SYSTEM, METHOD, AND POLICY ENGINE FOR GRANTING TEMPORARY ACCESS TO ELECTRONIC CONTENT

• US 20110321132A1
• Filed: 06/25/2010
• Published: 12/29/2011
• Est. Priority Date: 06/25/2010
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Slingerland, Florin van, Burgers, Stefan
• Granted Patent: US 8,931,034 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 51/52 for supporting social networking services
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04N 21/2541 Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/25891 being end-user preferences retrieval of video data in a video database based on user preferences G06F16/739; arrangements for recognizing users' preferences H04H60/46; user profiles in network data switching protocols H04L67/306; processing of user preferences or user profiles in wireless networks H04W8/18
• CPC Class Codes: H04N 21/4788 communicating with other users, e.g. chatting arrangements for providing for computer conferences, e.g. chat rooms, to substation in data switching networks H04L12/1813; distributed application using peer-to-peer [P2P] networks H04L67/104

Abstract

A system, method, and Policy Engine for granting a first user temporary access to a second user'"'"'s electronic content. The Policy Engine receives a request originating from the first user to access the second user'"'"'s content, and retrieves from a relationship database, relationship information regarding a relationship between the two users. If an access rule matching the relationship information is stored in the Policy Engine, the Policy Engine applies the access rule to control access by the first user for a period of time specified in the rule. If an access rule is not stored, the Policy Engine obtains the access rule from the second user. The Policy Engine allows access when the matching rule grants access and the matching rule has not expired, and denies access when there is no matching rule, when the matching rule does not allow access, or when the matching rule has expired.

Claims

1. A method of granting a first user temporary access to a second user'"'"'s electronic content, the method comprising the steps of:

receiving by a Policy Engine, a request originating from the first user to access the second user'"'"'s content;

retrieving by the Policy Engine from a relationship database, relationship information regarding a relationship between the first and second users;

applying by the Policy Engine, an access rule matching the relationship information, the access rule specifying a period of time the content is available;

when the specified period of time has not expired, the Policy Engine granting the first user access to the second user'"'"'s content; and

when the specified period of time has expired, the Policy Engine denying the first user access to the second user'"'"'s content.

2. The method as recited in claim 1, wherein the access rule also specifies how much of the second user'"'"'s content the first user is allowed to access, and the granting step includes granting access only to the allowed content.

3. The method as recited in claim 1, wherein the first user has at least one identifiable characteristic, and the access rule also specifies that all users having the at least one identifiable characteristic can access the second user'"'"'s content for the specified period of time.

4. The method as recited in claim 1, wherein the step of retrieving relationship information from a relationship database includes retrieving the relationship information from an internal database in the Policy Engine if an internal database exists, or from an Active Address Book (AAB) external to the Policy Engine, if an internal database does not exist.

5. The method as recited in claim 1, further comprising, before applying the access rule, the steps of:

determining whether an access rule matching the relationship information is stored within the Policy Engine; and

when there is not an access rule matching the relationship information stored within the Policy Engine, obtaining the access rule from the second user.

6. The method as recited in claim 5, wherein the first and second users are online with a social media network, and the step of obtaining the access rule from the second user includes:

sending a request for the access rule from the Policy Engine to the second user through the social media network; and

receiving the access rule from the second user through the social media network.

7. The method as recited in claim 5, wherein the first user requests access to the content through a social media network when the second user is not online with the social media network, and the step of obtaining the access rule from the second user includes:

sending from the Policy Engine to the second user, an e-mail message requesting the access rule; and

receiving the access rule from the second user in an e-mail response message.

8. The method as recited in claim 1, further comprising sending from the Policy Engine to the second user, a notification of the first user'"'"'s access to the second user'"'"'s content during the specified period of time, or a notification that the first user attempted to access the second user'"'"'s content after the specified period of time expired.

9. The method as recited in claim 1, wherein an access server provides the second user'"'"'s content to the first user, and the method further comprises, when access is granted, periodically refreshing the second user'"'"'s content by the access server and providing the refreshed content to the first user.

10. A Policy Engine for controlling access by a first user to a second user'"'"'s electronic content, the Policy Engine comprising:

a communication unit for receiving a request originating from the first user to access the second user'"'"'s content;

a relationship retrieval unit for retrieving from a relationship database, relationship information regarding a relationship between the first and second users;

a matching unit for applying an access rule matching the relationship between the first and second users, the access rule specifying a period of time the content is available; and

a timer for determining whether the specified period of time has expired;

wherein when the specified period of time has not expired, the communication unit sends a response toward the first user indicating that the content is available to the first user; and

wherein when the specified period of time has expired, the communication unit sends a response toward the first user indicating that the content is no longer available.

11. The Policy Engine as recited in claim 10, wherein the access rule also specifies how much of the second user'"'"'s content the first user is allowed to access.

12. The Policy Engine as recited in claim 10, wherein the first user has at least one identifiable characteristic, and the access rule also specifies that all users having the at least one identifiable characteristic can access the second user'"'"'s content for the specified period of time.

13. The Policy Engine as recited in claim 10, wherein the relationship database is implemented in the Policy Engine.

14. The Policy Engine as recited in claim 10, wherein the relationship database is implemented in an Active Address Book (AAB) external to the Policy Engine, and the relationship retrieval unit includes means for retrieving the relationship information from the AAB.

15. The Policy Engine as recited in claim 10, further comprising:

a rules database for storing access rules, the rules database being accessible by the matching unit for determining whether an access rule matching the relationship information is stored within the rules database; and

a rules retrieval unit for obtaining the access rule from the second user when there is not an access rule matching the relationship information stored within the rules database.

16. The Policy Engine as recited in claim 15, wherein when the first and second users are online with a social media network, the rules retrieval unit is configured to obtain the access rule from the second user through the social media network.

17. The Policy Engine as recited in claim 15, wherein when the first user requests access to the content through a social media network when the second user is not online with the social media network, the rules retrieval unit is configured to obtain the access rule from the second user through e-mail messaging.

18. The Policy Engine as recited in claim 10, further comprising communication means for sending to the second user, a notification of the first user'"'"'s access to the second user'"'"'s content during the specified period of time, or a notification that the first user attempted to access the second user'"'"'s content after the specified period of time expired.

19. A system for controlling access by a first user to a second user'"'"'s electronic social content, the system comprising:

a Social Media Portal (SMP) for providing the first user with access to a social media network;

a Policy Engine in communication with the SMP for storing and applying access rules for controlling access to the social content of a plurality of users; and

an Active Address Book (AAB) in communication with the Policy Engine for storing relationship information regarding relationships between the plurality of users;

wherein the SMP includes means for forwarding to the Policy Engine, a request originating from the first user to access the second user'"'"'s content;

wherein the Policy Engine includes;

a relationship retrieval unit for retrieving from the AAB, relationship information regarding a relationship between the first and second users;

a matching unit for applying an access rule matching the relationship between the first and second users, the access rule specifying a period of time the content is available;

a timer for determining whether the specified period of time has expired; and

a communication unit for sending a response to the SMP allowing access when the matching rule grants access and the matching rule has not expired, and for sending a response to the SMP denying access when there is no matching rule, when the matching rule does not allow access, or when the matching rule has expired.

20. The system as recited in claim 19, wherein the Policy Engine also includes means for obtaining an access rule from the second user when a matching rule is not stored in the Policy Engine.