Checkpoint object

• US 6,035,399 A
• Filed: 04/07/1995
• Issued: 03/07/2000
• Est. Priority Date: 04/07/1995
• Status: Expired due to Term

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Company (HP Inc.)
• Inventors: Klemba, Keith S., Crall, Christopher J., Pato, Joseph N., Palmer, Thomas A., Carpenter, Gregory P., Anderson, Anne H.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Elisca, Pierre E.
• Application Number:
  US08/422,206
• Time in Patent Office: 1,796 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 395/200.59, 395/683, 707/103, 707/200, 707/9
• US Class Current: 726/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 9/466 Transaction processing

Abstract

An object oriented tool monitors the step-by-step progress of security administration within an electronic work flow to implement access control measures, and security administration policies that may include additional checks and balances, such as second party review, escalated authorization requirements, and trusted audit facilities. A security administration architecture for distributed electronic data processing systems preferably includes a checkpoint object that provides uniform characterization of milestone or transition states in administration activity, and which may be inherited by or refined to an administration activity object. A checkpoint object manager that is instantiated as a trusted third party object manages the state progression of checkpoint objects. As a result of checkpointing, checkpoint objects are resumed with their state advanced, reversed, or unchanged by the checkpoint object manager as appropriate. The checkpoint object manager also assures that all checkpoints are logged and monitored, and that resumptions are authenticated.

Claims

1. An apparatus for monitoring step-by-step progress of security administration within an electronic work flow, comprising:

a checkpoint object that provides uniform characterization of milestone and/or transition states in administration activity, where object class definition is inherited by or refined to an administration activity object; and

a checkpoint object manager that is instantiated as a trusted third party object which manages state progression of checkpoint objects;

wherein said checkpoint object manager further comprises at least one of;

an action that resumes checkpointed objects with their state either advanced, reversed, or unchanged; and

an action that assures that all checkpoints are logged and/or monitored.

2. The apparatus of claim 1, wherein the checkpoint object manager further comprises:

an action that assures that all resumptions are authenticated.

3. The apparatus of claim 1, wherein said checkpoint object must checkpoint to said checkpoint object manager to obtain second party approval.

4. The apparatus of claim 1, wherein said checkpoint object manager provides any of second party review, escalated authorization requirements, and trusted audit facilities.

5. The apparatus of claim 1, wherein said checkpoint object may inherit an object class having any desired security administration attributes;

and wherein any object that has these attributes, or that has inherited this class, can then be managed by said checkpoint object manager.

6. The apparatus of claim 1, further comprising:

a task that may be performed as part of a process until it reaches a checkpoint, at which point the process check-ins a checkpoint object to said checkpoint object manager, wherein said checkpoint object cannot be checked-out of said checkpoint object manager unless criteria that implement security administration policies are met.

7. The apparatus of claim 1, wherein said checkpoint object allows suspension of a task, and said task may not resumed, except as authorized.

8. The apparatus of claim 7, wherein said checkpoint object manager escalates said checkpoint object upon failure to resume a suspended task, either by receiving authorization and/or by returning to said task within a predetermined time.

9. The apparatus of claim 1, said checkpoint object further comprising one or more of the following attributes:

an applicationID attribute which identifies a name of an application that sets the context for this checkpoint;

an ApplCkPntState attribute that indicates a state of an object when a checkpoint is performed;

an ApplResumeState attribute that indicates a state with which an object should resume;

an ApplAuthRule attribute which is a signed authorization rule that is used by a current application, where said rule is indexed by states such that it governs authorization entitlements as said application'"'"'s activities progress;

a CkPntTimeLimit attribute that indicates a time limit that said checkpoint object may reside with said checkpoint manager, where if said time limit is exceeded, said checkpoint manager issues an event to signal escalation of checkpoint attention;

a CkPntObjMgrID attribute that records a list of all checkpoint object managers that have currently serviced a checkpoint object;

a CkPntDataPntrs[ ] attribute that provides a list of pointers to current checkpoint data, where said data is stored as binary data by said checkpoint object manager, such that if the data comprise a pointer, then only a pointer is returned by said checkpoint object manager; and

such that if the data comprise actual data, then the data are stored by said checkpoint object manager; and

a CkPntSeal attribute that provides a trusted seal of current checkpoint object information.

10. The apparatus of claim 1, said checkpoint object further comprising at least the following action:

a Seal_-- CkPntObj( ) action that computes a CkPntSeal attribute, where said CkPntSeal attribute provides a trusted seal of current checkpoint object information.

11. The apparatus of claim 1, said checkpoint object manager further comprising one or more of the following attributes:

an ApplCkPntCount attribute that provides a count of checkpoint objects that are currently checkpointed by the checkpoint object manager; and

an ApplCkPntList[ ] attribute that provides a non-ordered list of checkpoint objects that are currently checkpointed by the checkpoint object manager.

12. The apparatus of claim 1, said checkpoint object manager further comprising one or more of the following actions:

a Find( ) action that searches an ApplCkPntList attribute for objects that match a criteria of passed arguments, where said ApplCkPntList attribute provides a non-ordered list of checkpoint objects that are currently checkpointed by the checkpoint object manager;

a Delete( ) action that is adapted to delete a checkpointed object, where authorization required for the Delete( ) action is associated with administration entitlements for said checkpoint object manager;

a CkPnt( ) action that checkpoints an application object that contains the CkPntObj class behavior, where checkpointing an object captures all CkPntObj attributes and checks a suspended object in its present state into a CkPntObjMgr datastore, where said CkPntObjMgr holds this information, and waits for a next application service to check out said object and resume processing;

a Resume( ) action that passes all checkpoint attributes for an identified checkpointed object to a calling object after first passing authorization rules to said calling object; and

a Report( ) action that produces at least one report drawn from checkpoint object manager log/audit files and/or currently checkpointed data.

13. A method for monitoring step-by-step progress of security administration within an electronic work flow, comprising the steps of:

providing a checkpoint object that provides uniform characterization of milestone and/or transition states in administration activity, where object class definition is inherited by or refined to an administration activity object;

providing a checkpoint object manager that is instantiated as a trusted third party object which manages state progression of checkpoint objects;

checkpointing a checkpoint object; and

further comprising at least one of the steps of;

providing an action via said checkpoint object manager that resumes checkpointed objects with their state either advanced, reversed, or unchanged; and

providing an action via said checkpoint object manager that assures that all checkpoints are logged and/or monitored.

14. The method of claim 13, further comprising the steps of:

interrupting a task;

checkpointing a checkpoint object; and

providing an action via said checkpoint object manager that assures that all resumptions of said interrupted task are authenticated.

15. The method of claim 13, further comprising the step of:

checkpointing said checkpoint object to said checkpoint object manager to obtain second party approval.

16. The method of claim 13, further comprising the step of:

providing via said checkpoint object manager any of second party review, escalated authorization requirements, and trusted audit facilities.

17. The method of claim 13, wherein said checkpoint object may inherit an object class having any desired security administration attributes;

and wherein any object that has these attributes, or that has inherited this class, can then be managed by said checkpoint object manager.

18. The method of claim 13, further comprising the steps of:

performing a task as part of a process until it reaches a checkpoint; and

checking-in a checkpoint object to said checkpoint object manager, wherein said checkpoint object cannot be checked-out of said checkpoint object manager unless criteria that implement security administration policies are met.

19. The method of claim 13, further comprising the step of:

suspending a task with said checkpoint object manager, wherein said task may not resumed, except as authorized.

20. The method of claim 19, further comprising the step of:

escalating said checkpoint object with said checkpoint object manager upon failure to resume a suspended task, either by receiving authorization and/or by returning to said task within a predetermined time.

21. The method of claim 13, said checkpoint object comprising one or more of the following attributes:

an applicationID attribute which identifies a name of an application that sets the context for this checkpoint;

an ApplCkPntState attribute that indicates a state of an object when a checkpoint is performed;

an ApplResumeState attribute that indicates a state with which an object should resume;

an ApplAuthRule attribute which is a signed authorization rule that is used by a current application, where said rule is indexed by states such that it governs authorization entitlements as said application'"'"'s activities progress;

a CkPntTimeLimit attribute that indicates a time limit that said checkpoint object may reside with said checkpoint manager, where if said time limit is exceeded, said checkpoint manager issues an event to signal escalation of checkpoint attention;

a CkPntObjMgrID attribute that records a list of all checkpoint object managers that have currently serviced a checkpoint object;

a CkPntDataPntrs[ ] attribute that provides a list of pointers to current checkpoint data, where said data is stored as binary data by said checkpoint object manager, such that if the data comprise a pointer, then only a pointer is returned by said checkpoint object manager; and

such that if the data comprise actual data, then the data are stored by said checkpoint object manager; and

a CkPntSeal attribute that provides a trusted seal of current checkpoint object information.

22. The method of claim 13, said checkpoint object comprising at least the following action:

a Seal_-- CkPntObj( ) action that computes a CkPntSeal attribute, where said CkPntSeal attribute provides a trusted seal of current checkpoint object information.

23. The method of claim 13, said checkpoint object manager comprising one or more of the following attributes:

an ApplCkPntCount attribute that provides a count of checkpoint objects that are currently checkpointed by the checkpoint object manager; and

an ApplCkPntList[ ] attribute that provides a non-ordered list of checkpoint objects that are currently checkpointed by the checkpoint object manager.

24. The method of claim 13, said checkpoint object manager comprising one or more of the following actions:

a Find( ) action that searches an ApplCkPntList attribute for objects that match a criteria of passed arguments, where said ApplCkPntList attribute provides a non-ordered list of checkpoint objects that are currently checkpointed by the checkpoint object manager;

a Delete( ) action that is adapted to delete a checkpointed object, where authorization required for the Delete( ) action is associated with administration entitlements for said checkpoint object manager;

a CkPnt( ) action that checkpoints an application object that contains the CkPntObj class behavior, where checkpointing an object captures all CkPntObj attributes and checks a suspended object in its present state into a CkPntObjMgr datastore, where said CkPntObjMgr holds this information, and waits for a next application service to check out said object and resume processing;

a Resume( ) action that passes all checkpoint attributes for an identified checkpointed object to a calling object after first passing authorization rules to said calling object; and

a Report( ) action that produces at least one report drawn from checkpoint object manager log/audit files and/or currently checkpointed data.