Method and system for session based authorization and access control for networked application objects

An ingress-session-based authorization and access control data processing system to control access from an initiator-host to objects on a target host comprising:

• means to receive an access-request originally coming from the initiator-host, that references an object on the target host to access,
• means to assign the access-request to an ingress-session and selecting a session-context belonging to that ingress-session,
• means to check whether the access to the referenced object is authorized in the selected session-context or not, that deny the access to the referenced object if the access to said object on the target host is not authorized in the selected session-context and that grants the access to the referenced object if the access to said object on the target host is allowed in the selected session-context,
• means that hand over references to objects on the target host to the initiator-host as a response to a granted access-request, and
• means that authorize objects the reference is handed over for, for access under the handed over reference in that session-context the already granted access request is assigned to.

A computer-readable storage medium having stored thereon instructions to cause a processor to execute an ingress-session-based authorization and access control method in a data processing system to control access from an initiator-host to objects on a target host, the method comprising:

• (i) receiving an access-request originally coming from the initiator-host, that references an object on the target host to access,
• (ii) assigning the access-request to an ingress-session and selecting a session-context belonging to that ingress-session,
• (iii) checking whether the access to the referenced object is authorized in the selected session-context or not,
• (iv) denying the access to the referenced object if the access to said object on the target host is not authorized in the selected session-context,
• (v) granting the access to the referenced object if the access to said object on the target host is allowed in the selected session-context,
• (vi) handing over references to objects on the target host to the initiator host as a response to a granted access-request, and
• (vii) authorizing the handed over references for access in that session-context.