Method and apparatus for device dependent access control for device independent web content

• US 20060236408A1
• Filed: 04/14/2005
• Published: 10/19/2006
• Est. Priority Date: 04/14/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Yan, Shunguo
• Application Number:
  US11/105,612
• Publication Number:
  US 20060236408A1
• Time in Patent Office: Days
• US Class Current: 726/29
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A method, an apparatus, and computer instructions are provided for device-dependent access control for device independent web content. In an illustrative embodiment, a module may be implemented in a computer program detects a client device and security level from a request for a resource by a client device. The module loads, from a data source or configuration file, a three-dimensional device dependent access control matrix, which includes a user role axis, a device axis, and a resource axis. Based on the security level of the device indicated by the device matrix, the module grants or denies access to the resource by the user device. The security levels may include security protocols implemented by different devices, encryption schemes implemented by different devices, and security patches applied by the same device.

Claims

1. A method in a data processing system for device dependent access control for device independent content, the method comprising:

detecting a device type and a security level from a request for access to a resource of the data processing system by a user device, responsive to a user device login; and

loading a three-dimensional matrix from one of a data source and a configuration file, wherein the matrix includes a user role axis, a device axis, and a resource axis.

2. The method of claim 1, further comprising:

performing a lookup of a plurality of matrix assignment tables based on a user role of the user device, a type of user device, and the resource requested;

determining, based on one of a plurality of devices of the device axis, if permission is granted to the user device;

if the permission is granted, allowing the user device to access the resource; and

if the permission is not granted, denying the user device access to the resource and sending a warning to at least one of the user device and another.

3. The method of claim 2, wherein the plurality of devices represent a plurality of security levels, wherein the plurality of security levels include a security protocol implemented in different devices, an encryption scheme implemented in different devices, a security patch applied in a device, and a combination of a security protocol, an encryption scheme, and a security patch applied.

4. The method of claim 2, wherein the plurality of devices is grouped by a type of the device, and is further grouped by a security level of the device.

5. The method of claim 2, wherein the user role includes an administrator, a user, and a manager.

6. The method of claim 2, wherein the type of user device includes a personal digital assistant, a Web browser, a smart phone, and a telephone.

7. The method of claim 2, wherein the resource requested include at least one of an application, a data set, a Web page, and a spreadsheet.

8. The method of claim 2, wherein the permission includes at least one of deploy, create, delete, update, assign, view, and configure.

9. The method of claim 3, wherein the security protocol implemented in different devices includes at least one of a proprietary security protocol, and a wireless access protocol.

10. The method of claim 3, wherein the encryption scheme includes at least one of public key encryption, 32-bit key encryption, 64-bit key encryption, and 128-bit key encryption.

11. The method of claim 3, wherein the security patch applied in a device includes at least one of security patches published by vendors for specific devices, and a browser version of the device.

12. The method of claim 2, wherein the detecting, loading, determining, allowing, and denying steps are performed by a module implemented in a computer program executed by the data processing system.

13. The method of claim 1, wherein the three-dimensional matrix is configured by an administrator via a user interface.

14. The method of claim 1, wherein the loading step comprises:

reading data from the three-dimensional matrix into a resource-to-user assignment table; and

reading data from the three-dimensional matrix into a resource-to-device assignment table.

15. A data processing system comprising:

a bus;

a memory connected to the bus, wherein a set of instructions are located in the memory; and

a processor connected to the bus, wherein the processor executes the set of instructions to detect a device type and a security level from a request for access to a resource of the data processing system by a user device, responsive to a user device login, load a three-dimensional matrix from one of a data source and a configuration file, wherein the matrix includes a user role axis, a device axis, and a resource axis.

16. The data processing system of claim 15, wherein the processor further executes the set of instructions to perform a lookup of a plurality of matrix assignment tables based on a user role of the user device, a type of user device, and the resource requested, determine, based on one of a plurality of devices of the device axis, if permission is granted to the user device, allow the user device to access the resource if the permission is granted, and deny the user device access to the resource and sending a warning to at least one of the user device and another if the permission is not granted.

17. The data processing system of claim 15, wherein the processor, in executing the set of instructions to load a three-dimensional matrix from one of a data source or a configuration file, reads data from the three-dimensional matrix into a resource-to-user assignment table, and reads data from the three-dimensional matrix into a resource-to-device assignment table.

18. A computer program product in a computer readable medium for device dependent access control for device independent Web content, the computer program product comprising:

first instructions for detecting a device type and a security level from a request for access to a resource of the data processing system by a user device, responsive to a user device login; and

second instructions for loading a three-dimensional matrix from at least one of a data source or a configuration file, wherein the matrix includes a user role axis, a device axis, and a resource axis.

19. The computer program product of claim 18, further comprising:

third instructions for performing a lookup of a plurality of matrix assignment tables based on a user role of the user device, a type of user device, and the resource requested;

fourth instructions for determining, based on one of a plurality of devices of the device axis, if permission is granted to the user device;

fifth instructions for allowing the user device to access the resource if the permission is granted; and

sixth instructions for denying the user device access to the resource and sending a warning to at least one of the user device and another if the permission is not granted.

20. The computer program product of claim 18, wherein the second instructions comprises:

first sub-instructions for reading data from the three-dimensional matrix into a resource-to-user assignment table; and

second sub-instructions for reading data from the three-dimensional matrix into a resource-to-device assignment table.