Microsoft patents system that mixes role and attribute access controls
Microsoft describes a computer system that manages who can access digital files by checking two different types of security rules. When a user requests access, the system first identifies if the file uses role-based or attribute-based protection, then verifies the user's identity against the specific rules for that file type.
In the filing’s own words
Hybrid access control management systems for managing role-based access control resources and attribute-based access control resources are provided. One aspect provides a computing system for implementing hybrid access control management, the computing system comprising: processing circuitry coupled to memory that stores instructions, which, upon execution by the processing circuitry, cause the processing circuitry to: receive a request from a user account to access an access-controlled resource; determine a protection mechanism of the access-controlled resource, wherein the protection mechanism is an attribute-based protection mechanism or a role-based protection mechanism; validate the request from the user account based on the determination of the protection mechanism; and permit the user account to access the access-controlled resource upon successful validation of the request.
What exactly they claim (claim 1)
1. A computing system for implementing hybrid access control management, the computing system comprising: processing circuitry coupled to memory that stores instructions, which, upon execution by the processing circuitry, cause the processing circuitry to: receive a request from a user account to access an access-controlled resource; determine a protection mechanism of the access-controlled resource, wherein the protection mechanism is an attribute-based protection mechanism or a role-based protection mechanism; validate the request from the user account based on the determination of the protection mechanism, wherein validating the request comprises: in response to determining that the protection mechanism is a role-based protection mechanism: determining a role of the user account, wherein the role of the user account is assigned automatically based on data of the user account, and wherein the role of the user account is updated dynamically as the data of the user account is updated; and validating the role of the user account against a role-based access control policy describing one or more roles permitted to access the access-controlled resource; and in response to determining that the protection mechanism is an attribute-based protection mechanism: retrieving attributes associated with an attribute-based access control policy describing attribute values permitted to access the access-controlled resource; and validating the retrieved attributes against the attribute-based access control policy, wherein the attributes and the data of the user account for determining the role of the user account are stored in a policy information point database; and permit the user account to access the access-controlled resource upon successful validation of the request.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- Hybrid access control resource management
- Patent number
- US12755038B2
- Application number
- 18474157
- Filed
- Sep 25, 2023
- Granted
- Oct 6, 2026
- Inventors
- 2
- Claims
- 16
Classified under
G06F 21/6209 Physics & computingG06F 21/31 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.