Automatic enforcement of obligations according to a data-handling policy

• US 8,561,126 B2
• Filed: 12/29/2004
• Issued: 10/15/2013
• Est. Priority Date: 12/29/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ananthanarayanan, Rema, Gupta, Ajay Kumar, Powers, Calvin Stacy, Joshi, Sachindra, Bhide, Manish Anand, Mohania, Mukesh K
• Primary Examiner(s): PHAM, LUU T
• Application Number:
  US11/025,307
• Publication Number:
  US 20060143464A1
• Time in Patent Office: 3,212 Days
• Field of Search: 713/182, 726/2, 726 26- 33
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Methods, systems and computer program products for automatically enforcing obligations in accordance with a data-handling policy are disclosed. Requests by users for accessing data stored in a data repository are intercepted. A determination is made whether any obligations apply to each data item requested in accordance with the data handling policy. The determination may relate to whether rules having associated obligations identified in the data-handling policy apply to data items requested by a user. The obligations are automatically executed at an appropriate time after access of the data. Association of a data item requested by the user with an obligation may be recorded and tracked to determine the appropriate time for executing the obligation.

Claims

1. A method for automatically enforcing obligations in accordance with a data-handling policy, said data-handling policy comprising rules for access to data stored in a data repository and obligations based on said access to said data, said method comprising:

intercepting a request by a user for accessing said data stored in said data repository;

determining user access restrictions to said data according to said rules;

providing requested data to said user upon successfully validating said user according to said rules;

identifying an obligation associated with access to a specific data item, said obligation comprising a specified action invoked by said data-handling policy as a result of said access to said specific data item, and said obligation being associated with an appropriate time for execution;

identifying rules in said data-handling policy having said obligation;

generating a list of data access events, based on said rules, for associating the specific data item requested by said user with said obligation; and

responsive to said requested data comprising said specific data item, automatically executing said obligation at said appropriate time after access to said specific data item requested by said user.

2. The method of claim 1, said identifying comprising:

associating a rule in said data-handling policy with said obligation.

3. The method of claim 2, said identifying further comprising:

recording said specific data item requested by said user being associated with said obligation; and

tracking said specific data item and said obligation to determine said appropriate time for executing said obligation.

4. The method of claim 1, said list of data access events comprising any of:

data item categories;

user categories; and

user requests.

5. The method of claim 1, further comprising:

tracking said specific data item and said obligation that is associated with said specific data item to determine said appropriate time for executing said obligation.

6. The method of claim 1, wherein a data schema of said data repository remains unmodified.

7. A method for automatically enforcing obligations that apply to access of data items stored in a data repository, said method comprising:

intercepting a request by a user for accessing data stored in said data repository;

executing said request on said data repository;

determining whether access to a data item returned in response to said request is governed by rules of a data-handling policy;

providing requested data to said user upon successfully validating said user according to said rules;

determining whether an obligation is associated with said data item returned in response to said request, said obligation comprising a specified action invoked by said rules of said data handling policy as a result of said access to a specific data item;

responsive to said requested data comprising said specific data item, automatically tracking said specific data item and said obligation to determine an appropriate time for said obligation to be executed;

identifying rules in said data-handling policy having said obligation;

generating a list of data access events, based on said rules, for associating the specific data item requested by said user with said obligation; and

automatically executing said obligation at said appropriate time.

8. The method of claim 7, wherein a data schema of said data repository remains unmodified.

9. The method of claim 7, said automatically tracking said specific data item further comprising:

recording said obligation associated with said specific data item returned in response to said request.

10. A system for automatically enforcing obligations in accordance with a data handling policy, said data handling policy comprising rules for access to data stored in a data repository and obligations based on said access to said data, said system comprising:

a processor operatively connected to said data repository;

a user interface operatively connected to said processor, said user interface receiving a request for accessing said data stored in said repository; and

an output device operatively connected to said processor,

said processor comprising;

a content manager;

a request interceptor that intercepts said request for accessing said data stored in said repository and executes said request on said content manager, which returns requested data to said output device according to said request;

an event handler that determines whether said request is approved according to said rules and determines if an obligation is associated with access to a specific data item returned in response to said request in accordance with said data handling policy, said obligation comprising a specified action invoked by said data-handling policy as a result of said access to said specific data item, and said obligation being associated with an appropriate time for execution; and

a policy translator that identifies rules in said data handling policy having said obligation and generates a list of data access events, based on said rules, for associating the specific data item requested by said user with said obligation; and

responsive to said requested data comprising said specific data item, said processor executing said obligation at said appropriate time after access of said specific data item.

11. The system of claim 10, said event handler recording that said specific data item requested is associated with said obligation.

12. The system of claim 10, wherein said list of data access events comprises comprising any of:

data item categories; and

user categories.

13. The system of claim 10, said processor further comprising:

a privacy data management engine that maintains a list of users and data items and performs conflict resolution for mapping of data categories to unique obligations.

14. The system of claim 10, wherein a data schema of said repository remains unmodified.

15. A computer system for automatically enforcing obligations that apply to data items stored in a data repository, said system comprising:

a memory for storing data and computer instructions; and

a processor connected to said memory, said processor executing said computer instructions to perform the tasks of;

intercepting a request for accessing data stored in said repository;

executing said request on said data repository;

determining whether access to a data item returned in response to said request is governed by rules of a data-handling policy;

identifying if an obligation is associated with said data item returned in response to said request in accordance with said data handling policy, said obligation comprising a specified action invoked by said data-handling policy as a result of said access to a specific data item, and said obligation being associated with an appropriate time for execution;

marking said data item returned in response to said request having an obligation according to said data handling policy;

automatically tracking said data item returned in response to said request having an associated obligation and said associated obligation to determine an appropriate time when said obligation should be executed;

identifying rules in said data-handling policy having said obligation;

generating a list of data access events, based on said rules, for associating said specific data item requested with said obligation; and

automatically executing said associated obligation at said appropriate time.

16. The system of claim 15, wherein said rules comprising privacy rules.

17. The system of claim 15, wherein a data schema of said data repository remains unmodified.

18. The system of claim 15, said processor executing said computer instructions further performing:

validating an authority of a user to access said data item; and

providing said data item to said user upon successfully validating said user in accordance with said rules of said data handling policy.

19. A non-transitory computer readable medium, tangibly storing instructions executable by a computer to perform a method for automatically enforcing obligations in accordance with a data-handling policy, said method comprising:

intercepting a request for accessing data stored in a data repository;

determining user access restrictions to said data according to rules of said data-handling policy;

providing requested data to a user upon successfully validating said user according to said rules;

identifying an obligation associated with access to a specific data item, said obligation comprising a specified action invoked by said data-handling policy as a result of said access to said specific data item, and said obligation being associated with an appropriate time for execution;

identifying rules in said data-handling policy having said obligation;

generating a list of data access events, based on said rules, for associating the specific data item requested by said user with said obligation; and

responsive to said requested data comprising said specific data item, automatically executing said obligation at said appropriate time after access to said specific data item requested by said user.

20. The non-transitory computer readable medium of claim 19, said method further comprising:

identifying rules in said data-handling policy having associated obligations; and

determining whether said rules apply to each data item requested by said user.

21. The non-transitory computer readable medium of claim 20, said method further comprising:

recording said specific data item requested by said user being associated with said obligation; and

tracking said specific data item and said obligation to determine said appropriate time for executing said obligation.

22. The non-transitory computer readable medium of claim 19, wherein said list of data access events comprising any of:

data item categories;

user categories; and

user requests.

23. The non-transitory computer readable medium of claim 19, said method further comprising:

validating an authority of said user to access said data; and

providing said requested data to said user upon successfully validating said user in accordance with said rules of said data handling policy.

24. The non-transitory computer readable medium of claim 19, wherein a data schema of said data repository remains unmodified.

25. A non-transitory computer readable medium, tangibly storing instructions executable by a computer to perform a method for automatically enforcing obligations in accordance with a data-handling policy, said method comprising:

intercepting a request for accessing data stored in a data repository;

executing said request on said data repository;

determining whether access to a data item returned in response to said request is governed by rules of said data-handling policy;

determining whether an obligation is associated with said data item returned in response to said request, said obligation comprising a specified action invoked by said rules of said data handling policy, as a result of said access to a specific data item;

identifying rules in said data-handling policy having said obligation;

generating a list of data access events, based on said rules, for associating said specific data item requested with said obligation;

responsive to said data item returned in response to said request comprising said specific data item, automatically tracking said specific data item and said obligation to determine an appropriate time for said obligation to be executed; and

automatically executing said obligation at said appropriate time.

26. The non-transitory computer readable medium of claim 25, wherein a data schema of said data repository remains unmodified.

27. The non-transitory computer readable medium of claim 25, said method further comprising:

validating an authority of a user to access said data item; and

providing said data item to said user upon successfully validating said user in accordance with said rules of said data handling policy.