US 2016/0110553 A1Published application

Policy access control lists attached to resources

AssigneeInternational Business Machines Corporation

InventorsMICHAEL FACTOR, Elliot K. KOLODNER, ALEXANDRA SHULMAN-PELEG

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, storage systems and computer program products implement embodiments of the present invention that include defining, for an entity, a policy access control list including one or more access rules, each of the access rules including one or more user conditions and one or more entity conditions. Upon receiving a request from a user to access a given entity, one or more user attributes associated with the user and one or more entity attributes associated with the given entity are identified. For each of the access rules, the one or more user conditions are applied to the one or more user attributes, the one or more entity conditions are applied to the one or more entity attributes. Access to the given content entity is granted to the user upon determining that a minimum threshold of the one or more user conditions and the one or more entity conditions are met.

Claims20

Dependent claims

A method, comprising:

defining, by a storage system for a plurality of entities, a policy access control list (PACL) comprising one or more access rules, each of the access rules comprising one or more user conditions and one or more entity conditions, wherein the plurality of entities comprise a context entity and a content entity;
receiving, from a user, a request to access a given entity;
identifying, by the storage system, one or more user attributes associated with the user;
identifying one or more entity attributes associated with the given entity;
for each of the one or more access rules, applying, the one or more user conditions to the one or more user attributes, and applying the one or more entity conditions to the one or more entity attributes;
granting, to the user, access to the given content entity upon determining that a minimum threshold of the one or more user conditions and the one or more entity conditions are met;
and
providing, by the context entity, context to multiple content entities, and wherein the entity comprises entities comprise a given content entity, and wherein the entity attributes comprise content entity attributes,
wherein each of the entity attributes is selected from a list comprising a context entity attribute and a content entity attribute, and wherein the PACL comprises a context PACL, and wherein each of the user conditions comprises a context user condition, and wherein each of the entity conditions comprises a context entity condition,
wherein the PACL comprises a content PACL, and wherein each of the user conditions comprises an additional content user condition, and wherein each of the entity conditions comprises a content entity condition,
wherein granting access to the given entity comprises migrating the given content entity from a first storage system to a second storage system, and
wherein the PACL comprises one or more entity migration conditions and one or more entity migration rules, and wherein migrating the given entity comprises using the one or more entity migration conditions and the one or more entity migration rules.

9 more elements

A storage system, comprising:

a storage device configured to store a plurality of entities, and a policy access control list (PACL) comprising one or more access rules, each of the access rules comprising one or more user conditions and one or more entity conditions, wherein the plurality of entities comprise a context entity and a content entity;
and
a processor configured:
to receive, from a user, a request to access a given entity;
to identify one or more user attributes associated with the user;
to identify one or more entity attributes associated with the given entity;
for each of the one or more access rules, to apply, the one or more user conditions to the one or more user attributes, and to apply the one or more entity conditions to the one or more entity attributes;
to grant, to the user, access to the given content entity upon determining that a minimum threshold of the one or more user conditions and the one or more entity conditions are met;
and
to provide, by the context entity, context to multiple content entities, and wherein the entity comprises entities comprise a given content entity, and wherein the entity attributes comprise content entity attributes,
wherein each of the entity attributes is selected from a list comprising a context entity attribute and a content entity attribute, and wherein the PACL comprises a context PACL, and wherein each of the user conditions comprises a context user condition, and wherein each of the entity conditions comprises a context entity condition,
wherein the PACL comprises a content PACL, and wherein each of the user conditions comprises an additional content user condition, and wherein each of the entity conditions comprises a content entity condition,
wherein the processor is configured to grant access to the given entity by migrating the given content entity from a first storage system to a second storage system, and
wherein the PACL comprises one or more entity migration conditions and one or more entity migration rules, and wherein the processor is configured to migrate the given entity by using the one or more entity migration conditions and the one or more entity migration rules.

11 more elements

A computer program product, the computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to define, for a plurality of entities, a policy access control list (PACL) comprising one or more access rules, each of the access rules comprising one or more user conditions and one or more entity conditions, wherein the plurality of entities comprise a context entity and a content entity;
computer readable program code configured to receive, from a user, a request to access a given entity;
computer readable program code configured to identify, by the storage system, one or more user attributes associated with the user;
computer readable program code configured to identify one or more entity attributes associated with the given entity;
computer readable program code configured, for each of the one or more access rules, to apply, the one or more user conditions to the one or more user attributes, and to apply the one or more entity conditions to the one or more entity attributes;
computer readable program code configured to grant, to the user, access to the given content entity upon determining that a minimum threshold of the one or more user conditions and the one or more entity conditions are met;
and
computer readable program code configured to provide, by the context entity, context to multiple content entities, and wherein the entity comprises entities comprise a given content entity, and wherein the entity attributes comprise content entity attributes,
wherein each of the entity attributes is selected from a list comprising a context entity attribute and a content entity attribute, and wherein the PACL comprises a context PACL, and wherein each of the user conditions comprises a context user condition, and wherein each of the entity conditions comprises a context entity condition,
wherein the PACL comprises a content PACL, and wherein each of the user conditions comprises an additional content user condition, and wherein each of the entity conditions comprises a content entity condition,
wherein the computer readable program code is configured to grant access to the given entity by migrating the given content entity from a first storage system to a second storage system, and
wherein the PACL comprises one or more entity migration conditions and one or more entity migration rules, and wherein the computer readable program code is configured to migrate the given entity by using the one or more entity migration conditions and the one or more entity migration rules.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/517,952Filed 20 Oct 2014
Published: 21 Apr 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/101
For controlling access to devices or network resources: access control lists [ACL]
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 63/102
For controlling access to devices or network resources: entity profiles
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general