Multi-focused fine-grained security framework

• US 10,354,078 B2
• Filed: 09/27/2017
• Issued: 07/16/2019
• Est. Priority Date: 04/16/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Beamon, Bridget B., Debroni, Bradley M., Filoti, Octavian F., Kyle, Bryan J., Nolan, Christopher M.
• Primary Examiner(s): Sholeman, Abu S
• Application Number:
  US15/717,363
• Publication Number:
  US 20180032742A1
• Time in Patent Office: 657 Days
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An approach is provided in which a knowledge manager generates a knowledge structure that includes security annotation tokens and term tokens. Each of the security annotation tokens are stored in a parallel field and align to at least one of the term tokens. The knowledge manager matches security policies corresponding to a search request to one or more of the security annotation tokens and, in turn, generates search results based upon obfuscation of one or more of the term tokens aligned to the matched security annotation tokens.

Claims

1. A method implemented by an information handling system that includes a memory and a processor, the method comprising:

receiving, at a question answer system, a search request initiated by a user;

identifying, by the question answer system, one or more user authorizations corresponding to the user;

generating, by the question answer system, one or more answers of the search request based upon the one or more user authorizations, wherein the generation of the one or more answers comprises;

creating one or more preliminary search results from searching a knowledge structure utilizing one or more search restriction policies corresponding to the one or more user authorizations, wherein the knowledge structure includes a plurality of security annotation tokens and a plurality of term tokens, each of the plurality of security annotation tokens stored in at least one of a plurality of parallel fields corresponding to at least one of the plurality of term tokens;

scoring the one or more preliminary search results based upon one or more scoring security policies corresponding to the one or more user authorizations, resulting in one or more scored preliminary search results; and

generating the one or more answers from the scored preliminary search results by removing one or more passages from the scored preliminary search results based upon one or more passage authorization security policies corresponding to the one or more user authorizations; and

displaying, by the question answer system, a modified version of at least one of the one or more answers, wherein the modified version of the one or more answers obfuscates one or more of the plurality of term tokens whose corresponding security annotation token matches at least one or more visualization security policies corresponding to the one or more user authorizations.

2. An information handling system comprising:

one or more processors;

a memory coupled to at least one of the processors; and

a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of;

receiving, at a question answer system, a search request initiated by a user;

identifying, by the question answer system, one or more user authorizations corresponding to the user;

generating, by the question answer system, one or more answers of the search request based upon the one or more user authorizations, wherein the generation of the one or more answers comprises;

creating one or more preliminary search results from searching a knowledge structure utilizing one or more search restriction policies corresponding to the one or more user authorizations, wherein the knowledge structure includes a plurality of security annotation tokens and a plurality of term tokens, each of the plurality of security annotation tokens stored in at least one of a plurality of parallel fields corresponding to at least one of the plurality of term tokens;

scoring the one or more preliminary search results based upon one or more scoring security policies corresponding to the one or more user authorizations, resulting in one or more scored preliminary search results; and

generating the one or more answers from the scored preliminary search results by removing one or more passages from the scored preliminary search results based upon one or more passage authorization security policies corresponding to the one or more user authorizations; and

displaying, by the question answer system, a modified version of at least one of the one or more answers, wherein the modified version of the one or more answers obfuscates one or more of the plurality of term tokens whose corresponding security annotation token matches at least one or more visualization security policies corresponding to the one or more user authorizations.

3. A computer program product stored in a computer readable storage medium, comprising computer program code that, when executed by an information handling system, causes the information handling system to perform actions comprising:

receiving, at a question answer system, a search request initiated by a user;

identifying, by the question answer system, one or more user authorizations corresponding to the user;

generating, by the question answer system, one or more answers of the search request based upon the one or more user authorizations, wherein the generation of the one or more answers comprises;

creating one or more preliminary search results from searching a knowledge structure utilizing one or more search restriction policies corresponding to the one or more user authorizations, wherein the knowledge structure includes a plurality of security annotation tokens and a plurality of term tokens, each of the plurality of security annotation tokens stored in at least one of a plurality of parallel fields corresponding to at least one of the plurality of term tokens;

scoring the one or more preliminary search results based upon one or more scoring security policies corresponding to the one or more user authorizations, resulting in one or more scored preliminary search results; and

generating the one or more answers from the scored preliminary search results by removing one or more passages from the scored preliminary search results based upon one or more passage authorization security policies corresponding to the one or more user authorizations; and

displaying, by the question answer system, a modified version of at least one of the one or more answers, wherein the modified version of the one or more answers obfuscates one or more of the plurality of term tokens whose corresponding security annotation token matches at least one or more visualization security policies corresponding to the one or more user authorizations.