Access control system, a rule engine adaptor, a rule-based enforcement platform and a method for performing access control

A rule engine adaptor applicable for access control to at least one information resource associated with at least one application within a computer network, the rule engine adaptor acting as intermediary in communication between a rule engine and various application specific context sources and an application specific constraint enforcement point, respectively, the rule engine adaptor further comprising:

• a. a context converter component providing an access to the rule engine adaptor for the various context sources which provide context information, and acting as intermediary in communication of the rule engine with any one of the context sources, the context converter translating the context information originating from one of the various context sources into facts that can be interpreted and correlated with rules by the rule engine;
• b. a constraint converter component acting as intermediary in communication of the rule engine with a constraint specification console which provides an interface to specify application specific constraints based on the context sources so as to enable the rule engine to enforce constraints when the context sources update their respective context information;
• and
• c. a query converter component providing an access to the rule engine adaptor for the constraint enforcement point and acting as intermediary in communication of the rule engine with the constraint enforcement point so as to enable the constraint enforcement point to make access decisions in reaction to a certain query.

A rule-based enforcement platform applicable for access control to at least one information resource associated with at least one application within a computer network, the platform comprising:

• a. a rule engine being capable of handling facts and applying inference rules on those facts, the rule engine storing the rules;
• b. a constraint specification console providing an interface to specify application specific constraints based on agreed-upon application specific context sources;
• and
• c. a rule engine adaptor providing an access point to the constraint specification console so as to be capable of forwarding constraints specified within the constraint specification console to the rule engine so that the constraints get stored in the rule engine as a set of rules, uniform access points for application specific context sources to access the platform so as to enable the application specific context sources to communicate with the rule engine such that context information provided by the context sources being expressed as facts within the rule engine and an access point for an application specific constraint enforcement point to access the platform so as to allow access control to the at least one information resource based on the application specific constraints with regard to context information originating from the context sources.

A computer-implemented method for performing access control to at least one information resource associated with at least one application within a computer network, the computer-implemented method comprising:

• receiving identified application relevant context sources;
• receiving specified constraints, specified by means of a constraint specification console, the constraints being based on context information that are provided by the identified relevant context sources;
• translating the specified constraints into rules understandable by an appropriate rule engine;
• forwarding the translated constraints to the rule engine so that the translated constraints get stored in the rule engine as a set of rules;
• translating, at runtime by means of a rule engine adaptor, context information originating from the identified relevant context sources into facts that can be interpreted and appropriately correlated with the respective rules by and stored in the rule engine;
• and
• querying such facts, in case of need, by means of an application specific constraint enforcement point from the rule engine via the rule engine adaptor so as to enable the constraint enforcement point to make appropriate enforcement decisions.

A computer program product with a computer-readable storage medium and a computer program stored on the computer-readable storage medium suitable for carrying out a computer-implemented method when the computer program is run on a computer, the computer implemented method comprising:

• receiving identified application relevant context sources;
• receiving specified constraints, specified by means of a constraint specification console, the constraints being based on context information that are provided by the identified relevant context sources;
• translating the specified constraints into rules understandable by an appropriate rule engine;
• forwarding the translated constraints to the rule engine so that the translated constraints get stored in the rule engine as a set of rules;
• translating, at runtime by means of a rule engine adaptor, context information originating from the identified relevant context sources into facts that can be interpreted and appropriately correlated with the respective rules by and stored in the rule engine;
• and
• querying such facts, in case of need, by means of an application specific constraint enforcement point from the rule engine via the rule engine adaptor so as to enable the constraint enforcement point to make appropriate enforcement decisions.

A computer-readable storage medium with a computer program stored thereon, the computer program comprising a program code which is suitable for carrying out a computer-implemented method when the computer program is run on a computer, the computer-implemented method comprising:

• receiving identified application relevant context sources;
• receiving specified constraints, specified by means of a constraint specification console, the constraints being based on context information that are provided by the identified relevant context sources;
• translating the specified constraints into rules understandable by an appropriate rule engine;
• forwarding the translated constraints to the rule engine so that the translated constraints get stored in the rule engine as a set of rules;
• translating, at runtime by means of a rule engine adaptor, context information originating from the identified relevant context sources into facts that can be interpreted and appropriately correlated with the respective rules by and stored in the rule engine;
• and
• querying such facts, in case of need, by means of an application specific constraint enforcement point from the rule engine via the rule engine adaptor so as to enable the constraint enforcement point to make appropriate enforcement decisions.