会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 96. 发明申请
    • SUBJECT MATCHING FOR DISTRIBUTED ACCESS CONTROL SCENARIOS
    • WO2018208290A1
    • 2018-11-15
    • PCT/US2017/031762
    • 2017-05-09
    • INTEL CORPORATION
    • SMITH, Ned M.HELDT-SHELLER, Nathan
    • H04W4/00H04W12/08G06F21/62H04L29/06
    • Various systems and methods for implementing an access control policy that provides subject matching in distributed access control scenarios, such as Internet of Things (loT) device interconnection settings, are described. An access evaluator 330 intermediates and evaluates loT subject(s) requesting access to loT object(s). In an example, a device determining an access control policy with an access evaluator 330 includes: receiving a request from a subject 310 to perform an operation with an object 320; evaluating a first type of access policy of the subject 310, and a second type of access policy of the object 320, to determine a first and second access scope for performing the requested operation; identifying an access policy object 350 that provides a mapping between the first access scope and the second access scope for performing the requested operation; and providing access from the subject 310 to the object 320 based on a security level determined from the mapping between the first access scope and the second access scope provided with the access policy object 350. The access evaluator 330 grants (or denies) access based on the access policy object 350. The first and second types of access policies of the subject 310 and the object 320, respectively, may be distinct and incompatible, wherein the first type of access policy provides a different number of security levels than the second type of access policy, and wherein the access control object maps the first access scope to the second access scope at a lower privilege level. The present techniques decouple access policy from respective subjects and objects so there are no implicit bindings. Instead, a policy object may be adapted to provide for explicit matching of both subjects and objects. The present techniques provide flexibility for access to be evaluated at multiple points of enforcement (such as by a bridge or gateway, at the point of origin or at the point of destination). Further, with the present techniques, access and security considerations may be evaluated at the most appropriate scope for the given enforcement point.