Abstract: A satellite system may have a constellation of communications satellites that provides services to users with user devices such as portable electronic devices and home and office equipment. The constellation of satellites may include low-earth orbit satellites or other non-geostationary satellites having coverage areas that move across the surface of the Earth as the satellites orbit the Earth. The system may have gateways that communicate with the user devices as satellites move into and out of range. Computing equipment at a gateway or associated metropolitan point of presence may direct the gateways to handover communications sessions with the user devices from an outgoing satellite to an incoming satellite. Handover operations may involve handovers in prioritized batches, make-before-break handover procedures, and break-before-make handover procedures.

Abstract: A method of defining policies for controlling access to resources of a system. Authorization requirements for the system are modeled to obtain a model expressing each of a plurality of access control policies as a constraint. From the model is generated a single policy set in an authorization markup language that captures the requirements. This method can be used to define role-based access control policies in a format that can be adapted for input to a variety of access control mechanisms. This generative approach to access control design allows maintenance to be performed at the requirements level.

Abstract: A method of defining policies for controlling access to resources of a system. Authorization requirements for the system are modeled to obtain a model expressing each of a plurality of access control policies as a constraint. From the model is generated a single policy set in an authorization markup language that captures the requirements. This method can be used to define role-based access control policies in a format that can be adapted for input to a variety of access control mechanisms. This generative approach to access control design allows maintenance to be performed at the requirements level.

Abstract: An apparatus to implement role based access control which reduces administrative expenses associated with managing access in accordance with policies and roles. The apparatus includes a memory storing a first role based access control condition associated with an action and a subsystem executing an enforcement entity and a decision entity. In one preferred form, the two entities are independent entities. The enforcement entity receives a request for the action from a requestor with a role. Additionally, the enforcement entity communicates the role and the request to the decision entity for the decision entity's decision of whether the role satisfies the first condition. The decision entity then communicates the decision to the enforcement entity. Accordingly, the enforcement entity allows or denies the requestor the action based on the decision made by the decision entity.