Data driven role based security
AssigneeMicrosoft Corporation
InventorsSergei Ivanov, John August Barrows
Life of this patent
Estimating the term…
Abstract
Data driven role based security is provided. At login, the system queries for a data context in connection with access to computing objects of a computing system. When a request for access to computing objects is received by the computing system, one or more control expressions specified for the computing object being accessed are evaluated. The evaluation of the control expressions may reference the user context or the data context previously established, and returns a set of effective permissions. Access to the computing object is then granted if the set of permissions includes an appropriate permission for the request for access.
Claims19
A method, comprising:
- querying for a data context in connection with potential access to one or more computing objects of a computing system by at least one computing device on behalf of a user identity;
- receiving the data context in response to the query;
- in response to receiving the data context, defining a derived role for the user identity relative to the one or more computing objects based on at least one aspect of the data context;
- receiving, by the at least one computing device, a request for access to at least one computing object of the one or more computing objects, the request for access on behalf of the user identity;
- evaluating a control expression of an object governing access to the at least one computing object based on the derived role to form a set of permissions;
- and
- granting access to the at least one computing object if the set of permissions includes a permission for the request for access.
A system, the system comprising:
- one or more computer storage devices having stored thereon computer-executable instructions representing a login component and an access control component, wherein:
- the login component is configured to:
- query for a data context for access requests to data objects of a computing system in response to a user login, the data context is retrieved based on the data objects, the user login associated with a user identity;
- receive the data context responsive to the query;
- and
- in response to receiving the data context, define a derived role for the user identity relative to the data objects based on at least one aspect of the data context;
- the access control component is configured to dynamically evaluate, in response to a request by the user identity for access to at least one data object of the data objects, at least one control expression of an access control object that controls whether the derived role is to be granted access based on a set of permissions.
Dependencies are inferred from the claim text.