Determining whether predefined data controlled by a server is replicated to a client machine

• US 20070260649A1
• Filed: 05/02/2006
• Published: 11/08/2007
• Est. Priority Date: 05/02/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chakra, Al, Ogle, David, Kaminsky, David
• Granted Patent: US 8,849,760 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A request is received for predefined data from a client machine. It is determined if the client machine is at an acceptable location to receive the predefined data. The requested predefined data is replicated to the client machine if the client machine is at an acceptable location and replication of the predefined data is prevented if the client machine is at an unacceptable location.

Claims

1. A method of determining whether predefined data controlled by a server is replicated to a client machine comprising:

receiving a request for said predefined data from said client machine;

determining if said client machine is at an acceptable location to receive said predefined data; and

replicating said requested predefined data to said client machine if said client machine is at an acceptable location and preventing replication of said predefined data to said client machine if said client machine is at an unacceptable location.

2. The method of claim 1, wherein determining if said client machine is at an acceptable location comprises tracing a route information packets take to reach said client machine from said server.

3. The method of claim 2, wherein said client machine is determined to be at an acceptable location if a number of hosts along said route between said server and said client machine is less than a predefined number.

4. The method of claim 2, further comprising storing a list identifying each insecure host capable of being located along said route between said server and said client machine, and wherein said client machine is determined to be at an acceptable location if none of the hosts along said route is found on said list.

5. The method of claim 2, further comprising storing a list identifying each trusted host capable of being located along said route between said server and said client machine, and wherein said client machine is determined to be at an acceptable location if all hosts along said route are found on said list.

6. The method of claim 1, further comprising storing a list comprising at least one of an IP address, a fully qualified domain name and a portion of a fully qualified domain name corresponding to at least one insecure location, and wherein said determining if said client machine is at an acceptable location comprises determining the fully qualified domain name, a portion of said fully qualified domain name, or the IP address for said client machine and comparing said determined fully qualified domain name, the portion of said fully qualified domain name, or the IP address with said list, and said client machine is determined to be at an acceptable location if said fully qualified domain name, the portion of said fully qualified domain name or said IP address of said client machine is not found on said list.

7. The method of claim 1, wherein said predefined data comprises one of high-level security data and intermediate-level security data and said determining if said client machine is at an acceptable location comprises defining a first set of acceptable locations corresponding to said high-level security data and a second set of acceptable locations corresponding to said intermediate-level security data.

8. A system for determining whether predefined data is replicated to a client machine comprising:

a module to receive a request for said predefined data from said client machine;

a module to determine if said client machine is at an acceptable location to receive said predefined data; and

a module to replicate said requested predefined data to said client machine if said client machine is at an acceptable location and prevent replication of said predefined data to said client machine if said client machine is at an unacceptable location.

9. The system of claim 8, wherein said module to determine if said client machine is at an acceptable location traces a route information packets take to reach said client machine from said system.

10. The system of claim 9, wherein said module to determine if said client machine is at an acceptable location determines if a number of hosts along said route between said system and said client machine is less than a predefined number.

11. The system of claim 9, further comprising a module to store a list containing each insecure host capable of being located along said route between said system and said client machine, and wherein said module to determine if said client machine is at an acceptable location determines that said client machine is at an acceptable location if none of the hosts along said route is found on said list.

12. The system of claim 9, further comprising a module to store a list containing each trusted host capable of being located along said route between said system and said client machine, and wherein said module to determine if said client machine is at an acceptable location determines that said client machine is at an acceptable location if all hosts along said route are found on said list.

13. The system of claim 8, further comprising a module to store a list comprising at least one of an IP address, a fully qualified domain name or a portion of a fully qualified domain name corresponding to at least one insecure location, and wherein said module to determine if said client machine is at an acceptable location determines the fully qualified domain name, a portion of said fully qualified domain name or the IP address for said client machine and compares said determined fully qualified domain name, the portion of said fully qualified domain name or the IP address with said list and determines that said client machine is at an acceptable location if said fully qualified domain name, the portion of said fully qualified domain name or said IP address of said client machine is not found on said list.

14. The system of claim 8, wherein said predefined data comprises one of high-level security data and intermediate-level security data and said module to determine if said client machine is at an acceptable location to receive said predefined data defines a first set of acceptable locations corresponding to said high-level security data and a second set of acceptable locations corresponding to said intermediate-level security data.

15. A computer program product for determining whether predefined data is replicated to a client machine, the computer program product comprising:

a computer usable medium having computer usable program code embodied therewith, the computer usable program code comprising;

computer usable program code configured to receive a request for said predefined data from said client machine;

computer usable program code configured to determine if said client machine is at an acceptable location to receive said predefined data; and

computer usable program code configured to replicate said requested predefined data to said client machine if said client machine is at an acceptable location and prevent replication of said predefined data to said client machine if said client machine is at an unacceptable location.

16. The computer program product of claim 15, wherein said computer usable program code to determine if said client machine is at an acceptable location traces a route information packets take to reach said client machine from a server.

17. The computer program product of claim 16, wherein said computer usable program code to determine if said client machine is at an acceptable location determines if a number of hosts along said route between said server and said client machine is less than a predefined number.

18. The computer program product of claim 16, further comprising computer usable program code to store a list containing each insecure host capable of being located along said route between said server and said client machine, and wherein said computer usable program code to determine if said client machine is at an acceptable location determines that said client machine is at an acceptable location if none of the hosts along said route is found on said list.

19. The computer program product of claim 16, further comprising computer usable program code to store a list containing each trusted host capable of being located along said route between said server and said client machine, and wherein said computer usable program code to determine if said client machine is at an acceptable location determines that said client machine is at an acceptable location if all hosts along said route are found on said list.

20. The computer program product of claim 15, further comprising computer usable program code to store a list comprising at least one of an IP address, a fully qualified domain name and a portion of a fully qualified domain name corresponding to at least one insecure location, and wherein said computer usable program code to determine if said client machine is at an acceptable location determines the fully qualified domain name, a portion of said fully qualified domain name or the IP address for said client machine and compares said determined fully qualified domain name, the portion of said fully qualified domain name or the IP address with said list, and determines that said client machine is at an acceptable location if said fully qualified domain name, the portion of said fully qualified domain name or said IP address of said client machine is not found on said list.