System and method for access control and identity management

摘要

A mechanism for the flow of access by derivation is provided. An access point may be any object, such as files or functions, to which the access recipient is granted access rights by the access provider. Access is typically represented by a relationship object referencing the access provider function, the access recipient function, and the access point object, and a set of access rights. This membership access relationship object is typically represented as a subtype of the access relationship. When a membership access relationship is created, typically a new associated persona function is generated, representing the new identity created for the access recipient function while serving as a member of the access point function. When a persona function is invited to be a member in another function, that in turn generates a membership and a second persona that is derived from the first persona, resulting in identity derivation.

主权项

1. A computer program product for decomposing functions having computer code stored in a non-transitory tangible storage medium that when read and executed by a computer causes the following steps to be performed in a computer system:
creating a first function, a second function, and a third function; creating a first identity object with a first associated identifier for the first function, a second identity object with a second associated identifier for the second function, and a third identity object with a third associated identifier for the third function, wherein each of the first, second and third identity objects has a separately evolving information set in the computer system; joining in a membership object the first identity object, the second identity object, and the third function, wherein the first identity object is a membership provider, the second identity object is a membership recipient, and the third function is a membership target, so that the second identity object is a member of the third function, creating a fourth identity object with an associated fourth identifier that derives from the second identity object, so that the third function is decomposable into a collection of member functions through the creation of new membership objects, accomplishing decomposition of the membership target through the creation of new membership objects, wherein the fourth identity object is a member function of the membership target, whereby the creation of any member functions generates new membership objects, creating an expanding program structure and a collaborative means for interpreting the functional structure of a computer program wherein all of the member functions participate in the interpretation, performing interpretation dynamically at system runtime; creating separately evolving information sets for the identity objects associated with any of the member functions; providing immediate access for the member functions to the information set of the membership target so that the member functions can immediately access and operate on the information set of the membership target; wherein the member functions are distributable within a single system, throughout a multi-node system, or throughout a distributed graph database system on one or a plurality of machines so that work of any of the member functions is also distributable; and applying specific access rights controlling how each of the member functions accesses or operates on the information set of the membership target so that the information set-or a subset of the information set of the membership target is made accessible to any one of the member functions of the membership target, whereby different subsets of information are accessible to each member function; wherein membership recipients and derived identity objects that license the membership recipients are functions that interpret the membership target, the interpreters configured to further decompose the work of the membership target into at least one additional member function so that membership in a membership object propagates a self-generating and dynamically expanding functional system through the creation of additional member functions by the interpreters of the membership target function.