Microsoft Technology Licensing, LLC

Andrey Popov

Mark Fishel Novak

David McPherson

Ming Tang

Paul J Leach

Arun K Nanda

Vishal Agarwal

Nir Ben Zvi

Karanbir Singh

Pranav Kukreja

Ramaswamy Ranganathan

Resource authorization policies and resource scopes may be defined separately, thereby decoupling a set of authorization rules from the scope of resources to which those rules apply. In one example, a resource includes anything that can be used in a computing environment (e.g., a file, a device, etc.). A scope describes a set of resources (e.g., all files in folder X, all files labeled 'Y', etc.). Policies describe what can be done with a resource (e.g., 'read-only,' &#x201c;read/write,&#x201d; &#x201c;delete, if requestor is a member of the admin group,&#x201d; etc.). When scopes and policies have been defined, they may be linked, thereby indicating that the policy applies to any resource within the scope. When a request for the resource is made, the request is evaluated against all policies associated with scopes that contain the resource. If the conditions specified in the policies apply, then the request may be granted.

Scoped resource authorization policies

A context of a principal is built, at a target system controlling access to a resource, independently of the principal requesting access to the resource. An authorization policy is applied, at the target system, to the context to determine whether the principal is permitted to access the resource, and an indication of whether the principal is permitted to access the resource is provided (e.g., to an administrator). Modifications can be made to the context and the authorization re-applied to determine whether a principal having the modified context is permitted to access the resource.

Target-based access check independent of access request

Growing community of inventors

Renton, WA, United States of America

Andrey Popov