Determining whether predefined data controlled by a server is replicated to a client machine

• US 8,849,760 B2
• Filed: 05/02/2006
• Issued: 09/30/2014
• Est. Priority Date: 05/02/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chakra, Al, Kaminsky, David, Ogle, David M.
• Primary Examiner(s): Hwa, Shyue Jiunn
• Application Number:
  US11/415,674
• Publication Number:
  US 20070260649A1
• Time in Patent Office: 3,073 Days
• Field of Search: 707/204, 707/640, 707/641, 709/229
• US Class Current: 707/640
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A request is received for predefined data from a client machine. It is determined if the client machine is at an acceptable location to receive the predefined data. The requested predefined data is replicated to the client machine if the client machine is at an acceptable location and replication of the predefined data is prevented if the client machine is at an unacceptable location.

Claims

1. A method of determining whether predefined data controlled by a server is replicated to a client machine comprising:

receiving, by the server, a request for said predefined data from said client machine;

tracing, by the server, a route information packets take to reach said client machine from said server;

determining, by the server, an acceptability of a location of said client machine to receive said predefined data using said traced route;

replicating, by the server, said requested predefined data to said client machine when said location of said client machine is determined to be acceptable and preventing, by the server, replication of said predefined data to said client machine when said location of said client machine is determined to be unacceptable; and

storing, by the server, a list identifying each trusted host capable of being located along said route between said server and said client machine, and wherein said location of said client machine is determined to be acceptable when all hosts along said route are found on said list.

2. The method of claim 1, wherein said predefined data comprises one of high-level security data and intermediate-level security data and said determining said acceptability of said location comprises defining a first set of acceptable locations corresponding to said high-level security data and a second set of acceptable locations corresponding to said intermediate-level security data.

3. The method of claim 1, wherein said location of said client machine is further determined to be acceptable when a number of hosts along said route between said server and said client machine is less than a predefined number.

4. The method of claim 1, further comprising storing a list identifying each insecure host capable of being located along said route between said server and said client machine, and wherein said location of said client machine is further determined to be acceptable when none of the hosts along said route is found on said list.

5. A system for determining whether predefined data is replicated to a client machine comprising:

a module to receive a request for said predefined data from said client machine;

a module to trace a route information packets take to reach said client machine from said system;

a module to store a list containing each trusted host capable of being located along said route between said system and said client machine;

a module to determine an acceptability of a location of said client machine to receive said predefined data using said traced route, wherein said location of said client machine is determined to be acceptable when all hosts along said route are found on said list; and

a module to replicate said requested predefined data to said client machine when said location of said client machine is determined to be acceptable and prevent replication of said predefined data to said client machine when said location of said client machine is determined to be unacceptable.

6. The system of claim 5, wherein said predefined data comprises one of high-level security data and intermediate-level security data and said module to determine said acceptability of said location defines a first set of acceptable locations corresponding to said high-level security data and a second set of acceptable locations corresponding to said intermediate-level security data.

7. The system of claim 5, wherein said module to determine said acceptability of said location further determines when a number of hosts along said route between said system and said client machine is less than a predefined number.

8. The system of claim 5, further comprising a module to store a list containing each insecure host capable of being located along said route between said system and said client machine, and wherein said module to determine said acceptability of said location further determines that said location of said client machine is acceptable when none of the hosts along said route is found on said list.

9. A computer program product for determining whether predefined data is replicated to a client machine, the computer program product comprising:

a computer readable storage medium having computer usable program code embodied therewith, the computer usable program code comprising;

computer usable program code configured to receive a request for said predefined data from said client machine;

computer usable program code configured to trace a route information packets take to reach said client machine from a server;

computer usable program code configured to store a list containing each trusted host capable of being located along said route between said server and said client machine;

computer usable program code configured to determine an acceptability of a location of said client machine to receive said predefined data using said traced route, wherein said location of said client machine is determined to be acceptable when all hosts along said route are found on said list; and

computer usable program code configured to replicate said requested predefined data to said client machine when said location of said client machine is determined to be acceptable and prevent replication of said predefined data to said client machine when said location of said client machine is determined to be unacceptable.

10. The computer program product of claim 9, wherein said computer usable program code to determine said acceptability of said location further determines when a number of hosts along said route between said server and said client machine is less than a predefined number.

11. The computer program product of claim 9, further comprising computer usable program code to store a list containing each insecure host capable of being located along said route between said server and said client machine, and wherein said computer usable program code to determine said acceptability of said location further determines that said location of said client machine is acceptable when none of the hosts along said route is found on said list.