US 2023/0421609 A1Published application

Organization based access control with boundary access policies

AssigneeOracle International Corporation

InventorsVaibhav Shrivastava, Natalie Shuchyng You, Somyajit Jena, Brajendra Bhujabal, Rajan Madhavan

Life of this patent

Estimating the term…

Loading patent…

Abstract

An organization-based access control (OBAC) system defines resource access rights using graph-based team node trees, each comprising a plurality of hierarchically-connected team nodes. Each team node is associated with a list of members, team resources, and a team-specific access policy that defines the rights of team members to access the team resources. When a node in a tree has one or more descendant nodes, boundary access policies can be generated to define rights, of members of the node, to access resources associated with descendant nodes. Such boundary access policies may grant parent team members different access rights for child team resources than is granted to the child team members. A node management policy can grant rights to manage a portion of a team node tree. Team-specific access policies, boundary access policies, and management policies can include unique references to one or more particular resources, resource attributes, or groups of resources.

Claims20

Dependent claims

A computer-executed method for filesystem access control, comprising:

maintaining graph data comprising a team node tree that comprises a plurality of team nodes and one or more hierarchical relationships between the plurality of team nodes, each team node of the plurality of team nodes being associated with:
(a) one or more users in a represented team,
(b) a set of resources for the represented team,
(c) a team node-specific set of policies that define rights of the one or more users to access the set of resources for the represented team, and
(d) one or more other team nodes as either a parent node or child node of each of the one or more other team nodes;
for each team node of a set of parent team nodes in the team node tree, determining an effective access policy, for said each team node, comprising:
the team node-specific set of policies for said each team node, and
one or more boundary access policies that define rights for the one or more users of said each team node to access a set of child resources comprising one or more sets of resources associated with child nodes of said each team node;
detecting an instruction, from a particular user that is associated with a particular team node of the team node tree, to perform an access operation, of a particular type, on a particular resource that is associated with a particular child team node of the particular team node;
responsive to detecting the instruction:
determining that the particular user has the right to perform the particular type of access operation on the particular resource based, at least in part, on information from the effective access policy for the particular team node, and
responsive to determining that the particular user has the right to perform the particular type of access operation on the particular resource, causing performance of the access operation instructed by the instruction;
wherein the method is performed by one or more computing devices.

10 more elements

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause:

maintaining graph data comprising a team node tree that comprises a plurality of team nodes and one or more hierarchical relationships between the plurality of team nodes, each team node of the plurality of team nodes being associated with:
(a) one or more users in a represented team,
(b) a set of resources for the represented team,
(c) a team node-specific set of policies that define rights of the one or more users to access the set of resources for the represented team, and
(d) one or more other team nodes as either a parent node or child node of each of the one or more other team nodes;
for each team node of a set of parent team nodes in the team node tree, determining an effective access policy, for said each team node, comprising:
the team node-specific set of policies for said each team node, and
one or more boundary access policies that define rights for the one or more users of said each team node to access a set of child resources comprising one or more sets of resources associated with child nodes of said each team node;
detecting an instruction, from a particular user that is associated with a particular team node of the team node tree, to perform an access operation, of a particular type, on a particular resource that is associated with a particular child team node of the particular team node;
responsive to detecting the instruction:
determining that the particular user has the right to perform the particular type of access operation on the particular resource based, at least in part, on information from the effective access policy for the particular team node, and
responsive to determining that the particular user has the right to perform the particular type of access operation on the particular resource, causing performance of the access operation instructed by the instruction.

9 more elements

Dependencies are inferred from the claim text.