DE102010016324A1 - System, method and arrangements for securing resources - Google Patents

Abstract

The present invention (100) relates to a system, method and / or arrangements for securing access to resources (111), in particular for access via a computer network (50), the system or an arrangement comprising: a. At least one means of integration that makes it possible to access at least one or more means that are used to influence access decisions about access to at least one resource 111; b. At least one means of aggregation, which makes it possible to calculate aggregated access rights, at least one means of access decision being used in the calculation.

Description

1. Technical area

The present invention relates to systems, methods, and arrangements that can be used to secure resources, particularly in highly scalable scenarios, with computer networks. In this case, the invention was made, in particular with consideration of the Internet and platforms occurring therein.

2. State of the art

An example of a modern security system is Spring Security. It has resources that make it possible to secure a Java program via annotations. In Spring Security, access control lists for individual objects created by classes can be stored. The system has a central access control list (ACL) filing system in which the access control lists are stored in a database. These are then used when accessing resources to check access to permission. The individual access control lists can refer to further access control lists in the central repository, from which they inherit the contents. Because of this, an access check will then include the access control lists inheriting rights. One problem with Spring Security is that it has only one internal depot and can not use any other systems or access list types. Since different technologies are normally used in a system landscape, Spring Security can be considered isolated from the other systems, since they do not work together. Another problem is that access decisions that inherit rights from other access control lists must always load and evaluate the access control lists from which rights were inherited. These and other limitations make such a system inflexible and difficult to scale.

Apache Shiro ( http://cwiki.apache.org/confluence/display/SHIRO/Index ) is a security system for various programming platforms, but does not support the integration of other security systems and their access control lists, which, for example, inherit rights from each other.

Other security systems are considered similar or less powerful than Spring Security.

An example of an access control list language is XACL. However, this does not solve the problem of being able to manage heterogeneous systems with different access control lists through one system.

This invention is therefore based on the technical problem of making it possible to provide arrangements, methods and systems that make it possible to use data that can be used for access control from different systems, as well as to distribute them. The challenge is that the different systems can follow different specifications and are actually incompatible.

Furthermore, in addition to this functionality, further functions by the invention allow a good scalability. Furthermore, the invention should also be able to be used in acute and future application scenarios, in particular in the highly dynamic Internet environment.

3. Summary of the invention

• a. Zumindest ein Mittel zur Integration, das es ermöglicht, auf zumindest ein oder mehrere Mittel zuzugreifen, die genutzt werden, um Zugriffsentscheidungen über den Zugriff auf zumindest eine Ressource 111 zu beeinflussen;
• b. Zumindest ein Mittel zur Aggregation, das es ermöglicht, aggregierte Zugriffsrechte zu berechnen, wobei bei der Berechnung, zumindest ein Mittel zur Zugriffsentscheidung verwendet wird.

The present invention 100 solves the problems described above. In an embodiment according to claim 1, the invention 100 on:

• a. At least one means of integration that makes it possible to access at least one or more resources used to make access decisions about access to at least one resource 111 to influence;
• b. At least one means of aggregation, which makes it possible to calculate aggregate access rights, wherein at least one means of access decision is used in the calculation.

Thus, the present invention provides 100 a system, method and arrangement that allows a variety of systems 110 which may also include security features or methods of hedging, integrating and combining with each other, by aggregates of rights, beyond the system boundaries of a system 110 away, can be calculated. In this case, access rights can be understood as authorizations or refusals to carry out operations. For example, such rights may be the permissions to read, write, modify, delete or administer. But there are also more complex permissions or denials, such as authorize, approve, execute, z. Of services or functions, execute with constraints, execute with limited result set, depending on the user role and any other function that occurs in programs, especially in business management.

The means used for access decisions 112 , can use a variety of resources 111 represent. For example, such means 112 Access control lists or parts thereof. Or complete security systems, other systems 110 or individual parts of them. Also, the various embodiments of the invention 100 or parts of them themselves represent such means, for example, to scale them.

Aggregate means pooling rights for a specific resource 111 , A resource 111 may be, for example, a file or any other form of document or database, e.g. B. also a placeholder, in place of the client 130 is allowed to store information.

Such documents may, for example, occur in a document base, also referred to as a database, in which the documents are stored. An example of a document base is a file system. However, a document base may also be active, for example, the database / document base may be a web server or even multiple web servers, such as the Internet. The term database also refers to several systems 110 or also via computer networks coupled systems. The term document is therefore a collective term for all possible outputs of a database or even a collection of data generated by a user. A document can, for. B. dynamically generated from a database, which is why a database in the context of the present invention 100 as source or combination of sources or source systems 110 which data can be requested, written and / or changed. A document is thus a logical unit, a partition, component and / or subdivision, and therefore also applies to parts of documents. Embodiments of the present invention 100 In doing so, they can use the structural information of the database to improve and / or accelerate access to the database or existing documents. For example, the following data and associated systems can serve as database and thus as documents 110 or systems 110 Serve alone: Hypertext documents, Word documents, e-mails, web servers, program code, such as classes or objects or other constructs that occur during programming or compiled source code generated from it, API calls or return values, accesses to program parts, business objects, such as z. Eg documents, or master data, application servers, SAP systems, data warehouses, text documents, images, audio files, social networks, videos, blogs, Twitter, social networks, mobile devices such as cell phones, peer-to-peer networks, input devices , File systems, databases, search engines, servers, routers, machines, sensors, test systems, debuggers, people and / or automobiles. Unless the present invention 100 in a computer network 50 is used, this network and its participants can take the role of the database, on the Internet z. For example, the Internet network itself, peer-to-peer networks, web servers, websites, clients, mobile clients 130 (eg mobile phones, notebooks, PDAs, etc.) and other actors. A web page identifies a document that is accessible via the Internet, and may include various content that occurs there, such. For hypertext documents, videos, images and other documents that may contain hyperlinks. The term website can also stand for several documents, eg. For example, all or part of the pages under a particular domain. Thus, the term website is also a collective term for what is commonly called website or website, ie a collective term for an entire website, eg. B. an appearance of a company, an organization, a private person, an association, an interest group or for a specific purpose, eg. B. sale, trade, information, discussion, exchange, pleasure, search, mediation etc. Such an Internet site can be transmitted via various protocols, eg. TCP / IP, HTTP, HTTPS, FTP, POP3, SMTP and other protocols used for communication in computer networks 50 be used.

By resources 111 Classes or even objects from programs, it is thus possible to associate access rights with them. Rights can be roles or access rights that specify what operations are performed on or with the resource 111 be performed. This is very advantageous because roles can be linked to object instances and inherited. This makes it possible to implement Role Based Access Control on object and not just on the class level (Instance Role Based Access Control - IBAC).

This IBAC makes it possible to make access decisions to specific resources 111 due to hierarchies of rights or roles specific to a specific resource 111 or resource hierarchy apply and in this with at least one client 130 are linked to meet.

Here, the rights that were determined on the basis of aggregations can be stored. This makes it possible to use the aggregated rights in an access decision. Aggregate formation itself can take place via rules or programs. It is also possible that queues with messages are used to further accelerate aggregate formation to further increase parallelism.

This is a great advantage over the prior art, since thus for the first time relationships, such as inheritance, of Access control lists on different systems 110 away are possible. This can be realized because a variety of integration units and access means can be combined. It can by the invention 100 the inherited rights through at least one aggregation unit 102 be calculated and by the integration unit 101 get saved. For example, already existing systems 110 or databases, such as. For example, Image Server or Video Streaming Server, and each resource, such as images, videos, directories, or other documents may inherit rights from another system, such as program logic.

Particularly advantageous in forming the aggregates is the fact that not necessarily only one aggregation unit 102 exists, but there may be more of these. This enables distributable processing to take place, thus ensuring high scalability.

In addition, the invention 100 , as in 1b of course, also directly with one or more systems 110 work together. For example, this part of a system 110 or a system 110 can also be a part of this. This allows seamless integration with other systems 110 , This could be the invention 100 itself in turn z. B. serve as a security system, in combination with other inventions 100 or systems 110 is used. This allows the invention 100 not necessarily just as a system 110 can be implemented. Rather, it can be considered a variety of systems 110 that z. B. by the integration unit 101 and aggregation unit 102 communicate, be realized. This results in a particularly advantageous distributability, such as in a computer network 50 over several servers.

In a further aspect of the invention 100 can the systems, the means of access decision 112 include, from the invention 100 be addressed via at least one computer network, such as the Internet. This allows the invention 100 particularly preferably can be used in heterogeneous distributed system landscapes.

Furthermore, the invention may have at least one inheritance tree. This makes it possible to map the inheritance structure or inheritance structures. This can be used, for example, in calculating the aggregates to determine which "access decision means 112 "Must be considered in the formation of aggregates. Such inheritance tree is particularly advantageous in that thus inheritance also on different systems 110 that can not be inherited, can be mapped. Thus, for example, by aggregates into foreign non-inheritable systems 110 also be added to an inheritance function. Another advantage of the inheritance tree is the possibility that several can be used as in 2a shown. There you can see different systems 110 - 200 . 210 . 220 have different inheritance trees and are referenced from nodes in an inheritance tree to nodes in others. This makes it possible in particular to scale the aggregation in combination with inheritance trees. Another advantage of such trees is that the information available in the trees can be used in the calculation of aggregates. For example, to detect dependencies and generate aggregate schedules.

In another embodiment, means may be defined in programs that are taken into account in the access decision. Such means may be, for example, annotations or aspects. Thus, for example, expressions can be given which roles or permissions which accesses to at least one resource 111 to have. Thus, for example, methods of a class or the class itself can be restricted by means of annotations. Due to the ability to form aggregates, it is also possible to define "virtual resources" in the program source text. For example, images that can be found on an image server. In the process, such images can occur as "normal objects in the object-oriented sense" in the program source text. The physical image on the Image Server inherits the rights of the virtual object. This makes it possible for the rights in the image server to be inherited from the "virtual object" during aggregate formation. With such an aggregate formation, it is also possible to consider further means defined in the program source text, such as contents of annotations or aspects.

A, particularly preferred in the dynamic Internet environment, such as Web.2.0, used variant of the invention 100 , has the ability to dynamically integrate or remove integrators. This allows a particularly flexible adaptation without the need of the invention 100 to adapt yourself if a new system 110 should be included, since thus only at runtime, the required integration means can be loaded.

Furthermore, the invention 100 have means that updates are detected by "access control means". This can be used to, for example, a process for aggregating objects that are affected by the affected Object inherit, performed or updated. This capability thus makes it particularly dynamic and flexible means for access decision 112 update, as well as updates in foreign systems 110 can be recognized.

Another skill, characterized by the capabilities of the invention 100 results is the possibility of being on resources 111 does not need to be accessed via a centralized security system, as is the case today with Spring Security, for example. Rather, a client can 130 directly on resources 111 access that in a system 110 that are the means of access decision 112 can evaluate, as for example in 1e -G is shown. In this case, the means for access decision 112 for example, by the invention 100 to be updated. This direct access saves a detour of the data packets from the actual systems 110 about the invention 100 or another security system.

A preferred variant of the invention 100 may also have or use cryptographic means. These can be used, for example, to help the client 130 to share a secret that serves various accesses to at least one resource 111 perform. This access could also be limited in time. This can be used, and thus also other third-party systems 110 use. For example, the client could 130 thus about OpenID in the invention 100 authenticate and of the invention 100 a secret with which he can access the resources needed 111 can get access.

Thus, for example, an application could be created that at least one existing security infrastructure, such. For example, Amazon Web Services ACL Infrastructure ( http://aws.amazon.com/ ), the Google App Engine Infrastructure ( http://code.google.com/intl/de-DE/appengine/ ) or similar uses. By this or a similar could at least a direct resource access by the client 130 be enabled by z. B. the cryptographic means of the platform can be used to at least one client 130 Sharing a secret by pointing directly to at least one resource 111 can be accessed. The effectiveness of the secret could also be temporarily limited or / and coupled to various access operations.

Furthermore, could by the invention 100 an inheritance structure for the resources 111 and / or the associated means of access control, such as ACLs on Amazon today. This would then make it possible in conjunction with aggregates, the platform to an inheritance option by the invention 100 to expand. To further enhance this, individual parts or the complete invention could 100 thus also be realized as part of such a platform, and other parts could be made available to developers or users of the platform, for example, as an API or as a library or a combination of API and library. This would allow programs developed for such a platform to use a ready-made highly scalable security system that allows inheritance to be performed.

In such a scenario where the invention 100 is used in such or similar cloud computing infrastructure, it is also possible that to improve other services that offers such a platform can be used. For example, aggregation could be massively parallelized by many instances.

Furthermore, information about the client, so-called client information, can be used in the access decision. Client information or even user information is identifiable information that is based on one or more users / clients 130 or are related to one or more devices, arrangements or methods. Client information here are z. For example, data about or from users or devices, arrangements and procedures themselves. This may include, for example, passive data that may be in the user's profile, such as a user's profile. As hometown, group memberships, friends or even data that have been revealed, for example, by analysis. Other types of user data may be active data. Active can mean that these data only exist at runtime and change very frequently. For example, the current coordinates of the user, such. GPS coordinates or access point, its IP, status message, connection speed, client type. Due to the characteristics of client information, further information is often derivable from such information. For example, in the location perimeter based on the access point, the GPS coordinates or / and an IP address. Such derivable information is itself also referred to as client information.

For example, thus a client 130 due to his current position, he will be informed of other secrets, as if he is in a different position. Furthermore, thus the client information, together with other client information or other data together, can be considered. This ability to pay attention to client information in the access decision thus allows for a variety of novel use cases for backups, and thus new access decisions can be made. For example, it is thus possible, the Access from clients 130 on information from other clients 130 Restrict to their proximity.

Another variant of the invention 100 supports one or more roles or one or more hierarchies of access rights. For example, they may express which rights or roles contain other rights or roles. Thus, for example, roles and rights can be assigned and configured more easily, since it is no longer necessary to specify all rights and roles. This variant is particularly advantageous in conjunction with associating rights with certain resources 111 , Here it is access decisions to certain resources 111 due to hierarchies and rights or roles specific to a specific resource 111 or resource hierarchy, with a client 130 are linked to meet. This differs from the example of Spring Security where such hierarchies are not directly related to resources 111 are definable.

The present invention 100 further relates to a method of securing resources, the method comprising the steps of: a. Access one or more resources used to make access decisions about accessing at least one resource 111 to influence; and b. Calculation of at least one aggregate, wherein at least one means of access decision is used in the calculation. Further advantageous embodiments of the method according to the invention can be found in the further dependent claims.

Finally, the present invention provides 100 a computer program having instructions to execute each method described herein.

4. Brief description of the drawings

1a E: arrangements, systems and interactions according to embodiments of the present invention;

2a -C: inheritance possibilities according to embodiments of the present invention;

3a -D: Aggregation method and visualizations according to embodiments of the present invention;

4 An integration unit and arrangement according to an embodiment of the present invention;

5 Method and exemplary representation of the transformation between different means used for access decision, according to an embodiment of the present invention;

5. Detailed description of preferred embodiments

Security Systems / System components:

It is fundamental in systems 110 such that means of access decision 112 make the decision about the permission or the partial permission of an access and thus authorize this. These could also be called means access control. In doing so, funds are used or / and also evaluated by means of access decision 112 be taken into account in the cases of the decision. For simplicity, this document uses these two types of resources as access decision-makers 114 and decision maker 113 , designated. Where the decision maker 113 as well as access decision makers 114 , in each case also for a plurality of access decision makers 114 as well as decision-makers 113 can stand. Here is the access decision maker 114 the means that makes at least one access decision. This can also be used as a "means of access decision 112 Be designated. The decision-making means 113 are the means by which the decision is made, such as resources, such as documents. These can also be referred to as "resources" used for access decisions. Access decisions can also mean a plurality of access decisions, for example, in that multiple smaller access decisions can result in a large access decision. Often the border between these different means can not be clearly drawn and in security systems 110 a mixture between decision-making agents 113 , Access decision maker 114 and access decisions, these can be generalized as a means of access decision 112 and all occurrences of the aforementioned terms in this document could be identified by "means of access decision 112 " be replaced. The reason why, nevertheless, the words decider 113 , Access decision and access decision maker 114 is partially used is that this subdivision easier understanding of the invention 100 promotes. Therefore, in the further course, if it promotes comprehensibility, the terms access decision makers 114 and decision maker 113 rather than means of access decision 112 used.

Fig. 1a

1a shows an embodiment of the present invention 100 , It can be seen that the invention 100 has means such as Example one or more integration units 101 that made it possible for the invention 100 together with other security systems 110 or inventions 100 is used. In addition, it can be seen that the invention 100 also via one or more means that can be used to form at least one aggregate, also in interaction with other components of the invention, such. B. an aggregation unit 102 , can have. One or more such aggregation means, such as aggregation units 102 , with means for integration, such as at least one integration unit 101 work together. This cooperation can, for example, be used when generating aggregates of decision makers 113 occur. For example, through integration units 101 aggregation units 102 Information about updates will be communicated or aggregation units 102 can integrate units 101 use it to decide 113 access. Such access may be, for example, reading, writing, updating or even analyzing means used for access control.

In the 1a It can also be seen that one or more clients 130 directly to the individual parts of the invention 100 access, and thus all functions, by this invention 100 revealed directly by a client 130 are usable.

clients:

clients 130 are z. For example, people or groups of people who use technical devices to communicate with machines, processes, other clients, devices or even over computer networks. clients 130 do not necessarily have to be humans. Rather, clients can 130 For example, machines, apparatus and procedures, so be user groups.

Often with clients 130 also information, even with the technical devices that use them, associable. Because a client 130 may represent a user or groups of users using at least one technical device or the clients 130 Even if one or more machines are themselves, there will be no differentiation between user (human) and client and the word client 130 also used as an equivalent for users and vice versa.

Aggregate:

Aggregates are decision-making agents 113 from existing decision-makers 113 or resources such. B. other documents were calculated. For example, aggregates of access decision means may be the sum of allowed rights for clients 130 minus the denials for clients 130 be seen. It can be considered as additional resources 111 z. As framework conditions, such as hierarchical permissions or hierarchical roles or other means that are considered for access decision in their generation or updating. This z. For example, all of the features discussed in this document that are presented in aggregate formation or steps thereof may be considered to serve aggregates of "normal" arbitration means 113 delineate. For example, an aggregate may optionally be transformed into a suitable format for at least one target system, whereby further framework conditions, such as rules, computer programs, systems, are also generated when the aggregate is generated and the transformation, if appropriate, into the appropriate format for the target system 110 or information about clients 130 in different systems 110 , can be used. Such aggregates can particularly preferably be optimizations for a very wide variety of applications in comparison to the decision-making means 113 or resources from which they were generated. In contrast to a normal means, which is used for access decisions, an aggregate can additionally or alternatively be characterized by further features. For example, this can result in a faster access decision with at least one access, in contrast to at least one access decision based on at least one previously existing decision maker 113 that was taken into account for generating the aggregate. Or / and there will be less or no resources 111 of at least one access decision maker 114 , in contrast to at least one access decision, due to at least one previously existing decision maker 113 needed to produce the aggregate. Where such resources, such as memory or processor load can be, but also documents or rules that are used in the access decision to decide the access question. Or / and it is not an evaluation of fewer rules or computer programs, in contrast to at least one access decision, due to at least one previously existing decision maker 113 that was considered for generating the aggregate possible. Furthermore, aggregates can also, for. B. at least one optimized form in which accesses are particularly often performed, for example, in the use of client information, in comparison with at least one access decision, due to at least one previously existing decision maker 113 that was taken into account for generating the aggregate. Another possibility is that aggregates make it possible to work on or in resources such as Take Web servers, for example, to make access decisions that were previously not possible. In combination or alternatively, aggregates can also be transformations and thus, for example, a representation of decision-making agents 113 , at least in an expression of at least one previously existing decision maker 113 , which was considered for the generation of the aggregate, distinguished. Such an expression may be, for example, that instead of a user name, a userID is specified in the aggregate.

Security Systems / Systems

As the security systems described above 110 or often systems 110 These are all apparatus, methods and arrangements that use any means to access decisions about access to at least one resource 111 or even represent the means or part of the mean that is evaluated upon access. Because often many systems 110 Access control lists for accesses can also evaluate these as security systems 110 in the sense of the invention 100 be seen. Thus, every system is a security system 110 to see that supports security features. Thus, for example, programs, the security functions or even the invention 100 to see yourself as a security system. The term security system is thus rather a logical name for access-controlled systems 110 or units responsible for security, such as access control lists. Examples include Web servers such as Apache or IIS, Windows Server, ERP systems, Business Intelligence systems and many others.

It is not mandatory, so that purely the integration units on the security systems 110 can access. For example, it is conceivable that even the aggregation units themselves on the security systems 110 can access. The reason is that, for example, through the integration units 101 Updates could be uncovered and therefore due to aggregation procedures in aggregation units 102 and they do not have direct access to the integrators and directly write the results of the aggregation procedures.

Another skill about the invention 100 may be means of access decision 112 , So access decision makers 114 and decision-making. These can all be in this invention 100 evaluate decision-making means and decide on accesses. For example, such resources could be modeled on Spring Security or Apache Shiro, or existing resources could be modified to include the advanced novel features of this invention 100 to combine with existing ones. Another possibility is to further develop this other existing security system to perform the functions of this invention 100 in one or more apparatus, methods or arrangements. Thus, this invention as well as the advancement is to be seen for each security system and may have means specialized for such cases to achieve optimal integration.

However, it should be noted that this invention 100 can not be implemented only for the Java platform or the Java Enterprise platform. Rather, the invention 100 be realized on a variety of platforms. For example, on the Dotnet platform or in C ++. It is also conceivable that the invention 100 implemented as a combination of different technologies.

Examples, means of access decision 112 :

The means of security systems 110 or the invention 100 even being used to make access decisions can be diverse. Such means may be, for example, Access Control Lists (ACL), which are particularly common nowadays, such as by Security or an Apache web server. But also programs or tables in databases or web pages or all documents can be such means. Another example of such means may also be annotations or security aspects of aspect oriented programming. Thus, for example, expressions can be given in the program source text which roles or permissions, which accesses to at least one resource 111 to have. It can also, for. B. by such terms, directly or indirectly by system logic other means, such as access control lists are specified, which are used in the access decision. Another example of such access decision means 112 can be client information.

Client information:

Because of the manifold possibilities, what or who a client 130 can also be client information as information about users, as well as the information about technical devices. Client information is information that refers to one or more users or to one or more clients 130 , Devices or processes are related. Client information is thus data about or from users or devices and procedures themselves. This can For example, passive data, for example, in the profile of the user, such. As hometown, group memberships, friends or even data that have been revealed, for example, by analysis. Other types of user data may be active data. Active can mean that these data only exist at runtime and change very frequently. For example, the current coordinates of the user, their IP, status message, connection speed, client type. Due to the characteristics of previously shown client information, further information can often be derived from such information. For example, in the location perimeter due to an IP address. Such derivable information is itself also referred to as client information.

It can be z. For example, a combination of the various possibilities of the access decision means 112 be used for at least one access decision. For example, a combination of access control lists and annotations and aspects, as in Spring Security. This invention 100 now makes it possible to take this fact into account when aggregating or aggregating.

Thus, it is possible that information about clients, such as its location in the form of GPS data or other other data from its profile, are used in the access decision. This allows z. B. that the invention 100 thus also "Location based Access Control" can support. This data can be combined with other means of access decision. Particularly advantageous here is that the client information as a means of access decision 112 In this case, they can even be incorporated into aggregates or evaluated together with aggregates. For such scenarios, the invention 100 have other specialized resources. For example, aggregates can be optimized and formed such that access decisions can be made by them, particularly in terms of performance, in the incorporation of client information, for example to the aggregates themselves, in the actual access decision.

Access Control Lists can also be used with a variety of resources 111 be associated. For example, with classes, objects, and any kind of documents. This allows the rights at the level of various resources 111 be assigned. For example, it is possible roles, object instances in a program in an object-oriented programming language such. Java or Visual Basic.

resources 111 or ACLs may additionally, in a preferred embodiment, have relationships with one another, such as inheritance. Such inheritance may mean, for example, that the rights of an access control list include the rights of one or more other access control lists or other means. For example, an image of a directory may inherit rights. It is also conceivable that hierarchies of business objects, such as master data or master data groups or documents or / and other objects in business systems, such. B. Erp systems or data warehouses occur and rights are inherited.

These relationships can be defined, for example, by specifying the parent object, for example its type or / and identity. For example, about the class and objectID of the parent objects or about the identity of the parent decision maker 113 , This can be, for example, in the resources 111 yourself or in decision-making 113 happen. Also, a combination of the possibility could be in a variant of the invention 100 get supported. Because of that decision maker 113 with resources 111 Often, in this disclosure, only the inheritance of resources is linked 111 written, however, whatever the inheritance of decision-making 113 includes and vice versa.

Note that these inheritance and other relationships can also be between object instances in programming, not just between classes themselves or classes and object instances. Rather, it is possible that every resource 111 from every other resource 111 Rights inherit what the invention 100 very flexible and adaptable.

A particularly preferred variant of access control lists helps to define denials and permissions for users or user groups for data and functions. For example, by denying users from groups can be excluded.

Furthermore, such access control lists may contain rules or programs, or refer to rules or programs, as their evaluation is used in at least one access decision. In the process, such rules or programs may also contain other resources 111 include in the access decision. The invention 100 may have additional specialized means of calculating aggregates for rules or programs. This can be z. This can be used, for example, to increase the access control list evaluation speed, or for systems that themselves do not support the ability to use rules in combination with access control lists with other systems 110 or with rules or programs.

Furthermore, ACLs can only be rules or programs like another resource 111 to use or transform as an access control list.

This makes it possible that, for example, friend lists in social networks can be used to evaluate a permission of an access. In contrast to today used manual queries that check such cases, it is thus possible to handle these cases via a security system and thus use so to speak "virtual" access control lists. This makes it possible to remove the security function for such cases from the actual source code and thus to be able to write or generate clearer source code. As a result, additional problems that resulted from the limitation previously solved in addition. For example, it is thus easy to inherit from a "friends list as an access control list" in other access control lists.

Examples of such rules may also include checks on what rights a user may change during an access. Or complex checks can be made as to what different rights a user must possess. Also, such rules or programs may be used to comply with other information such as the pure access control lists in the access check.

Often access control lists also have different formats. For example, in an access control list, the rights for a client become 130 defined on the basis of a bit mask. Elsewhere, only pure lists are defined. Or, instead of the client 130 or define the group directly in the access control list, a proxy identification is stored. Others allow LDAP or OpenID references to be deposited. For this reason, the invention 100 for such or similar cases have specialized means to work with the most diverse access control lists. In this case, other apparatus or methods can be used, which then forms part of the invention 100 are. For example, to access OpenID Provider or aggregate the access control lists from the various formats and transform them into other formats.

Particularly preferred is the invention 100 also means that it is possible to easily manage the access control lists, for example by at least one model of an access control list 500 to the heterogeneous access control lists from different systems 110 to edit uniformly. By managing this, for example, an interface for easy editing or the unified access or the like is meant. As an example, here 1c be used. It could be in the different systems 110 different types of access control lists can be found, homogenized by the invention 100 is accessed.

An execution of the model 500 or also from access control lists, which together with the invention 100 can be used also has rights that can be marked as not inheritable. Furthermore, an access control list of the model is also preferred 500 then built that to a group or a client 130 Rights or roles are allowed and denied.

A particularly preferred further ability is not only to be able to specify rights in access control lists, but also to be able to define roles in them. This allows roles to be defined resource-specific or in a resource hierarchy. Thus, role-based access control is also possible at the object level and not just at the class level in programming, such as Spring Security.

Furthermore, hierarchies of rights or roles in access control lists could also be defined. These can then be used for access decisions or aggregation. The big advantage here is that it reduces the complexity of assigning rights.

Preferably, the invention features 100 also about the ability to receive information in one or more embodiments of the invention 100 can be stored. For example, if information, for example, genetic information, does not exist in security systems 110 save. For example the information, which resource 111 from which resources 111 inherits. But there are also other skills conceivable, on the z. For example, the model 500 an access control list. Such information may then be in the invention 100 itself, or it has, for example, means to store the required information about detours in the relevant system. For example, an aggregate could be calculated, and the additional information could be stored in the comments of an access control list.

1b shows the invention 100 in a larger environment. It can be seen that the invention 100 even a security system 110 include or be directly connected to it. Furthermore, it can be seen that they also have a further instance or variant of the invention 100 directly can be connected. For example, a higher scalability can be made possible by these possibilities.

Furthermore, it can be seen that the invention 100 with other systems 110 and instances or variants of the invention 100 via at least one computer network 50 , such as the Internet, can be connected. In this case, such a connection can be a stateless or stateful connection.

Also shows 1b in that all communications of the invention 100 via at least one computer network 50 can take place. But it is also possible that a variety of computer networks 50 is used. For example, a client 130 or other parts also via a wireless network, such as wireless or Mobilfunknetzt with the invention 100 communicate.

Through the distribution over a computer network 50 It is also possible that the invention 100 herself or parts of her over a computer network 50 connected and distributed. For example, aggregation and integration units do not necessarily have to be implemented in one system.

The different systems 110 in 1b continue to show that a variety of different methods and systems 110 with a variety of instances of the invention 100 or a variety of components can play together. This allows a particularly good dispersibility of the invention, for. In large cluster environments.

The client who is also connected to the computer network 50 connected, showing that this directly through the network to the systems 110 as well as to the invention 100 can access. However, this client is a substitute for a large number of clients 130 to see.

Note that the invention 100 not necessarily in a computer network 50 must be used. Rather, it can also be used in a variety of computer networks. For example, in peer-to-peer networks. Or it is possible that the client is connected to the Internet via a mobile network.

1c shows how the invention 100 as an intermediary to communicate with a variety of systems 110 can be used. This has the advantage that by the invention 100 homogenized to the different systems 110 can be accessed. It is also possible that an instance of the invention 100 is accessed, and communicates with other instances to z. B. clients 130 to allow settings to be made centrally and then distributed. In doing so, the client can 130 also by the individual components of the invention 100 on different systems 110 access or these can be used in an access. For example, decision makers 113 by the invention, for. B. also with the help of a model 500 and / or integrators are addressed and manipulated.

Also, it is possible that by addressing the individual systems 110 in the invention or inventions, inheritance information is deposited. For example, an access can specify which resources 111 Rights of which resources 111 inherit. It is also possible that the inheritance structure, through access to one or more inventions or systems 110 will be changed.

Note that this is a client 130 in 1c does not necessarily have to be a user. Rather, such a client 130 as described also a system or invention 100 be like this by the different identifiers 100 / 110 / 130 is indicated. 1d illustrates this even more clearly. The whole thing is shown in two stages. A client 100 / 110 / 130 communicates with a system or an invention 100 / 110 that or in turn with an invention 100 can communicate. It can be through such communication or direct communication with a client 130 z. For example, an action 150 how a procedure is triggered, for example.

For example, such an action 150 a process of aggregate formation. For triggering actions 150 For this purpose, particularly specialized means can be used. For example, decision makers could be regular 113 Check for updates and trigger the appropriate aggregate build. This could be done, for example, in one or more integrators or in specially designed means. It could also be possible for a client 130 , an invention 100 or the system of an invention 100 notifies that decision maker 113 to be updated. For example, by means specially designed for this case, such as an extension of the invention 100 together used systems.

By these abilities can thus be said in summary, z. B. several inventions are connected in series. Furthermore, it was explained how passive, such. B. by messages and active, z. B. by regular testing of decision makers 113 , Updates of decision-making 113 can be recognized, and this to actions 150 , such as B. Aggregate formations can lead.

Thus, the invention 100 Have funds that have updates from decision makers 113 be recognized. This can be used to automate, for example, a process for aggregate formation, for objects that inherit rights.

1e shows another system structure with clients 130 and inventions 100 and systems 110 , At the same time, clients can 130 as before, systems 110 or inventions 100 be. The client 130 can do this directly on a resource 111 access that in an invention 100 or a conventional security system 110 / 100 , When accessing means for access decision are evaluated and to make at least one access decision. The client can also talk about the invention 100 to the resource 111 access. Another possibility is that the client has resources to access the resource 111 the invention 100 gets transmitted through which he has access to the resource 111 can obtain. For example, these means may be to authenticate by which he is at the system 100 / 110 that the resource 111 managed, authenticated, or through which he can gain access.

The invention 100 may also have cryptographic means. These can be used, for example, in such scenarios. In doing so, the client can 130 For example, a secret can be transmitted through which he can gain access.

It is also possible that the client 130 authenticated or authorized in one or more inventions, and these then the individual systems 110 or inventions telling which client to which resource 111 Has access.

In such scenarios, further time windows can be set, how long a client can access a resource 111 Has. For example, by secrets get a period of validity and this, for example, the individual systems 110 or inventions is communicated.

Thus, it is possible that on resources 111 does not need to be accessed through a central security system, but directly to resources 111 in other systems 110 can be accessed by a variety of means.

These capabilities allow, for example, file uploads not via a file stream through a server / system 110 to be sent to security control. Rather, it is thus possible for clients 130 direct access to resources 111 gain and thus directly resources 111 from the client 130 can be transferred to a system.

This ability enables the invention 100 particularly convenient to use with cloud computing services, such as the Amazon Web Services, the Google App Engine or similar and related services. Thus, for example, the means can provide secrets to clients 130 time-limited for access to calculate, for them direct uploads are offered. Furthermore, all other capabilities of the invention 100 be used in such a cloud or grid computing environment. Thus, the security mechanisms that already exist there can thus be used and by the invention 100 be supplemented. For example, access control lists can thus be supplemented by inheritance.

Also particularly advantageous is the ability of the invention with identity providers 140 , for example Ldap authentication (described in: http://www.microsoft.com/germany/technet/itsolutions/network/grundlagen/tec_comp_2_2_3.mspx ) or similar devices, techniques, procedures, protocols, or a combination of them, such as OpenID ( http://openid.net/ ), Kerberos ( http://de.wikipedia.org/wiki/Kerberos_(Informatik) . http://www.hznet.de/security/kerbeinf.pdf ) or other authentication means. Identity providers are thus means that can authenticate at least one user. Especially in large distributed scenarios, this capability is beneficial. 1f shows an example of such a scenario. It shows how a client 130 with the identity provider 140 communicates, for example, for authentication, this also about the invention 100 or in combination with this and the system 100 / 110 with the resource 111 can happen. These and similar processes are known from the prior art. Essential for this scenario is that the invention 100 and the system 100 / 110 with the resource 111 , an identity provider 140 can use.

Also note that an identity provider is itself a system 110 can be.

For example, the invention 100 Aggregates for the system 100 / 110 calculate references to an identity provider 140 be set. This allows, for example, that the client 130 directly through the identity provider 140 can authenticate, and the invention 100 even with the concrete access is not needed.

Another skill about the invention 100 In one embodiment, integrating with different identity providers is also possible 140 or similar authentication means. It may have the ability to do so, clients 130 an identity provider 140 clients 130 in another identity provider 140 assigned. Such assignments can be made, for example, by rules or simple or complex mappings, e.g. B. in a memory unit to which the invention 100 can be defined or integrated into it. In this way, for example, not only can aggregates and inheritances be made possible across aggregates in aggregate formation, but other framework factors can be taken into account and different systems can be considered 110 also often clients 130 can designate differently. Thus, resources can ultimately 111 in systems 110 with different systems 110 by the invention 100 Relationships such as B. inheritance.

These skills, through the invention 100 To achieve a higher scalability, can be particularly preferred in relation to modern Internet platforms such. B. Social networks are used. For example http://www.studivz.net/ the http://www.wer-kennt-wen.de/ and http://www.facebook.com/ the problem, if the address of an image in the network is known, that anyone can retrieve the image through the direct URL and no security features protect the image, since only access by the platform performs the security check and not the image delivery component. This is seen by many users as a security hole. By the invention 100 such a problem would be solvable. It could directly decision makers 113 to be saved to the image. For example, as an access control list for the web server that delivers the images.

This is exemplified in 1g demonstrated. It became a general system 110 through a social network 160 presented to better visualize the scenario. It was deliberately a second system 110 added that at least z. The image server 110 represents the social network and thus symbolize that on this even without the social network 160 can be accessed. The invention 100 generates from the data in the social network 160 decision means 113 and store them in the image server 110 , This can happen, for example, by databases or the like of the social network 160 is accessed and used to create access control lists. In this case, users / clients can also be involved 130 be specified, which have access to different images. In this case, for example, references of images to the user data / client information / user identities could be deposited.

The client 130 can now access the social network 160 and the image server 110 access. It can then be the image server 110 the access control of the access decision using the decision-making means 113 that through the invention 100 created or updated. In this case, means previously or subsequently specified in this document can be used. For example, the client might 130 from the social network 160 to get a secret. Or the client 130 could face the social network 160 authenticate what this role is for an identity provider 140 occupies. It is also conceivable, other identity providers 140 to use. For example, similar methods or devices could be used, such as an Apache Web server, for which modules are available to authenticate against a variety of sources or to refer to a variety of sources.

• a. Zugriff auf die Daten zumindest einer Webplattform 160 und bestimmen der Daten, die für zumindest eine Zugriffsentscheidung auf zumindest eine Ressource 111 innerhalb der Webplattform 160 genutzt werden;
• b. berechnen und Speichern von Mitteln 113, die zu zumindest einer Zugriffsentscheidung genutzt werden, wobei diese Zugriffsentscheidung unter der Nutzung von Mitteln 114 des ressourcenausliefernden Systems 110 stattfindet.

In general, many possibilities are conceivable here through the aggregates, how this direct access could be carried out. In essence, the idea, and associated method or apparatus, is possessed by the invention 100 to use and images or similar of modern web platforms, especially social networks 160 to hedge the following steps. Of course, these or parts thereof may be combined with all other features of the invention.

• a. Access to the data of at least one web platform 160 and determining the data for at least one access decision to at least one resource 111 within the web platform 160 be used;
• b. calculate and save funds 113 which are used for at least one access decision, this access decision using resources 114 of the resource delivery system 110 takes place.

Thus, this embodiment of the invention 100 one possibility is the systems, the resources 111 like images or the like, in addition to the access decisions to use. This thus allows these resources 111 better secure and is doing better, the invention 100 can be used in an application.

The invention 100 can also have the property of being added to new functions at run time. For example, by reloading source code or compiled programs. This allows the invention 100 particularly flexible to adapt.

In 2a is an example of the legacy of decision-making 113 or even resources 111 demonstrated. The squares characterize the different systems 110 , named with 200 . 210 and 220 in which the resource 111 or the decision-making agents 113 can happen. The circles show orders of inheritance between means used for access decisions, for example, that come about by being on a resource 111 one or more parent resources 111 refer or it in the decision-making 113 is self defined, what is inherited from. It is possible to see that 211 from 201 inherits and 212 and 222 from 211 , Here is the inheritance between 211 and 201 between systems 210 and 200 and the inheritance between 222 and 211 between the systems 110 220 and 210 , The situation is similar between 202 and 221 . 223 and 224 ,

2 B shows another example of an inheritance. This is inherited from multiple parent objects. Multiple inheritance can have any number of ancestors from whom rights are inherited. This example of multiple concealment is discussed in 2c presented in a larger frame. It is shown that multiple inheritance also involves different systems 110 230 . 240 and 250 can happen across. As before, the arrowheads are to be seen as a parent-child assignment.

A variant of the invention 100 may also have capabilities that allow elements in the inheritance tree to be rearranged and the inheritance structure changed or inheritance turned off for individual elements as well. Turning on and off means that, on the one hand, elements that have one or more ancestors will have no or fewer ancestors in the future and thus inherit no or fewer rights or, conversely, elements that have no ancestors, will be assigned one or more ancestors. Likewise, elements can be assigned to new ancestors or ancestors. For such cases, the invention 100 They also have other resources, specialized for this purpose, which, for example, trigger new aggregate operations, including the new inheritance structure and the associated means of access 112 note.

Particularly preferred, the invention 100 also have a cycle checker during inheritance. For example, such can reveal cycles in inheritance hierarchies. This can be used for single as well as for multiple inheritance. An example of a cycle is in 2c to see. It inherits 242 from 241 and 231 from 242 , Well the connection could be 260 through the 241 be added by the 241 from 231 would inherit. Such and similar cases can be detected by a cycle checker.

Such a cycle checker could be realized, for example, by checking, when adding a new inheritance connection, whether the inheritance tree of element A is to inherit from element B in the future, already contains element B at any point in the previous tree, and if element A and B in FIG different objects are.

Because in the exemplary inheritance trees aggregates by the invention 100 with the respective resources 111 in the systems 110 can be associated, becomes another advantage of the invention 100 visible, noticeable. It is thus possible that to the respective systems 110 Inquiries are made that use the aggregates already at the request itself, in order to determine elements belonging to the result set. This makes it possible, for example, to exclude inappropriate elements already in a query, since all access information through aggregates is directly available. For example, objects of a class could be queried for which the requester has a specific role. Without aggregates, the ancestors would have to be interviewed as well, and this would be slow, especially in foreign systems, if at all technically possible. With aggregates, these can now be used to determine only applicable objects.

To the different systems 110 200 . 210 and 220 and their decision-making means 113 can access, for. B. the integration unit 101 be used. In that the invention 100 also has the aggregation means, it is possible to allow the inheritance system across. It uses the aggregation unit 102 z. As the integration unit, to the various systems 110 access. Because this has the opportunity, the decision-making means 113 from the different systems 110 To read, you can calculate from these aggregates. For example, she can 201 read and with the current content of 211 the absolute rights for 211 write, so this in turn for further access as a decision maker 113 can be used. Therefore, after that, for example 222 and 212 be calculated. Likewise this is so similarly for the further rights and for the inheritance of several ancestors implementable.

Note, however, that aggregation, as described above, may also include other steps, such as transforming the access decision means into the correct format. The aggregation can also be used to z. For example, to simplify long access control lists by, for example, duplicating entries, e.g. B. in heritage come to filter. Such transformations can be realized in the respective application by means of specially adapted transformation means.

The aggregation can be further characterized by the use of mechanisms from the functional Programming and / or the use of queuing theory to be accelerated. For example, the aggregation can be defined by declarative programming to achieve high parallelism. It is also possible that the aggregation techniques, such as Map Reduce, for example US7650331 , Amazon Elastic MapReduce ( http://aws.amazon.com/elasticmapreduce/ ) or similar, the z. More colorful http://de.wikipedia.org/wiki/MapReduce to find uses. Furthermore, findings from the queuing theory can be used to achieve a high data throughput.

3a shows the process by which aggregates are formed. First of all, the required resources needed for aggregate formation are determined 301 , Then one or more aggregates are formed 302 , Such required means may be, for example, the elements of which an element for which an aggregate is to be formed, inherits. In this case, the determination of the required means may also include the loading of the required funds. After the formation of the aggregates can also be done a write, the new decision maker 113 creates, deletes or updates. The determination or loading of the necessary means can also be performed by the integration unit, as well as the writing. It is also possible that this involves at least one computer network 50 be transmitted. It is also possible that the aggregation unit (s) and the integration unit (s) are created as a common unit. Thus, an aggregation unit 102 about all features of the integration unit 101 dispose and vice versa.

3b shows that aggregate formations can also trigger new aggregate formations 303 , For example, as in 3c an inheritance hierarchy exist. The fact that an aggregate of o1 is formed or the associated means that are used for access control, generated or updated, this could by the invention 100 and aggregates for o2 and o3 could be calculated. Likewise for o4, o5 and o6. In 3d this is shown. In this case, aggregates that are on the same hierarchy level, z. B. also be calculated in parallel.

The invention 100 may have specialized resources for such cases, such as B. allow to generate aggregates in parallel. For example, new processes can be created for each element at each new hierarchy level.

The actual forming of the aggregates can be specified by rules or computer programs. At the same time, rules or computer programs could be loaded dynamically at runtime. Such rules or computer programs may be optimized especially for the various means used for access decision.

Optionally, further, generating a flowchart for aggregate formation may be part of the invention 100 and the aggregate production process. Such a flowchart may serve as how and / or in which order aggregates should be determined for different access decision means. In doing so, this generation of a schedule may be done on the basis of the resource for which an aggregate uses the access decision means. It is also possible that the means or several means themselves are used to determine how the aggregate is to be formed. Moreover, it is also possible that further means of the invention 100 used to create such a flowchart.

For example, the invention 100 also have one or more inheritance trees, z. B. in several variants or instances in which information is stored, which inheritance between resources 111 or their access decision means exist. It could be used as a data structure z. For example, a specially adapted Patricia Trie, HAS Trie or Brust Trie, or a similar data structure (see "HAT-trie: A Cache-aware Trie-based Data Structure for Strings"). http://crpit.com/confpapers/CRPITV62Askitis.pdf ) serve. These could then be used in the aggregate formation and form a flowchart for z. For example, aggregates in the hierarchy can be calculated from top to bottom.

4 shows an integration unit 101 of the present invention 100 , This has an access performer 401 who has access to different systems 110 , about at least one integrator 402 , performs. The integrators 402 Include means to access different systems 110 to be able to access. Such integrators 402 can be created programmatically as a collection of functions or classes. Through these integrators 402 it is the integration unit 101 by the access operator possible, for. For example, perform the various operations described in this document for the means of access control. In the access provider 401 or in one or more integrators 402 or elsewhere in the integration unit 101 , previously discussed means of transformation can be used.

In the integrators 402 in the access provider 401 or elsewhere in the invention 100 can also be a model 500 access control means 112 that was previously discussed to be available. This can be, for example, as a transformation model 500 or for access by clients 130 serve as in 5 shown. In doing so, the means used for access decision, the model of System A 501 follow, first in the model of the invention 500 transformed and from this into the model of the system B 504 or also C 503 or D 502 , This allows, for example, not all different types of transformations of different systems 110 must be described to each other.

The invention 100 can, as mentioned, also have a storage unit. These may also be, for example, of the components of the invention, such as the integration unit 101 or aggregation unit 102 or their components are accessed. In this example, the data on inheritance relationships or other data can be stored. For example, a system might not support storing aggregate arbitrator and master arbitrator. Thus, the original decider could be prior to the aggregate process in the invention 100 remain and only the aggregate decider into the system 110 to be written. Unless the original decision maker on the invention 100 would change, this would create a new aggregate arbitrator. Or it would be possible if the aggregate decider in the system 110 has been changed, as compared with the original decision maker, in the invention 100 recognize the change and adjust the original decision maker accordingly.

As you can see, the integration unit 101 also via a cache / cache 404 feature. This should serve above all the acceleration. This can increase the speed of processing, such as in aggregate formations or even in the benefit of the invention 100 for access control. The cache can be 404 at various points in the invention 100 be used. It is also conceivable caches 404 to be used in several places.

In 4 is shown that a cache 404 from the integrators 402 and can be used by the access provider. For example, charged decision makers 113 in the cache 404 from integrators 402 or by the access provider 401 be filed. This or the integrators 402 could access the cache first before accessing it 404 check the content of the resources needed to avoid lengthy network latency attacks.

Furthermore, the invention 100 via a system directory 403 feature. In this can be deposited, for example, to which resources 111 which decision-making means 113 and / or systems 110 belong. It can be deposited in which systems 110 these funds can be retrieved, and / or by which integrators 402 these are to be found.

This information can be stored, for example, via simple mappings or via rules. For example, such rules may also specify how due to at least one identification feature of a resource 111 , at least one or more associated integrators 402 can be determined. It can be z. For example, a request to the system directory 403 about a resource 111 then be presented with at least one associated integrator 402 or a reference can be answered from this.

Thus, the system directory represents 403 Ready funds that make it possible through the integrators 402 and other related information to be managed.

In doing so, the access provider 401 in an access, for. Due to a resource 111 or one of its identification features, at least one associated integrator 402 determine and thus on their system and thus on their means of access decision 112 be accessed.

A, particularly preferred in the dynamic Internet environment, such as Web.2.0, used variant of the invention 100 has the ability to dynamically integrate or remove integrators. Such integrating means may be, for example, integrators or groups of integrators 402 be. In doing so, such integrators can 402 for example, dynamically adding the system directory 403 to be added. It could be z. In the integrator 402 itself or by additional information, such as the aforementioned rules, mappings or computer programs, be defined as the associated resources 111 can be seen. This could then also be in the system directory 403 be recorded. This makes it possible at runtime, also due to resources 111 or their identifiers, the new integrator 402 as belonging to determine and thus weave this seamlessly into the previous functionality of a system. Similar to the addition, the removal could be realized. The information would be the recognition of the associated resources 111 from the system directory 403 , together with the integrator 402 to be removed.

Another variant of the invention 100 can use means to dynamically add components. For example OSGI on the Java platform. For example, this could be the dynamic addition / registration and removal of integrators 402 will be realized.

The invention presented here 100 , Method, arrangement and apparatus may also be particularly preferably used to be used for video-sharing platforms. Especially to connect with social networks.

A particularly preferred application of this security system is the combination with a video platform or a live streaming video platform, such. For example, the "Newreporter System, Arrangements and Procedures for Video Platforms" filed by the inventor on April 4, 2010 for filing with the DPMA, and thus the state of the art (DPMA Official File Number: 10 2010 016 323.6). This Newreporter system can by combining with the invention, for example, with other systems 110 interact and inherit rights, and security functions can be realized based on client information, such as location-dependent security features.

Another, particularly preferred, application is the combination of the invention 100 with a hyper adapter ( EP09180953 ). Hereby, the invention, in particular the Yourweb variant, can be secured.

Another, particularly preferred, application is the combination of the invention 100 with a So-ad-tec system ( EP10001967 ). In this case, for example, the Nexusnodes system can be secured with it. It is also possible to protect a So-ad-tec system with it. Furthermore, the illustrated invention 100 also have a SCAPTCHA system or its functions described there or work together with such. This makes it possible, for example, to offer such a SCAPTCHA system as an infrastructure service, along with the other features described, in a cloud computing infrastructure.

Another use case is the hedging of business systems. For example, ERP systems, CRM systems, portals and the like. v. A.

It should be noted that this invention or group of inventions can be realized as computer-implemented systems or as computer programs. Due to the nature of this invention 100 All presented facts in different programming languages can be realized on different platforms. In addition, all procedures can be represented in declarative programs and thus in declarative situations and vice versa. Likewise, the processes can be converted as apparatuses or arrangements and vice versa.

In addition, due to the flexible nature of the invention, many individual parts of the invention discussed may be considered 100 combine or rearrange to provide better solutions at higher speeds or otherwise. Therefore, the description of the invention 100 rather than an exemplary embodiment of which features can also occur in other arrangements.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 7650331 [0106]
• EP 09180953 [0126]
• EP 10001967 [0127]

Cited non-patent literature

• http://cwiki.apache.org/confluence/display/SHIRO/Index [0003]
• http://aws.amazon.com/ [0026]
• http://code.google.com/intl/en-GB/appengine/ [0026]
• http://www.microsoft.com/technet/itsolutions/network/grundlagen/tec_comp_2_2_3.mspx [0088]
• http://openid.net/ [0088]
• http://en.wikipedia.org/wiki/Kerberos_(Computer Science) [0088]
• http://www.hznet.de/security/kerbeinf.pdf [0088]
• http://www.studivz.net/ [0092]
• http://www.wer-kennt-wen.de/ [0092]
• http://www.facebook.com/ [0092]
• http://aws.amazon.com/elasticmapreduce/ [0106]
• http://en.wikipedia.org/wiki/MapReduce [0106]
• http://crpit.com/confpapers/CRPITV62Askitis.pdf [0112]

Claims (15)

An invention ( 100 ) as a system or arrangements for securing access to resources ( 111 ), in particular for access via a computer network ( 50 ), the system or arrangement comprising: a. At least one means of integration that makes it possible to access at least one or more means used to make access decisions about access to at least one resource ( 111 ) to influence; b. At least one means of aggregation, which makes it possible to calculate aggregate access rights, wherein in the calculation, at least one means of access decision ( 112 ) is used. A system or arrangement according to claim 1, wherein the invention ( 100 ), at least one calculated right, at least one aggregate, is stored as a means that is used for at least one further access decision. A system or arrangement according to claim 1 or 2, wherein the invention ( 100 ) has at least one means of allowing at least one right to be exercised through at least two different systems ( 110 ) can be inherited. A system or arrangements according to any one of the preceding claims, wherein at least one access decision means ( 112 ) in computing at least one aggregate via at least one computer network ( 50 ) is accessed. A system or arrangements according to any one of the preceding claims, wherein the invention ( 100 ) has at least one inheritance tree indicating at least one inheritance relationship involving the inheritance of rights between at least two or more resources ( 111 ) Are defined. A system or arrangements according to one of the preceding claims, wherein at least one access decision in the source code of a program specified means are taken into account. A system or assemblies according to any one of the preceding claims, wherein incorporation or removal of integration means at runtime can occur. A system or arrangements according to any one of the preceding claims, wherein access by at least one client ( 130 ), on at least one resource ( 111 ), directly by evaluating at least one of the invention ( 100 ) or access decision ( 112 ) happens. A system or arrangements according to any one of the preceding claims, wherein the invention ( 100 ) has cryptographic means and / or can interact with such means of another system or platform. A system or arrangements according to any one of the preceding claims, wherein the invention ( 100 ) is shared with a cloud computing platform or used as an infrastructure service. A system or arrangements according to one of the preceding claims, wherein at least one client information is taken into account in at least one access decision, directly or indirectly through aggregates. A system or arrangements according to one of the preceding claims, wherein in at least one access decision, directly or indirectly by aggregates, at least one hierarchy, of roles and / or rights associated with at least one resource ( 111 ) is observed. A method for securing access to resources ( 111 ), in particular for access via a computer network ( 50 ), the method comprising the steps of: a. Access to one or more resources ( 112 ) that are used to make access decisions about accessing at least one resource ( 111 ) to influence; b. Calculating at least one aggregate, wherein at least one access decision ( 112 ) is used The method of claim 13, further comprising the step of access decision, said access decision using resources ( 112 ) of the resource-delivering system ( 110 ) and at least one means, which was used in the calculation of the aggregate, to a web platform ( 160 ) is associated. A computer program comprising instructions for carrying out a method according to any of the preceding claims 13-14.

Images