Systems and methods for dynamically generating licenses in a rights management system

• US 20040039594A1
• Filed: 06/12/2003
• Published: 02/26/2004
• Est. Priority Date: 01/09/2002
• Status: Abandoned Application

• Current Assignee: Innerpresence Networks Incorporated
• Original Assignee: Innerpresence Networks Incorporated
• Inventors: Ranganathan, Srikanth, Myersdorf, Doron, Dickenson, Ray, Narasimhan, Anand
• Application Number:
  US10/460,738
• Publication Number:
  US 20040039594A1
• Time in Patent Office: Days
• US Class Current: 705/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Policies that govern the rights of system assets with respect to other system assets are enforced through dynamic generation of a license at a policy engine in response to a request by an asset to exercise a right with respect to another asset. The system assets are objects within the system to which behavior-regulating policies are applied. Typical types of system assets include users, devices, information files, and processes, and many other types of assets may also be defined. Upon receiving a request to exercise a right, the policy engine obtains predefined policies that are relevant to the request, and obtains factual information for evaluating the current state of transient conditions upon which rights are contingent as expressed in the policies. Through evaluation of the policies, the policy engine generates a license that expresses rights or prohibitions of the requesting asset with respect to another specified asset.

Claims

1. A method for regulating the behavior of assets within a system, comprising:

receiving a request for a license governing the exercise of a right by a first system asset with respect to a second system asset;

determining policies relevant to the exercise of the right by the first system asset with respect to the second system asset;

acquiring facts required for evaluation of the policies;

dynamically generating a license governing the exercise of the right by the first asset with respect to the second asset in accordance with the relevant policies and the acquired facts; and

providing the license to the requester of the license.

2. The method claimed in claim 1, wherein the first asset is a system user and the second asset is an information file, and the right is an action to be taken by the user with respect to the information file.

3. The method claimed in claim 2, wherein the information file is one of a document, a spreadsheet, a data file, data packet, buffer stream, real time communication, an audit trail, a policy, an email message, an image file, an audio file, and a video file.

4. The method claimed in claim 2, wherein the request further specifies a device at which the user wishes to exercise the right with respect to the information file.

5. The method claimed in claim 1, wherein the system assets include users, processes, devices and information files.

6. The method claimed in claim 5, wherein the system assets further include applications.

7. The method claimed in claim 1, wherein the request specifies a format in which the license is to be provided, and the license is provided in the specified format.

8. The method claimed in claim 7, wherein the format is one of XrML, ODRL and a tagged representation.

9. The method claimed in claim 1, wherein the request comprises an indication of a quality of service required in processing of the request, and said determining, acquiring and generating are performed in accordance with said quality of service.

10. The method claimed in claim 9, wherein the quality of service involves one of speed of processing and priority of processing.

11. The method claimed in claim 1, wherein a quality of service for said determining, acquiring and generating is determined in accordance with a quality of service rule.

12. The method claimed in claim 1, wherein the policies relevant to the exercise of the right are determined from among multiple policies having predefined relationships indicating their relative priorities.

13. The method claimed in claim 12, wherein the predefined relationships among policies are expressed in the form of a policy hierarchy arranged according the relative priorities of policies.

14. The method claimed in claim 13, wherein a hierarchy of policies is established for each type of asset defined in the system.

15. The method claimed in claim 13, wherein the predefined relationships among policies are further expressed in the form of conflict resolution rules for resolving conflicts among decisions yielded by policies of different hierarchies.

16. The method claimed in claim 1, wherein the second asset is an information file and the policies relevant to the exercise of the right are encapsulated with the information file.

17. The method claimed in claim 16, wherein the information file is stored in a network cache, and said method is performed in a device in communication with the cache.

18. The method claimed in claim 1, wherein relevant policies are retrieved as pre-assembled policy stacks corresponding to the first asset and the second asset.

19. The method claimed in claim 1, wherein relevant policies are determined in accordance with probabilities associated with each policy.

20. The method claimed in claim 1, wherein relevant policies are determined in accordance with probabilities associated with rules within policies.

21. The method claimed in claim 1, wherein the facts acquired for evaluation of the policies include group affiliations of the first and second asset.

22. The method claimed in claim 1, wherein the acquired facts comprise the current states of transient conditions upon whose states the exercise of rights are made contingent in said policies.

23. The method claimed in claim 22, wherein said current state is the current state of a physical security system.

24. The method claimed in claim 1, wherein the method is implemented on a server that receives requests from client agents at devices of the system.

25. The method claimed in claim 1, wherein the method is implemented in a client agent at a device where the first asset wishes to exercise the right with respect to the second asset.

26. The method claimed in claim 1, wherein the relevant policies are determined from among policies implementing regulations of the Health Insurance Portability and Accountability Act (HIPAA).

27. The method claimed in claim 1, wherein the relevant policies are determined from among policies implementing regulations of the Sarbanes-Oxley act.

28. The method claimed in claim 1, wherein the relevant policies are determined from among policies implementing regulations of part 11 of section 21 of the Code of Federal Regulations.

29. The method claimed in claim 1, wherein the relevant policies are determined from among policies implementing regulations of the Federal Information Privacy Standard.

30. The method claimed in claim 1, wherein the relevant policies are determined from among policies implementing regulations of the ISO 17799 standard for information security.

31. The method claimed in claim 1, further comprising:

dynamically generating a second license in response to the request upon a change of a fact required for evaluation of the license; and

providing the second license to the requester such that the second license superceded the previous license.

32. The method claimed in claim 1, wherein said policies dynamically change in response to changes in facts.

33. The method claimed in claim 32, wherein said policies dynamically change in response to time proximity to an event.

34. The method claimed in claim 32, wherein said policies dynamically change in response to a session parameter.

35. The method claimed in claim 32, wherein said policies are policies that control execution of web services and said policies dynamically change based on one of the status of other assets, a level of activity, and a virus warning.

36. The method claimed in claim 1, wherein determining said policies comprises obtaining policies from an outside domain to which one of said first and second asset belongs.

37. A programmable device for regulating the behavior of assets within a system, the device comprising a computer readable medium storing programming code for performing processing comprising:

receiving a request for a license governing the exercise of a right by a first system asset with respect to a second system asset;

determining policies relevant to the exercise of the right by the first system asset with respect to the second system asset;

acquiring facts required for evaluation of the policies;

dynamically generating a license governing the exercise of the right by the first asset with respect to the second asset in accordance with the relevant policies and the acquired facts; and

providing the license to the requester of the license.

38. A method for creating a policy for regulating the behavior of assets within a system, comprising:

monitoring activities with respect to an asset of the system;

applying metrics to the monitored activities to derive a value for the asset; and

creating a policy for governing behavior with respect to the asset in accordance with the assigned value.

39. The method claimed in claim 38, wherein creating a policy comprises selecting a policy from among predefined policies.

40. The method claimed in claim 38, wherein creating a policy comprises revising a policy governing behavior with respect to the asset.

41. A method for assessing the effects of a proposed policy for regulating the behavior of assets within a system, comprising:

defining relationships between the proposed policy and other system policies; and

evaluating the proposed policies and other policies of the system in accordance with said predefined relationships to identify conflicting decisions yielded by the proposed policy and the other policies.

42. A method for assessing the effects of a proposed policy for regulating the behavior of assets within a system, comprising:

defining relationships between the proposed policy and other system policies;

monitoring decisions yielded by the proposed policy in response to one of current system activities and historical system activities without enforcing the decisions yielded by the proposed policy.

43. A method for assessing the effects of a proposed policy for regulating the behavior of assets within a system, comprising:

defining relationships between the proposed policy and other system policies;

monitoring decisions yielded by the proposed policy in response to one of current system activities and historical system activities while selectively enforcing the decisions yielded by rules within the proposed policy.

44. A programmable device for regulating the behavior of assets within a system, the device comprising a computer readable medium storing programming code for performing processing comprising:

displaying a list of system assets owned by a user of the client device; and

providing tools enabling the user to perform at least one of;

associating a predefined policy with a system asset owned by the user;

modifying a rule of a policy associated with a system asset owned by the user;

modifying a policy associated with a system asset owned by the user;

creating a new policy and associating the policy with a system asset owned by the user.

45. The programmable device claimed in claim 44, wherein the list of system assets owned by the user is determined in accordance with a predefined role associated with the user.

46. A programmable device for regulating the behavior of assets within a system, the device comprising a computer readable medium storing programming code for performing processing comprising:

monitoring the behavior of specified assets within the system; and

displaying reports concerning the behavior of said specified assets.

47. The programmable device claimed in claim 46, wherein said processing further comprises enabling a user to specify assets to be monitored and actions to be monitored.

48. A method for creating a policy for regulating the behavior of assets within a system, comprising:

monitoring activities with respect to an asset of the system;

applying metrics to the monitored activities to derive a value for the asset; and

creating a policy for governing behavior with respect to the asset in accordance with the derived value.