# US 9,882,905 B2 · Access control in data processing system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,905 B2 - Document ID: US9882905B2 - Status: Granted - Kind: B2 - Application number: 14/523,653 - Filed: 2014-10-24 - Published: 2015-02-12 - Granted: 2018-01-30 - Earliest claimed: 2010-03-31 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Thomas R. Gross; Guenter Karjoth - Web page: https://patentgrep.com/patent/US9882905B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A policy data structure defines predetermined authorizations, each relating to authorization of at least one user to access at least one resource as well as to dynamic access requests. Each dynamic access request indicates a condition to be satisfied by a respective set of attributes associated with a user request to access a resource and for the request to be granted in absence of an authorization determinative of the request. If the structure does not define an authorization for a request to access a resource, it is determined whether the structure defines a dynamic access requirement determinative for the request, and if so, whether to grant the request in accordance with the respective set of attributes associated with the request. For at least one request, after determining whether to grant the request, a dynamic authorization relating to authorization to access the resource within the request is added to the structure. ## Claims ### Claim 1 A method comprising: determining, by a processor, whether a policy data structure defines a predetermined authorization for a resource access request that has been received; in response to determining that the policy data structure defines the predetermined authorization for the request, applying the predetermined authorization to the request, by the processor, to determine whether to grant the request; and in response to determining that the policy data structure does not define the predetermined authorization for the request: applying a dynamic authorization request condition specified by the policy data structure to the request, by the processor, to determine whether to still grant the request despite the policy data structure not defining the predetermined authorization for the request; and after applying the dynamic authorization request condition, and in response to the request having been granted, granting a subsequent request related to the request, for a length of time associated with the request. ### Claim 2 (depends on 1) The method of claim 1, wherein the predetermined authorization relates to authorization of at least one user to access at least one resource. ### Claim 3 (depends on 1) The method of claim 1, wherein the predetermined authorization relates to a plurality of dynamic access requests that each indicate a dynamic authorization request condition to be satisfied by a respective set of attributes associated with a user request to access a resource and for the request to be granted in absence of an authorization determination of the request. ### Claim 4 (depends on 1) The method of claim 1, further comprising: identifying any temporal validity limitation for the set of attributes associated with the resource access request to which the dynamic authorization request condition is applied; and, determining whether to add a dynamic authorization to the policy data structure in accordance with the temporal validity limitation. ### Claim 5 (depends on 1) The method of claim 1, further comprising, after applying the dynamic authorization request condition, adding a dynamic authorization relating to authorization to access a resource specified by the resource access request, by the processor, to the policy data structure where the resource access request has been granted. ### Claim 6 (depends on 5) The method of claim 5, further comprising, where the dynamic authorization has been added to the policy data structure: defining an expiration time for the dynamic authorization within the policy data structure in accordance with a temporal validity limitation indicated for a respective set of attributes associated with the request; and only applying the dynamic authorization to the subsequent request up to the expiration time. ### Claim 7 (depends on 6) The method of claim 6, further comprising: upon adding the dynamic authorization to the policy data structure, setting a temporary authorization flag associated with the dynamic authorization in the policy data structure; and, before applying an authorization to a further request, determining whether the temporary authorization flag is set for the authorization; in response to determining that the temporary authorization flag is set for the authorization, checking the expiration time for the authorization. ### Claim 8 (depends on 6) The method of claim 6, further comprising: removing the dynamic authorization from the policy data structure upon the expiration time having been reached. ### Claim 9 (depends on 5) The method of claim 5, wherein the policy data structure comprises a static authorization data structure defining the predetermined authorization, and wherein the dynamic authorization added to the policy data structure is integrated within the static authorization data structure. ### Claim 10 (depends on 9) The method of claim 9, further comprising: maintaining in the policy data structure a list identifying the dynamic authorization in the policy data structure and indicating an expiration time associated with the dynamic authorization. ### Claim 11 A storage device storing computer program code executable by a processor, the computer program code comprising: a first computer program part to determine whether a policy data structure defines a predetermined authorization for a resource access request that has been received; a second computer program part to, in response to determining that the policy data structure defines the predetermined authorization for the request, apply the predetermined authorization to the request, by the processor, to determine whether to grant the request; a third computer program part to, in response to determining that the policy data structure does not define the predetermined authorization for the request, apply a dynamic authorization request condition specified by the policy data structure to the request, by the processor, to determine whether to still grant the request despite the policy data structure not defining the predetermined authorization for the request; a fourth computer program part to identify any temporal validity limitation for the set of attributes associated with the resource access request to which the dynamic authorization request condition is applied; and a fifth computer program part to determine whether to add a dynamic authorization to the policy data structure in accordance with the temporal validity limitation. ### Claim 12 (depends on 11) The storage device of claim of claim 11, wherein the predetermined authorization relates to authorization of at least one user to access at least one resource. ### Claim 13 (depends on 11) The storage device of claim of claim 11, wherein the predetermined authorization relates to a plurality of dynamic access requests that each indicate a dynamic authorization request condition to be satisfied by a respective set of attributes associated with a user request to access a resource and for the request to be granted in absence of an authorization determination of the request. ### Claim 14 A system comprising: a plurality of resources; an apparatus to control access to the resources, the apparatus comprising: a memory to store a policy data structure; and, control logic to: determine whether the policy data structure defines a predetermined authorization for a resource access request that has been received; in response to determining that the policy data structure defines the predetermined authorization for the request, apply the predetermined authorization to the request, by the processor, to determine whether to grant the request; and in response to determining that the policy data structure does not define the predetermined authorization for the request, apply a dynamic authorization request condition specified by the policy data structure to the request, by the processor, to determine whether to still grant the request despite the policy data structure not defining the predetermined authorization for the request, wherein the predetermined authorization relates to a plurality of dynamic access requests that each indicate a dynamic authorization request condition to be satisfied by a respective set of attributes associated with a user request to access a resource and for the request to be granted in absence of an authorization determination of the request. ### Claim 15 (depends on 14) The system of claim 14, wherein the predetermined authorization relates to authorization of at least one user to access at least one resource. ### Claim 16 (depends on 14) The system of claim 14, wherein the control logic is further to: identify any temporal validity limitation for the set of attributes associated with the resource access request to which the dynamic authorization request condition is applied; and, determine whether to add a dynamic authorization to the policy data structure in accordance with the temporal validity limitation.