Knowledge-based control of security objects

• US 20040064724A1
• Filed: 09/12/2002
• Published: 04/01/2004
• Est. Priority Date: 09/12/2002
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Spinac, Clifford Jay, Rodriguez, Herman, Smith, Newton James Jr., Himmel, Benjamin Andrew, Himmel, Maria Azua
• Application Number:
  US10/242,548
• Publication Number:
  US 20040064724A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Controlling access to a resource, including creating a security object in dependence upon user-selected security control data types, including asserting security control data as security facts into a security knowledge database and asserting security rules into the security knowledge database, the security object including security control data and at least one security method, receiving a request for access to the resource, and receiving security request data. Embodiments include asserting the security request data as security facts into the security knowledge database, and determining access to the resource in dependence upon the security facts and security rules in the security knowledge database.

Claims

1. A method of controlling access to a resource, the method comprising:

creating a security object in dependence upon user-selected security control data types, including asserting security control data as security facts into a security knowledge database and asserting security rules into the security knowledge database, the security object comprising security control data and at least one security method;

receiving a request for access to the resource;

receiving security request data;

asserting the security request data as security facts into the security knowledge database; and

determining access to the resource in dependence upon the security facts and security rules in the security knowledge database.

2. The method of claim 1 further comprising removing from the security knowledge database at least some of the security request data asserted as security facts.

3. The method of claim 1 wherein creating a security object further comprises:

storing in the security object a resource identification for the resource;

storing in the security object an authorization level of access for the resource;

storing in the security object user-selected security control data types; and

storing, in the security object, security control data for each user-selected security control data type.

4. The method of claim 1 wherein determining access includes authorizing a level of access in dependence upon the authorization level of access for the resource.

5. The method of claim 1 wherein determining access to the resource further comprises inferring whether access is granted, the inferring carried out in dependence upon the security facts and security rules in the security knowledge database.

6. The method of claim 1 wherein determining access to the resource further comprises inferring with an inference engine whether access is granted, the inferring carried out in dependence upon the security facts and security rules in the security knowledge database.

7. The method of claim 1 further comprising deploying the security object.

8. The method of claim 1 wherein receiving a request for access to the resource comprises calling the security method.

9. The method of claim 1 wherein receiving a request for access to the resource further comprises identifying the security object.

10. The method of claim 9 wherein identifying the security object comprises identifying the security object in dependence upon a URI.

11. The method of claim 9 wherein identifying the security object comprises identifying the security object in dependence upon a URI that identifies the resource, including finding, in dependence upon the URI identifying the resource, an identification of the security object in an access control table.

12. A system for controlling access to a resource, the system comprising:

means for creating a security object in dependence upon user-selected security control data types, including means for asserting security control data as security facts into a security knowledge database and asserting security rules into the security knowledge database, the security object comprising security control data and at least one security method;

means for receiving a request for access to the resource;

means for receiving security request data;

means for asserting the security request data as security facts into the security knowledge database; and

means for determining access to the resource in dependence upon the security facts and security rules in the security knowledge database.

13. The system of claim 12 further comprising means for removing from the security knowledge database at least some of the security request data asserted as security facts.

14. The system of claim 12 wherein means for creating a security object further comprises:

means for storing in the security object a resource identification for the resource;

means for storing in the security object an authorization level of access for the resource;

means for storing in the security object user-selected security control data types; and

means for storing, in the security object, security control data for each user-selected security control data type.

15. The system of claim 12 wherein means for determining access includes means for authorizing a level of access in dependence upon the authorization level of access for the resource.

16. The system of claim 12 wherein means for determining access to the resource further comprises means for inferring whether access is granted, the means for inferring operating in dependence upon the security facts and security rules in the security knowledge database.

17. The system of claim 12 wherein means for determining access to the resource further comprises means for inferring with an inference engine whether access is granted, the means for inferring operating in dependence upon the security facts and security rules in the security knowledge database.

18. The system of claim 12 further comprising means for deploying the security object.

19. The system of claim 12 wherein means for receiving a request for access to the resource comprises means for calling the security method.

20. The system of claim 12 wherein means for receiving a request for access to the resource further comprises means for identifying the security object.

21. The system of claim 20 wherein means for identifying the security object comprises means for identifying the security object in dependence upon a URI.

22. The system of claim 20 wherein means for identifying the security object comprises means for identifying the security object in dependence upon a URI that identifies the resource, including means for finding, in dependence upon the URI identifying the resource, an identification of the security object in an access control table.

23. A computer program product for controlling access to a resource, the computer program product comprising:

a recording medium;

means, recorded on the recording medium, for creating a security object in dependence upon user-selected security control data types, including means, recorded on the recording medium, for asserting security control data as security facts into a security knowledge database and asserting security rules into the security knowledge database, the security object comprising security control data and at least one security method;

means, recorded on the recording medium, for receiving a request for access to the resource;

means, recorded on the recording medium, for receiving security request data;

means, recorded on the recording medium, for asserting the security request data as security facts into the security knowledge database; and

means, recorded on the recording medium, for determining access to the resource in dependence upon the security facts and security rules in the security knowledge database.

24. The computer program product of claim 23 further comprising means, recorded on the recording medium, for removing from the security knowledge database at least some of the security request data asserted as security facts.

25. The computer program product of claim 23 wherein means, recorded on the recording medium, for creating a security object further comprises:

means, recorded on the recording medium, for storing in the security object a resource identification for the resource;

means, recorded on the recording medium, for storing in the security object an authorization level of access for the resource;

means, recorded on the recording medium, for storing in the security object user-selected security control data types; and

means, recorded on the recording medium, for storing, in the security object, security control data for each user-selected security control data type.

26. The computer program product of claim 23 wherein means, recorded on the recording medium, for determining access includes means, recorded on the recording medium, for authorizing a level of access in dependence upon the authorization level of access for the resource.

27. The computer program product of claim 23 wherein means, recorded on the recording medium, for determining access to the resource further comprises means, recorded on the recording medium, for inferring whether access is granted, the inferring carried out in dependence upon the security facts and security rules in the security knowledge database.

28. The computer program product of claim 23 wherein means, recorded on the recording medium, for determining access to the resource further comprises means, recorded on the recording medium, for inferring with an inference engine whether access is granted, the inferring carried out in dependence upon the security facts and security rules in the security knowledge database.

29. The computer program product of claim 23 further comprising means, recorded on the recording medium, for deploying the security object.

30. The computer program product of claim 23 wherein means, recorded on the recording medium, for receiving a request for access to the resource comprises means, recorded on the recording medium, for calling the security method.

31. The computer program product of claim 23 wherein means, recorded on the recording medium, for receiving a request for access to the resource further comprises means, recorded on the recording medium, for identifying the security object.

32. The computer program product of claim 31 wherein means, recorded on the recording medium, for identifying the security object comprises means, recorded on the recording medium, for identifying the security object in dependence upon a URI.

33. The computer program product of claim 31 wherein means, recorded on the recording medium, for identifying the security object comprises means, recorded on the recording medium, for identifying the security object in dependence upon a URI that identifies the resource, including means, recorded on the recording medium, for finding, in dependence upon the URI identifying the resource, an identification of the security object in an access control table.