Access control for an e-commerce application

A method for selectively granting access to a target object, comprising:

• receiving a context comprising an actor attribute, an action attribute, and a target attribute;
• determining a first set of hierarchically broader actor attributes based on the actor attribute;
• determining a second set of hierarchically broader action attributes based on the action attribute;
• determining a third set of hierarchically broader target attributes based on the target attribute;
• determining a set of relevant access control instructions according to the actor, action, and target attributes and the first, second, and third sets of hierarchically broader relevant attributes and;
• determining whether any of the set of relevant access control instructions are conflicting access control instructions and, when conflicting instructions are found, resolving access control instruction conflicts by determining whether access control instruction access attribute values for the first, second, and third set of access control instructions conflict with either each other or a default access value and responsive to determining that any access control instruction value denies access to the target object including the default access value, denying access to the target object.

A computer program product, comprising a computer readable medium having computer code embodied therein for selectively granting access to a target object comprising:

• a computer readable program code device configured as an object data store comprised of a plurality of hierarchically structured target objects and a plurality of hierarchically structured actor objects;
• a computer readable program code device configured as an access control instruction data store comprising a plurality of hierarchically structured access control instructions;
• a computer readable program code device configured as an action data store comprising a plurality action objects
• a computer readable program code device configured as a context comprising an actor attribute, an action attribute, and a target attribute;
• and
• an access determination engine configured to selectively grant access to the target object based on a first set of access control instructions having attributes that match the context and a second set of access control instructions having attributes that are hierarchically broader than the attributes of the context, wherein the access determination engine determines whether any of the first set of access control instructions conflict with any of the second set of access control instructions and, when conflicting instructions are found, resolving access control instruction conflicts by determining whether access control instruction access attribute values for the first and second set of access control instructions conflict with either each other or a default access value and responsive to determining that any access control instruction value denies access to the target object including the default access value, denying access to the target object.

A system for selectively granting access to a target object, comprising;

• means for receiving a context comprising an actor attribute, an action attribute, and a target attribute;
• means for determining a first set of hierarchically broader actor attributes based on the actor attribute;
• means for determining a second set of hierarchically broader action attributes based on the action attribute;
• means for determining a third set of hierarchically broader target attributes based on the target attribute;
• means for determining a set of relevant access control instructions according to the actor, action, and target attributes and the first, second, and third sets of hierarchically broader relevant attributes;
• and
• means for determining whether any of the set of relevant access control instructions are conflicting access control instructions and, when conflicting instructions are found, resolving access control instruction conflicts by determining whether access control instruction access attribute values for the first and second set of access control instructions conflict with either each other or a default access value and responsive to determining that any access control instruction value denies access to the target object including the default access value, denying access to the target object.

A computer program product comprising a computer useable medium having computer readable code embodied therein selectively granting access to a target object, the computer program product adapted when run on a computer to execute steps, including:

• receiving a context comprising an actor attribute, an action attribute, and a target attribute;
• determining a first set of hierarchically broader actor attributes based on the actor attribute;
• determining a second set of hierarchically broader action attributes based on the action attribute;
• determining a third set of hierarchically broader target attributes based on the target attribute;
• determining a set of relevant access control instructions according to the actor action, and target attributes and the first, second and third sets of hierarchically broader relevant attributes;
• and
• determining whether any of the set of relevant access control instructions are conflicting access control instructions and, when conflicting instructions are found, resolving access control instruction conflicts by determining whether access control instruction access attribute values for the first, second, and third set of access control instructions conflict with either each other or a default access value and responsive to determining that any access control instruction value denies access to the target obiect including the default access value, denying access to the target obiect.