System and method for controlling policy distribution with partial evaluation

A method for controlling, with the aid of a computer system, distribution of an access control policy to permit or deny access to one or more protected alternatives using partial evaluation, the computer system comprising a database, a guard, a policy decider and a policy distributor, the computer system being programmed to perform the method comprising the steps of:

• receiving from a policy decider connected to a guard static attributes of the protected alternative at a policy distributor which is connected to the policy decider and to a database comprised in the system and which is operable to store all access control policy functions for all protected alternatives;
• constructing, at the policy distributor, a partial access control request from the static attributes of the protected alternative;
• performing, at the policy distributor, a partial evaluation against the access control policy function stored in the database by substituting the static attributes of the protected alternative, which are present in the partial control request, into the access control policy function, so as to generate a simplified access control policy function;
• and
• sending the simplified access control policy function from the policy distributor to the policy decider, and
• wherein each protected alternative is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.

A non-transitory computer readable storage medium containing at least one computer program product, which is directly loadable into the internal memory of at least one digital computer, and which comprises software code portions for performing, when the at least one product is/are run on the at least one computer, a method for controlling distribution of an access control policy to permit or deny access to one or more protected alternatives using partial evaluation, the method comprising the steps of:

• receiving from a policy decider, which is connected to a guard, static attributes of the protected alternative at a policy distributor which is connected to the policy decider and to a database comprised in at least one computer and which is operable to store all access control policy functions for all protected alternatives;
• constructing, at the policy distributor, a partial access control request from the static attributes of the protected alternative;
• performing, at the policy distributor, a partial evaluation against the access control policy function stored in the database by substituting the static attributes of the protected alternative, which are present in the partial control request, into the access control policy function, so as to generate a simplified access control policy function;
• and
• sending the simplified access control policy function from the policy distributor to the policy decider, and
• wherein each protected alternative is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.