Security apparatus and method for a data communications system

• US 5,734,820 A
• Filed: 03/11/1996
• Issued: 03/31/1998
• Est. Priority Date: 03/11/1996
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: Sterling Commerce (America) Incorporated (International Business Machines Corporation)
• Inventors: Howard, Ricky D., Khaouli, Ramzi
• Primary Examiner(s): Hua, Ly
• Application Number:
  US08/647,425
• Time in Patent Office: 750 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 395/200.06, 395/200.09, 395/492, 395/493, 395/494, 395/495, 395/496, 380/4, 380/24, 380/25
• US Class Current: 726/21
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A data communication system includes a host (12) having a memory and a remote (16) that communicate data. A security system (14) is coupled to the remote (16) and the host (12), and spawns an interactive process in response to the remote (16) requesting access to the host (12). The interactive process has selected access to the memory of the host (12), and interacts with the remote (16) to provide the selected access. The security system (14) may include a communications module (50), a control module (60), a mailbox module (62), an auto connect module (64), a log module (66), and an exits module (68).

Claims

1. A data communications system, comprising:

a remote associated with one of a plurality of users, the remote operable to communicate data;

a host coupled to the remote and having a memory, the host operable to communicate data with the remote;

a plurality of data repositories within the memory of the host, each data repository associated with a particular user; and

a security system coupled to the remote and the host, the security system operable to spawn an executable program in response to the remote requesting access to the host, the executable program having selected access to the memory of the host, the executable program operable to interact with the remote to provide the selected access, the selected access comprising access to the data repository associated with one of the plurality of users.

2. The system of claim 1, wherein the security system is operable to establish a separate executable program each time one of a plurality of remotes requests access to the host, each executable program having an associated remote, each executable program having selected access to the memory of the host.

3. The system of claim 1, wherein the security system spawns the executable program according to access information associated with the one of the plurality of users, the access information specifying the selected access.

4. The system of claim 3, wherein the access information comprises a mailbox identifier associated with the one of the plurality of users.

5. The system of claim 1, wherein the security system is distributed to operate on a plurality of different processing platforms.

6. The system of claim 1, wherein the security system further comprises:

a communication module operable to receive communications from the remote and to transmit an access signal in response; and

a mailbox module operable to spawn the executable program in response to the access signal.

7. The system of claim 6, wherein the mailbox module spawns the executable program according to access information associated with the one of the plurality of users, the access information specifying the selected access.

8. The system of claim 6, wherein the communications module comprises a protocol converter operable to receive first data from the remote in a first protocol and translate the first data into second data in a second protocol, the protocol converter operable to communicate the second data to the host in the second protocol.

9. A security system for providing selected access to a memory of a host, comprising:

a communications module coupled to a remote and the host, the remote being associated with one of a plurality of users, the communications module operable to receive communications from the remote and to transmit an access signal in response;

a control module coupled to the communications module, the control module operable to receive the access signal and, in response, to approve selected access to the memory of the host, the memory of the host comprising a plurality of data repositories, each data repository associated with a particular user, the control module operable to transmit a spawn signal in response to approving the selected access; and

a mailbox module coupled to the control module, the mailbox module operable to receive the spawn signal and to spawn an executable program in response, the executable program having the selected access to the memory of the host and operable to interact with the remote to provide the selected access, the selected access comprising access to the data repository associated with the one of the plurality of users.

10. The system of claim 9, wherein the security system is operable to establish a separate executable program each time one of a plurality of remotes requests access to the host, each executable program having an associated remote, each executable program having selected access to the memory of the host.

11. The system of claim 9, wherein the mailbox module spawns the executable program according to access information associated with the one of the plurality of users, the access information specifying the selected access.

12. The system of claim 9, further comprising an exits module coupled to the control module and operable to modify the selected access in response to commands communicated from the remote.

13. The system of claim 9, further comprising a remote site definitions file coupled to the control module and associated with the remote, the remote site definitions file operable to specify communications parameters for establishing communications between the remote and the host.

14. The system of claim 9, further comprising:

an auto connect definitions file specifying communications to be established at predetermined times between the security system and the remote; and

an auto connect module coupled to the control module and operable to initiate communications between the security system and the remote at the predetermined times specified in the auto connect definitions file.

15. The system of claim 14, wherein the communications between the security system and the remote comprise a command operable to cause the remote to execute a program.

16. The system of claim 14, wherein the communications between the security system and the remote comprise information operable to override remote-specific information associated with the remote.

17. The system of claim 9, further comprising an exits module coupled to the control module and operable to modify parameters associated with a remote command if the command is incompatible with the selected access.

18. The system of claim 9, further comprising an exits module coupled to the control module and operable to determine a reason to deny the one of the plurality of users the selected access.

19. The system of claim 9, further comprising an exits module coupled to the control module and operable to invoke an exit selected from the group consisting of:

an exit invoked in response to initialization of the system;

an exit invoked in response to a communications session being established with the remote;

an exit invoked in response to receiving data from the remote;

an exit invoked in response to the addition of data to the memory of the host;

an exit invoked in response to communicating data to the remote;

an exit invoked during shutdown of the system; and

an exit invoked in response to a request to execute an operation.

20. A method of data communications, comprising:

receiving communications from a remote at a host having a memory, the remote being associated with one of a plurality of users, the memory comprising a plurality of data repositories, each data repository associated with a particular user;

approving selected access to the memory of the host in response to the communications from the remote, the selected access comprising access to the data repository associated with the one of the plurality of users;

transmitting a spawn signal in response to approving the selected access; and

spawning an executable program in response to the spawn signal, the executable program operable to interact with the remote to provide the selected access.

21. The method of claim 20, wherein a separate executable program is established each time access by one of a plurality of remotes is approved, each executable program having an associated remote, each executable program having selected access to the memory of the host.

22. The method of claim 20, wherein spawning the executable program determines the selected access to the memory of the host, the selected access specified by access information associated with the one of the plurality of users.

23. The method of claim 20, wherein receiving the communications from the remote at the host comprises:

receiving first data from the remote in a first protocol;

translating the first data into second data in a second protocol using a protocol converter; and

communicating the second data to the host in the second protocol.

24. The method of claim 20, further comprising:

establishing communications between the remote and a communications module coupled to the host in response to receiving the communications from the remote;

spawning a child communications module to manage communications with the remote; and

reporting the communications from the remote to a control module, the control module operable to approve the selected access.

25. A method of initializing a data communications system, comprising:

coupling a plurality of non-control modules to a control module, the non-control modules operable to determine a well-known port number for the control module;

communicating ephemeral port numbers for the non-control modules to the control module using the well-known port for the control module; and

communicating a ready signal from the control module to each of the non-control modules to initialize the data communications system, the ready signal having the ephemeral port numbers for each of the non-control modules.

26. The method of claim 25, further comprising:

loading the identities of the non-control modules into a status table.

27. The method of claim 25, wherein the non-control modules comprise a communications module and a mailbox module.