 (depends on 19)

The method of claim 19, wherein the third part of the three part permission structure includes an identifier that indicates no resource identifiers are allowed.

### Claim 21 (depends on 1)

A non-transitory computer readable storage medium tangibly storing instructions that, when executed by a processor of a computer, perform the method according to claim 1.

### Claim 22 (depends on 11)

A non-transitory computer readable storage medium tangibly storing instructions that, when executed by a processor of a computer, perform the method according to claim 11.

### Claim 23

A computer-implemented method of providing distributed authorization, the method comprising the following steps performed by a second application:
receiving a communication from a first application, wherein the communication from the first application comprises a security context for a client, wherein the security context comprises information on the client, at least one resource of the first application, and at least one permission associated with the at least one resource; and
executing an authorization process based on the communication from the first application and the security context in order to determine whether the client is allowed to access the at least one resource of the first application.

### Claim 24 (depends on 23)

The method of claim 23, further comprising for at least one step within the authorization process, communicating with another application that is not the second application, in order to determine whether the client is allowed to access the at least one resource.

### Claim 25 (depends on 24)

The method of claim 24, wherein the another application is the first application or a third application that is different from the first application.

### Claim 26 (depends on 24)

The method of claim 24, wherein the first application is not directly linked to, and does not directly communicate with, the another application.

### Claim 27 (depends on 24)

The method of claim 24, wherein the another application is directly linked to, and communicates directly with, only the second application.

### Claim 28 (depends on 23)

The method of claim 23, wherein the second application is programmed to receive a plurality of authorization requests for resources within a processing system from a plurality of different software applications.

### Claim 29

A computer-implemented method of providing distributed authorization, the method comprising the following steps performed by a first application:
accepting a connection from a client to the first application;
authenticating the client to the first application;
accepting a request from the client to access at least one resource of the first application; and
in response to the request, communicating with a second application to determine whether the authenticated client is authorized to access the at least one resource;
wherein the communication with the second application comprises a security context for the client, wherein the security context comprises information on the client, the at least one resource associated with the request, and at least one permission associated with the at least one resource.

### Claim 30 (depends on 29)

The method of claim 29, further comprising:
retrieving at least one rule that is associated with a callback function that calls an authentication process that is defined in the second computing application;
building an abstract syntax tree based on the security context and the at least one rule;
evaluating the abstract syntax tree;
performing a callback to the authentication process defined in the second computing application during the evaluation of the abstract syntax tree; and
returning a result of the authorization request based on the evaluation of the abstract syntax tree to the first computing application.

### Claim 31 (depends on 23)

The method of claim 23, wherein the security context is a three part permission structure that is associated with the at least one resource, the three part permission structure including:
a first part that includes a domain or type of the resource,
a second part that defines at least one action that is done on the resource, and
a third part that includes a regular expression that, upon evaluation, produces output including an indication of the resource.

### Claim 32 (depends on 31)

The method of claim 31, wherein the third part includes an identifier of another, second resource.

### Claim 33 (depends on 31)

The method of claim 31, wherein the first, second, and/or third part(s) of the three part permission structure includes an identifier that allows for any matches associated with the respective part that includes the identifier.

### Claim 34 (depends on 31)

The system of claim 31, wherein the third part of the three part permission structure includes an identifier that indicates no resource identifiers are allowed.

### Claim 35 (depends on 23)

A system for providing distributed authorization, adapted for performing a method in accordance with claim 23.

### Claim 36 (depends on 29)

A system for providing distributed authorization, adapted for performing a method in accordance with claim 29.

### Claim 37

(canceled)