Session based security profile for internet access of an enterprise server

• US 6,782,425 B1
• Filed: 11/24/1999
• Issued: 08/24/2004
• Est. Priority Date: 11/24/1999
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Unisys Corporation
• Inventors: Guhl, Timothy J., Gretter, Eugene J., Kress, Daryl J., Behr, Gail L., Germscheid, Paul S.
• Primary Examiner(s): Barot, Bharat
• Application Number:
  US09/449,086
• Time in Patent Office: 1,735 Days
• Field of Search: 709/202-203, 709/217-219, 709/223-224, 709/227-229, 709/242, 707/1, 707/3, 707/9-10, 713/200-202
• US Class Current: 709/227
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

An apparatus for and method of utilizing an internet terminal coupled to the world wide web to access an existing proprietary data base management system having a dialog-based request format. The user request is received by a web server from the world wide web and converted into one or more sequenced data base management commands stored as corresponding to the service request. If the user terminal requests access to a secure function or to secure data, the user terminal is interrogated to determine its user profile. This user profile is compared to the security profile of the service request. The service request is honored if and only if the user profile corresponds to the security profile. The secure session control object created to honor the request is deleted upon completion of the session.

Claims

1. In a data processing environment having a user terminal with a user profile for generating a service request for access to data requiring a particular security profile responsively coupled via a publically accessible digital data communication network to a data base management system which honors said service request by executing a particular sequence of command language statements associated with said service request the improvement comprising:

an object responsively coupled to said user terminal via said publically accessible digital data communication network which interrogates said user terminal for said user profile and which compares said user profile to said particular security profile directly associated with said particular sequence of command language statements and which permits said data base management system to honor said service request if and only if said user profile corresponds to said particular security profile.

2. The improvement according to claim 1 wherein said object further comprises a secure session control object created specifically for honoring said service request which is deleted after said service request is honored.

3. The improvement according to claim 2 further comprising a session termination facility which deletes said secure session control object.

4. The improvement according to claim 3 wherein said publically accessible digital data communication network further comprises the internet.

5. The improvement according to claim 4 wherein said data base management system is MAPPER.

6. An apparatus comprising:

a. a user terminal having a user profile wherein a service request having a corresponding security profile generated by said user terminal;

b. a data base management system having access to a data base responsively coupled to said user terminal via a publically accessible digital data communication network; and

c. a gateway responsively coupled to said user terminal via said publically accessible digital data communication network which interrogates said user terminal to obtain said user profile wherein said gateway compares said user profile with said security profile and permits said data base management system to honor said service request if and only if said user profile corresponds to said security profile.

7. The apparatus of claim 6 wherein said publically accessible digital data communication network further comprises the world wide web.

8. The apparatus of claim 7 wherein said user terminal further comprises an industry compatible personal computer.

9. A method of regulating access between a user terminal having a user profile responsively coupled via a publically accessible digital data communication network to a data base management system comprising:

a. generating a service request at said user terminal;

b. transferring said service request to said data base management system;

c. determining a security profile corresponding to said service request;

d. interrogating said user terminal to determine said user profile; and

e. honoring said service request if and only if said user profile corresponds to said security profile.

10. A method according to claim 9 wherein said publically accessible digital data communication network further comprises the internet.

11. A method according to claim 10 wherein said honoring step further comprises creating a session control object.

12. A method according to claim 11 herein said further comprising deleting said session control object following said honoring step.

13. A method according to claim 12 wherein said remote data base management system further comprises MAPPER data base management system.

14. An apparatus comprising:

a. means having a user profile for generating a service request;

b. means responsively coupled to said permitting means via a publically accessible digital data communication network for honoring said service request;

c. means responsively coupled to said generating means for interrogating said generating means to determine said user profile;

d. means responsively coupled to said interrogating means for comparing said user profile with a security profile corresponding to said service request; and

e. means responsively coupled to said comparing means and said honoring means for preventing said honoring means from honoring said service request unless said comparing means determines that said user profile corresponds to said security profile.

15. An apparatus according to claim 14 wherein said publically accessible digital data communication network further comprises the world wide web.

16. An apparatus according to claim 15 wherein said preventing means creates a secure session control object corresponding to said security profile if said comparing means determines that said user profile corresponds to said security profile.

17. An apparatus according to claim 16 wherein said honoring means further comprises MAPPER data base management system.

18. An apparatus according to claim 17 wherein said generating means further comprises an industry standard personal computer.