Masking object data based on user authorization

• US 20060265375A1
• Filed: 05/19/2005
• Published: 11/23/2006
• Est. Priority Date: 05/19/2005
• Status: Active Grant

• Current Assignee: X Corp. (f/k/a Twitter, Inc.) (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Hess, Howard M.
• Granted Patent: US 7,693,849 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

Provided are a method, system, and program for processing a request for an object from a user. Layout information for the requested object is accessed, wherein the layout information delineates fields in the object. A determination is made from access control information as to whether the user is authorized to access the fields indicated in the layout information. The data from the object in one field which the user is not authorized to access is masked. The fields from the object are generated into a formatted object formatted according to the layout information, wherein the masked data is presented unintelligible to the user.

Claims

1. A method, comprising:

processing a request for an object from a user;

accessing layout information for the requested object, wherein the layout information delineates fields in the object;

determining from access control information whether the user is authorized to access the fields indicated in the layout information;

masking the data from the object in one field which the user is not authorized to access; and

generating the fields from the object into a formatted object formatted according to the layout information, wherein the masked data is presented unintelligible to the user.

2. The method of claim 1, further comprising:

generating data from the object in fields the user is determined to have authority to access into the formatted object without masking the data for the fields.

3. The method of claim 2, wherein the layout information includes field information for each field, wherein generating the data from fields the user is determined to have authority to access further comprises performing for each field indicated in the layout information:

determining data in the requested object for the field from the field information; and

formatting the determined data according to the field information to present the data in the formatted field according to the layout information in response to determining that the user is authorized to access data in the field.

4. The method of claim 1, wherein masking the data in one field to which authorization is not granted comprises overwriting the data in the field with unintelligible information to the user.

5. The method of claim 1, wherein the layout information is maintained in a format that is not self-describing.

6. The method of claim 1, wherein the request for the data is made through a file utility.

7. The method of claim 1, wherein the access control information provides authorization access for different users for each field indicated in the layout information for the data.

8. The method of claim 1, wherein the user comprises a dump routine accessing data from the memory to move to a dump location, and wherein the data from fields to which the user does not have access is masked before being moved from the memory to the dump location.

9. The method of claim 8, wherein masking the data in one field comprises:

processing the data in the field of the object in the memory to produce a code, wherein masking the data comprises replacing the object data moved to the dump location in the field with the code;

reviewing the data at the dump location; and

using the code to determine from the object the data that was in the field.

10. A system, comprising:

a processor;

a computer readable medium including code executed to perform operations, the operations comprising;

processing a request for an object from a user;

accessing layout information for the requested object, wherein the layout information delineates fields in the object;

determining from access control information whether the user is authorized to access the fields indicated in the layout information;

masking the data from the object in one field which the user is not authorized to access; and

generating the fields from the object into a formatted object formatted according to the layout information, wherein the masked data is presented unintelligible to the user.

11. The system of claim 10, wherein the operations further comprise:

generating data from the object in fields the user is determined to have authority to access into the formatted object without masking the data for the fields.

12. The system of claim 11, wherein the layout information includes field information for each field, wherein generating the data from fields the user is determined to have authority to access further comprises performing for each field indicated in the layout information:

determining data in the requested object for the field from the field information; and

formatting the determined data according to the field information to present the data in the formatted field according to the layout information in response to determining that the user is authorized to access data in the field.

13. The system of claim 10, wherein masking the data in one field to which authorization is not granted comprises overwriting the data in the field with unintelligible information to the user.

14. The system of claim 10, wherein the layout information is maintained in a format that is not self-describing.

15. The system of claim 10, wherein the request for the data is made through a file utility.

16. The system of claim 10, wherein the access control information provides authorization access for different users for each field indicated in the layout information for the data.

17. The system of claim 10, wherein the user comprises a dump routine accessing data from the memory to move to a dump location, and wherein the data from fields to which the user does not have access is masked before being moved from the memory to the dump location.

18. The system of claim 17, wherein masking the data in one field comprises:

processing the data in the field of the object in the memory to produce a code, wherein masking the data comprises replacing the object data moved to the dump location in the field with the code;

reviewing the data at the dump location; and

using the code to determine from the object the data that was in the field.

19. An article of manufacture including code causing operations to be performed, the operations comprising:

processing a request for an object from a user;

accessing layout information for the requested object, wherein the layout information delineates fields in the object;

determining from access control information whether the user is authorized to access the fields indicated in the layout information;

masking the data from the object in one field which the user is not authorized to access; and

generating the fields from the object into a formatted object formatted according to the layout information, wherein the masked data is presented unintelligible to the user.

20. The article of manufacture of claim 19, wherein the operations further comprise:

generating data from the object in fields the user is determined to have authority to access into the formatted object without masking the data for the fields.

21. The article of manufacture of claim 19, wherein the layout information includes field information for each field, wherein generating the data from fields the user is determined to have authority to access further comprises performing for each field indicated in the layout information:

determining data in the requested object for the field from the field information; and

formatting the determined data according to the field information to present the data in the formatted field according to the layout information in response to determining that the user is authorized to access data in the field.

22. The article of manufacture of claim 19, wherein masking the data in one field to which authorization is not granted comprises overwriting the data in the field with unintelligible information to the user.

23. The article of manufacture of claim 19, wherein the layout information is maintained in a format that is not self-describing.

24. The article of manufacture of claim 19, wherein the request for the data is made through a file utility.

25. The article of manufacture of claim 19, wherein the access control information provides authorization access for different users for each field indicated in the layout information for the data.

26. The article of manufacture of claim 19, wherein the user comprises a dump routine accessing data from the memory to move to a dump location, and wherein the data from fields to which the user does not have access is masked before being moved from the memory to the dump location.

27. The article of manufacture of claim 26, wherein masking the data in one field comprises:

processing the data in the field of the object in the memory to produce a code, wherein masking the data comprises replacing the object data moved to the dump location in the field with the code;

reviewing the data at the dump location; and

using the code to determine from the object the data that was in the field.