Classification Separation Router

• US 20110067113A1
• Filed: 09/17/2009
• Published: 03/17/2011
• Est. Priority Date: 09/17/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lendacky, Thomas G., Jones, Daniel H., Ratliff, Emily J., Wilson, George C.
• Granted Patent: US 8,627,494 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A method and system are provided to classify and convey data to satisfy a client request. The classification system is a two dimensional data classification system, including a first dimension pertaining to subject matter and a second dimension pertaining to data security. A partition is dynamically created, and data that satisfies the request populates the created partition to convey parsed data based satisfying both dimensions of the request.

Claims

1. A method for addressing a request for classified electronic data, comprising:

segregating data into at least two classifications;

receiving a request for data, wherein an identifier associated with the request includes a security attribute;

filtering data from the storage based upon presence of the security attribute in at least one of the classifications of the data and based upon presence of a security policy defining access to the classifications of data;

dynamically creating a partition to contain the filtered data;

populating the created partition with a copy of the filtered data; and

satisfying the request from the created partition.

2. The method of claim 1, further comprising assigning a time interval for active status of the created partition.

3. The method of claim 2, further comprising destroying the created partition following expiration of the time interval.

4. The method of claim 3, further comprising destroying the filtered data maintained local to the partition.

5. The method of claim 2, further comprising archiving the created partition following expiration of the time interval.

6. The method of claim 1, wherein the created partition is configured to receive data filtered for a single classification.

7. A computer system, comprising:

a server in communication with a data storage medium;

data stored local to the storage medium segregated into at least two classifications;

a receiving manager in communication with the server configured to receive a request for data, the request having an identifier with a security attribute;

a filter in communication with the receiving manager, the filter to parse data from the storage based upon presence of the security attribute in at least one of the classifications of the data and based upon presence of a security policy that defines access to the classifications of data;

a partition manager in communication with the receiving manager, the partition manager to dynamically create a partition to contain the filtered data;

the partition manager to populate the created partition with a copy of the filtered data to satisfy the request.

8. The system of claim 7, further comprising a time interval assigned to an active status of the created partition.

9. The system of claim 8, further comprising a time manager to destroy the created partition following expiration of the time interval, including destroying the filtered data maintained local to the partition.

10. The system of claim 8, further comprising a time manager to archive the created partition following expiration of the time interval, including maintenance of a copy of the filtered data in local data storage.

11. The system of claim 7, wherein the created partition is configured to receive data for a single classification.

12. An article comprising:

a computer-readable carrier including computer program instructions configured to address a request for classified electronic data, the instructions comprising;

instructions to separate stored data into at least two classifications;

instructions to receive a request for data, wherein an identifier associated with the request includes a security attribute;

instructions to filter data from the storage based upon presence of the security parameter in at least one of the classifications of the data and based upon presence of a security policy defining access to the classifications of data;

instructions to dynamically create a partition configured to contain the f filtered data; and

satisfaction of the request from the created partition, including populating the created partition with a copy of the filtered data.

13. The article of claim 12, further comprising instructions to assign a time interval for active status of the created partition.

14. The article of claim 13, further comprising instructions to destroy the created partition following expiration of the time interval.

15. The article of claim 14, further comprising instructions to destroy the filtered data maintained local to the partition.

16. The article of claim 13, further comprising instructions to archive the created partition following expiration of the time interval.

17. The article of claim 12, wherein the created partition is configured to receive data filtered for a single classification.