Enterprise model for provisioning fine-grained access control
AssigneeOracle International Corporation
InventorsJosh Bregman, Michael Khalandovsky
Life of this patent
Estimating the term…
Abstract
Access control rules can be defined for target applications of an enterprise system independent of a runtime of the target applications. The access control rules can then normalized into decision tables. These decision tables can then be used to reconcile authorization information with the target applications via user provisioning. This process can enable comprehensive reporting and analysis of enterprise access control rules without requiring direct integration of the target applications at runtime.
Claims20
A non-transitory computer-readable medium having instructions stored thereon that, when executed by a processor, cause the processor to implement an authorization policy, the implementing comprising:
- modeling an authorization policy set comprising one or more authorization policies;
- storing the authorization policy set in a policy store;
- retrieving from an application an input of the application, wherein the input of the application comprises at least one of a subject, a resource, or an action;
- applying the stored authorization policy set to the input of an application to generate an authorization decision set independent of the application using an application programming interface of the policy store, wherein the authorization decision set comprises one or more authorization decisions;
- storing the authorization decision set in a decision table;
- propagating the stored authorization decision set to the application using a user provisioning system;
- modifying the authorization policy set;
- and
- applying the modified authorization policy set to the input to regenerate the authorization decision set.
A computer-implemented method for implementing an authorization policy, comprising:
- modeling an authorization policy set comprising one or more authorization policies;
- storing the authorization policy set in a policy store;
- retrieving from an application an input of the application, wherein the input of the application comprises at least one of a subject, a resource, or an action;
- applying the stored authorization policy set to the input to generate an authorization decision set for an application independent of the application using an application programming interface of the policy store, wherein the authorization decision set comprises one or more authorization decisions;
- storing the authorization decision set in a decision table;
- propagating the stored authorization decision set to the application using a user provisioning system;
- modifying the authorization policy set;
- and
- applying the modified authorization policy set to the input to regenerate the authorization decision set.
An enterprise system, comprising:
- an authorization module comprising instructions;
- a memory configured to store the instructions of the authorization module;
- a processor configured to execute the instructions of the authorization module stored on the memory;
- and
- a user provisioning system,
- wherein the processor is further configured, when executing the instructions of the authorization module stored on the memory, to,
- model an authorization policy set comprising one or more authorization policies,
- store the authorization policy set in a policy store,
- retrieve from an application an input of the application, wherein the input of the application comprises at least one of a subject, a resource, or an action,
- apply the stored authorization policy set to an input of an application to generate an authorization decision set independent of the application using an application programming interface of the policy store, wherein the authorization decision set comprises one or more authorization decisions, and
- store the authorization decision set in a decision table, and
- wherein the user provisioning system is configured to propagate the stored authorization decision set to the application;
- wherein the processor is further configured, when executing the instructions of the authorization module stored on the memory, to,
- modify the authorization policy set;
- and
- apply the modified authorization policy set to the input to regenerate the authorization decision set.
Dependencies are inferred from the claim text.