Providing a necessary level of security for computers capable of connecting to different computing environments

• US 20050091355A1
• Filed: 10/02/2003
• Published: 04/28/2005
• Est. Priority Date: 10/02/2003
• Status: Abandoned Application

• Current Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Keohane, Susann Marie, McBrearty, Gerald Francis, Shieh, Johnny Meng-Han, Mullen, Shawn Patrick, Murillo, Jessica
• Application Number:
  US10/677,660
• Publication Number:
  US 20050091355A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 28/14 using intermediate storage

Abstract

Providing a necessary level of security for a computer capable of connecting to different computing environments, including monitoring (402) a type of connection between the computer and a network in a current computing environment; determining (406) a security level of data (408) before sending the data across the network; storing (416) the data in a buffer instead of sending the data across the network if the connection to the network lacks a security control (410) required for the determined security level of the data; and sending (420) the data from the buffer when the computer is connected to a changed computing environment having a new type of connection that has (412) the security control required for the data.

Claims

1. A method for providing a necessary level of security for a computer capable of connecting to different computing environments, the method comprising:

monitoring a type of connection between the computer and a network in a current computing environment;

determining a security level of data before sending the data across the network;

storing the data in a buffer instead of sending the data across the network if the connection to the network lacks a security control required for the determined security level of the data; and

sending the data from the buffer when the computer is connected to a changed computing environment having a new type of connection that has the security control required for the data.

2. The method of claim 1 wherein monitoring a type of connection comprises periodically determining the type of connection between the computer and the network.

3. The method of claim 1 wherein monitoring a type of connection comprises event-driven determining of the type of connection between the computer and the network.

4. The method of claim 3 wherein the steps of the method are carried out by a software process and event-driven determining of the type of connection is carried out whenever the process is invoked.

5. The method of claim 3 wherein determining a security level results in a determination that data to be transmitted requires at least some level of security and event-driven determining of the type of connection is carried out in response to such determination.

6. The method of claim 1 wherein determining a security level of data before sending the data across the current network comprises reading the security level of data from a markup element embedded in the data.

7. The method of claim 1 wherein determining a security level of data before sending the data across the current network comprises reading the security level of data from meta-data in a header in a network message.

8. The method of claim 1 further comprising returning a non-fatal error to a sending program if the connection to the network lacks a security control required for the data.

9. The method of claim 8 further comprising the sending program'"'"'s informing a user that the data will be held in a security buffer until the computer is connected to a changed computing environment having a new type of connection that has the security control required for the data.

10. The method of claim 8 further comprising the sending program'"'"'s prompting a user with the option to create a secure tunnel for transmission of the data.

11. A method for providing a necessary level of security for a computer capable of connecting to different computing environments, the method comprising:

connecting the computer to a network in a first computing environment;

specifying a security level for data to be sent across the network;

instructing a sending program to send the data across the network;

receiving an indication that security control of the first computing environment lacks a security control required for the specified security level;

connecting the computer to the network in a second computing environment, wherein the second computing environment has the security control required for the specified security level; and

receiving an indication that the data has been sent across the network.

12. The method of claim 11 further comprising:

determining, when the computer is connected to the second network, that the second computing environment has the security control required for the specified security level; and

automatically sending the data across the network promptly upon determining that the second computing environment has the security control required for the specified security level.

13. The method of claim 11 further comprising:

receiving an indication that the second computing environment has the security control required for the specified security level; and

again instructing the sending program to send the data across the network.

14. A system for providing a necessary level of security for a computer capable of connecting to different computing environments, the system comprising:

means for monitoring a type of connection between the computer and a network in a current computing environment;

means for determining a security level of data before sending the data across the network;

means for storing the data in a buffer instead sending the data across the network if the connection to the network lacks a security control required for the determined security level of the data; and

means for sending the data from the buffer when the computer is connected to a changed computing environment having a new type of connection that has the security control required for the data.

15. The system of claim 14 wherein means for monitoring a type of connection comprises means for periodically determining the type of connection between the computer and the network.

16. The system of claim 14 wherein means for monitoring a type of connection comprises means for event-driven determining of the type of connection between the computer and the network.

17. The system of claim 16 wherein elements of the system are operated by a software process and means for event-driven determining of the type of connection is operated whenever the process is invoked.

18. The system of claim 16 wherein operation of the means for determining a security level results in a determination that data to be transmitted requires at least some level of security and means for event-driven determining of the type of connection operates in response to such determination.

19. The system of claim 14 wherein means for determining a security level of data before sending the data across the current network comprises means for reading the security level of data from a markup element embedded in the data.

20. The system of claim 14 wherein means for determining a security level of data before sending the data across the current network comprises means for reading the security level of data from meta-data in a header in a network message.

21. The system of claim 14 further comprising means for returning a non-fatal error to a sending program if the connection to the network lacks a security control required for the data.

22. The system of claim 21 further comprising means for the sending program to inform a user that the data will be held in a security buffer until the computer is connected to a changed computing environment having a new type of connection that has the security control required for the data.

23. The system of claim 21 further comprising means for the sending program to prompt a user with the option to create a secure tunnel for transmission of the data.

24. A system for providing a necessary level of security for a computer capable of connecting to different computing environments, the system comprising:

means for connecting the computer to a network in a first computing environment;

means for specifying a security level for data to be sent across the network;

means for instructing a sending program to send the data across the network;

means for receiving an indication that security control of the first computing environment lacks a security control required for the specified security level;

means for connecting the computer to the network in a second computing environment, wherein the second computing environment has the security control required for the specified security level; and

means for receiving an indication that the data has been sent across the network.

25. The system of claim 24 further comprising:

means for determining, when the computer is connected to the second network, that the second computing environment has the security control required for the specified security level; and

means for automatically sending the data across the network promptly upon determining that the second computing environment has the security control required for the specified security level.

26. The system of claim 24 further comprising:

means for receiving an indication that the second computing environment has the security control required for the specified security level; and

means for again instructing the sending program to send the data across the network.

27. A computer program product for providing a necessary level of security for a computer capable of connecting to different computing environments, the computer program product comprising:

a recording medium;

means, recorded on the recording medium, for monitoring a type of connection between the computer and a network in a current computing environment;

means, recorded on the recording medium, for determining a security level of data before sending the data across the network;

means, recorded on the recording medium, for storing the data in a buffer instead sending the data across the network if the connection to the network lacks a security control required for the determined security level of the data; and

means, recorded on the recording medium, for sending the data from the buffer when the computer is connected to a changed computing environment having a new type of connection that has the security control required for the data.

28. The computer program product of claim 27 wherein means for monitoring a type of connection comprises means, recorded on the recording medium, for periodically determining the type of connection between the computer and the network.

29. The computer program product of claim 27 wherein means for monitoring a type of connection comprises means, recorded on the recording medium, for event-driven determining of the type of connection between the computer and the network.

30. The computer program product of claim 29 wherein elements of the system are operated by a software process and the means for event-driven determining of the type of connection is executed whenever the process is invoked.

31. The computer program product of claim 29 wherein execution of the means for determining a security level results in a determination that data to be transmitted requires at least some level of security and means for event-driven determining of the type of connection executes in response to such determination.

32. The computer program product of claim 27 wherein means for determining a security level of data before sending the data across the current network comprises means, recorded on the recording medium, for reading the security level of data from a markup element embedded in the data.

33. The computer program product of claim 27 wherein means for determining a security level of data before sending the data across the current network comprises means, recorded on the recording medium, for reading the security level of data from meta-data in a header in a network message.

34. The computer program product of claim 27 further comprising means, recorded on the recording medium, for returning a non-fatal error to a sending program if the connection to the network lacks a security control required for the data.

35. The computer program product of claim 34 further comprising means, recorded on the recording medium, for the sending program to inform a user that the data will be held in a security buffer until the computer is connected to a changed computing environment having a new type of connection that has the security control required for the data.

36. The computer program product of claim 34 further comprising means, recorded on the recording medium, for the sending program to prompt a user with the option to create a secure tunnel for transmission of the data.

37. A computer program product for providing a necessary level of security for a computer capable of connecting to different computing environments, the computer program product comprising:

a recording medium;

means, recorded on the recording medium, for connecting the computer to a network in a first computing environment;

means, recorded on the recording medium, for specifying a security level for data to be sent across the network;

means, recorded on the recording medium, for instructing a sending program to send the data across the network;

means, recorded on the recording medium, for receiving an indication that security control of the first computing environment lacks a security control required for the specified security level;

means, recorded on the recording medium, for connecting the computer to the network in a second computing environment, wherein the second computing environment has the security control required for the specified security level; and

means, recorded on the recording medium, for receiving an indication that the data has been sent across the network.

38. The computer program product of claim 37 further comprising:

means, recorded on the recording medium, for determining, when the computer is connected to the second network, that the second computing environment has the security control required for the specified security level; and

means, recorded on the recording medium, for automatically sending the data across the network promptly upon determining that the second computing environment has the security control required for the specified security level.

39. The computer program product of claim 37 further comprising:

means, recorded on the recording medium, for receiving an indication that the second computing environment has the security control required for the specified security level; and

means, recorded on the recording medium, for again instructing the sending program to send the data across the network.