Method and apparatus for realizing computer security

• US 6,073,240 A
• Filed: 10/28/1997
• Issued: 06/06/2000
• Est. Priority Date: 10/28/1997
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Levanoni, Menachem, Kurtzberg, Jerome M.
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US08/959,048
• Time in Patent Office: 952 Days
• Field of Search: 713/200, 713/201, 713/202, 380/3, 380/4, 380/23, 380/25, 364/286.5, 364/286.4, 364/280, 340/825.34, 340/825.31, 714/39, 714/47
• US Class Current: 726/21
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A method suitable for realizing computer security. The method includes the steps of establishing an authorization window for enabling computer system actions consistent with an authorization rule; and, monitoring the actions as an indicia of conformance to the authorization rule. The method preferably provides a pattern of system actions as an indicia of compliance with an authorization rule, and provides notification of predetermined patterns.

Claims

1. A method suitable for realizing computer security of a computer system, the method operable within a computer system and comprising:

(1) establishing an authorization window for enabling computer system actions consistent with an authorization rule;

(2) the computer system automatically and independently monitoring said actions as an indicia of conformance to said authorization rule after said authorization window closes; and

(3) while the computer system automatically and independently monitors said actions, the computer system automatically and independently determines whether said actions conform to said authorization rule.

2. A method according to claim 1, wherein step (1) comprises establishing the authorization window for a plurality of users.

3. A method according to claim 1, wherein step (1) comprises establishing the authorization window in accordance with a time schedule.

4. A method according to claim 1, wherein step (1) comprises establishing the authorization window in accordance with selected system actions.

5. A method according to claim 1, wherein step (2) comprises the computer system automatically and independently monitoring said actions at random times after said authorization window closes.

6. A method according to claim 1, wherein step (2) comprises the computer system automatically and independently monitoring said actions at predetermined times after said authorization window closes.

7. A method according to claim 1, wherein step (2) comprises the computer system automatically and independently monitoring said actions continuously after said authorization window closes.

8. A method according to claim 1, wherein step (2) comprises monitoring actions comprising file accessing.

9. A method according to claim 8, wherein step (2) comprises monitoring file modification.

10. A method according to claim 1, wherein step (2) comprises monitoring actions comprising program invocation.

11. A method according to claim 1, further comprising (4) providing a pattern of system actions based on the determination of whether said actions conform to said authorization rule.

12. A method according to claim 11, further comprising (5) providing notification of predetermined patterns.

13. Apparatus for realizing computer security of a computer system, comprising:

(1) means for establishing an authorization window for enabling computer system actions consistent with an authorization rule;

(2) means for the computer system to automatically and independently monitor said actions as an indicia of conformance to said authorization rule after said authorization window closes; and

(3) means for the computer system to automatically and independently determine whether said actions conform to said authorization rule while the computer system automatically and independently monitors said actions.

14. An apparatus according to claim 13, wherein said actions comprise file accessing.

15. An apparatus according to claim 14, wherein said actions comprise file modification.

16. An apparatus according to claim 13, wherein said actions comprise program invocation.

17. An apparatus according to claim 13, further comprising means for providing a pattern of system actions based on the determination of whether said actions conform to said authorization rule.

18. An apparatus according to claim 17, further comprising means for providing notification of predetermined patterns.