Back to results
US 8,555,378 B2Granted
Authorization caching in a multithreaded object server
AssigneeSAS Institute Inc.
InventorsBrian Payton Bowman, John Forrest Boozer
Life of this patent
Estimating the term…
Abstract
Systems and methods are included for accessing resource objects in a multi-threaded environment. A request is received from a requester to perform an operation with respect to a resource object, where the requested resource object has multiple associations with other objects. A determination as to whether an authorization cache entry corresponding to the requested resource object contains sufficient permission data for granting or denying the request for access to the requested resource object is made. A grant or deny of access to the requested resource object is returned when the authorization cache entry corresponding to the requested resource object contains sufficient permission data.
Claims69
A computer-implemented method, comprising:
- accessing a resource object having an identifier, wherein the resource object has multiple associations with other objects;
- receiving a first request to provide a first requesting entity with a first indicated type of access to the resource object;
- searching an authorization cache index using the identifier, wherein searching includes determining whether an authorization cache entry for the resource object exists;
- generating, on a computing device, a new authorization cache entry for the resource object, wherein generating a new authorization cache entry includes:
- identifying objects related to the resource object through direct access control associations, wherein a direct access control association has a corresponding access control entry object;
- and
- generating a table, wherein the table includes an identity and access permission status for each of one or more associated objects, and wherein the new authorization cache entry includes the generated table;
- determining whether the new authorization cache entry grants or denies the first indicated type of access to the first requesting entity;
- providing the first indicated type of access to the first requesting entity based on determining that the new authorization cache entry grants the first indicated type of access to the first requesting entity;
- subsequent to providing the first indicated type of access, receiving a second request to provide a second requesting entity with a second indicated type of access to the resource object;
- determining that the new authorization cache entry neither grants nor denies the second indicated type of access to the second requesting entity;
- and
- in response to determining that the new authorization cache entry neither grants nor denies the second indicated type of access, accessing a cache entry for a parent object of the resource object.
10 more elements
A computer-program product tangibly embodied in a non-transitory machine readable storage medium, and including instructions configured to cause a data processing apparatus to perform operations including:
- accessing a resource object having an identifier, wherein the resource object has multiple associations with other objects;
- receiving a first request to provide a first requesting entity with a first indicated type of access to the resource object;
- searching an authorization cache index using the identifier, wherein searching includes determining whether an authorization cache entry for the resource object exists;
- generating a new authorization cache entry for the resource object, wherein generating a new authorization cache entry includes:
- identifying objects related to the resource object through direct access control associations, wherein a direct access control association has a corresponding access control entry object;
- and
- generating a table, wherein the table includes an identity and access permission status for each of one or more associated objects, and
- wherein the new authorization cache entry includes the generated table;
- determining whether the new authorization cache entry grants or denies the first indicated type of access to the first requesting entity;
- providing the first indicated type of access to the first requesting entity based on determining that the new authorization cache entry grants the first indicated type of access to the first requesting entity;
- subsequent to providing the first indicated type of access, receiving a second request to provide a second requesting entity with a second indicated type of access to the resource object;
- determining that the new authorization cache entry neither grants nor denies the second indicated type of access to the second requesting entity;
- and
- in response to determining that the new authorization cache entry neither grants nor denies the second indicated type of access, accessing a cache entry for a parent object of the resource object.
11 more elements
A system, comprising:
- one or more data processors;
- and
- one or more non transitory computer-readable storage media containing instructions configured to cause the one or more processors to perform operations including:
- accessing a resource object having an identifier, wherein the resource object has multiple associations with other objects;
- receiving a first request to provide a first requesting entity with a first indicated type of access to the resource object;
- searching an authorization cache index using the identifier, wherein searching includes determining whether an authorization cache entry for the resource object exists;
- generating a new authorization cache entry for the resource object, wherein generating a new authorization cache entry includes:
- identifying objects related to the resource object through direct access control associations, wherein a direct access control association has a corresponding access control entry object;
- and
- generating a table, wherein the table includes an identity and access permission status for each of one or more associated objects, and
- wherein the new authorization cache entry includes the generated table;
- determining whether the new authorization cache entry grants or denies the first indicated type of access to the first requesting entity;
- providing the first indicated type of access to the first requesting entity based on determining that the new authorization cache entry grants the first indicated type of access to the first requesting entity;
- subsequent to providing the first indicated type of access, receiving a second request to provide a second requesting entity with a second indicated type of access to the resource object;
- determining that the new authorization cache entry neither grants nor denies the second indicated type of access to the second requesting entity;
- and
- in response to determining that the cache entry neither grants nor denies the second indicated type of access, accessing a cache entry for a parent object of the resource object.
14 more elements
Dependencies are inferred from the claim text.