Automated access policy translation
AssigneeMicrosoft Corporation
InventorBronislav Kavsan
Life of this patent
Estimating the term…
Abstract
The use of one resource access policy to populate a second resource access policy. One of more fields of the first resource access policy are each to be used to populate corresponding one or more fields of the second resource access policy. After identifying the field(s) of the first resource access policy, and identifying their corresponding field of the second resource access policy, the information from the source fields of the first resource access policy are then used to populate the destination fields of the second resource access policy. This may be done in an automated fashion thereby allowing for at least the possibility of the transition from one type of resource access security to another.
Claims10
A computer program product comprising one or more computer-readable storage devices having thereon computer-executable instructions that, when executed by one or more processors of a computing system, causes the computing system to perform a method for automated access policy translation, the method comprising:
- an act of accessing a first resource access policy comprised of an access control list (ACL) having a plurality of access control elements, each element having one or more data fields that define an access permission associated with a resource, and a principal to which the associated permission is to be applied;
- an act of accessing a second resource policy comprised of a hierarchically structured data structure;
- an act of identifying one or more data fields of the first resource access policy that are to be used to populate at least a portion of the hierarchical data structure of the second resource access policy;
- for each of the one or more identified data fields of the first resource access policy, an act of identifying an appropriate corresponding one or more positions within the hierarchical data structure of the second resource access policy which are to be populated by the identified one or more data fields from the ACL of the first resource access policy;
- and
- for each of the one or more identified data fields in the ACL of the first resource access policy, an act of copying the identified one or more data fields into the corresponding one or more positions within the hierarchical data structure of the second resource access policy in order to automatically populate the corresponding one or more positions within the hierarchical data structure of the second resource access policy.
A computerized method for automated access policy translation comprising:
- an act of accessing a first resource access policy comprised of an access control list (ACL) having a plurality of access control elements, each element having one or more data fields that define an access permission associated with a resource, and a principal to which the associated permission is to be applied, and at least one of the access control elements of the ACL having an issuer field that identifies an entity that asserts membership in a particular group;
- an act of accessing a second resource policy comprised of a hierarchically structured data structure;
- an act of identifying one or more data fields of the first resource access policy that are to be used to populate at least a portion of the hierarchical data structure of the second resource access policy;
- for each of the one or more identified data fields of the first resource access policy, an act of identifying an appropriate corresponding one or more positions within the hierarchical data structure of the second resource access policy which are to be populated by the identified one or more data fields from the ACL of the first resource access policy;
- and
- for each of the one or more identified data fields in the ACL of the first resource access policy, an act of copying the identified one or more data fields into the corresponding one or more positions within the hierarchical data structure of the second resource access policy in order to automatically populate the corresponding one or more positions within the hierarchical data structure of the second resource access policy.
Dependencies are inferred from the claim text.