Using a local authorization extension to provide access authorization for a module to access a computing system

• US 9,344,435 B2
• Filed: 12/03/2014
• Issued: 05/17/2016
• Est. Priority Date: 12/01/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Akelbein, Jens-Peter, Mueller-Friedt, Wolfgang
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US14/559,850
• Publication Number:
  US 20150089603A1
• Time in Patent Office: 531 Days
• Field of Search: 713168-174, 713182-186, 713/202, 709/225, 709/229, 226 2- 8, 726 2- 8, 726/26
• US Class Current: 1/1
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

Provided are a method, system, and computer program product for a local authorization extension to provide access authorization for a module to access a computing system. A memory stores information on a first validity range comprising position coordinates for a module seeking to access the computing system and a second validity range comprising position coordinates for a location authorization extension for a computing system. A determination is made of a first position signal from a first receiver of the module and of a second position signal from a second receiver of the location authorization module. Determinations are made as to whether the first position signal is within the first validity range and whether the second position signal is within the second validity range. The module is granted access to the computing system in response to determining that the first position signal is within the first validity range and the second position signal is within the second validity range.

Claims

1. A method, comprising:

storing in a memory information on a first validity range comprising position coordinates for a service authorization module seeking to access a computing system, wherein the first validity range defines position coordinates of an allowed range for a service technician having the service authorization module;

storing in the memory information on a second validity range comprising position coordinates for a location authorization extension for a computing system, wherein the second validity range defines position coordinates where the computing system is located when setting-up or installing the computing system;

storing in the memory information on at least one additional validity range for at least one additional module;

determining from a first receiver of the service authorization module a first position signal;

determining from a second receiver of the location authorization extension a second position signal;

determining from the first position signal whether the service authorization module is within the first validity range;

determining from the second position signal whether the local authorization extension is within the second validity range;

determining at least one additional position signal from at least one additional receiver; and

granting the service authorization module access to the computing system in response to determining that the first, the second, and the at least one additional position signal are within the first, the second, and the at least one additional validity range, respectively.

2. The method of claim 1, wherein the service authorization module comprises a device having the first receiver that is carried by the service technician seeking authorized access to perform maintenance on the computing system.

3. The method of claim 1, wherein the computing system comprises a virtual machine, and wherein the determining whether the first and second position signals are within the first and second validity ranges, respectively, and granting the service authorization module access are performed by a hypervisor controlling the computing system.

4. The method of claim 3, wherein a service center sends a command to the hypervisor to stop the virtual machine and wherein the granting the service authorization module access to the virtual machine is performed in response to receiving the command to stop the virtual machine.

5. The method of claim 3, further comprising:

wherein the at least one additional validity range comprises a third validity range for a first authorization authority and a fourth validity range for a second authorization authority;

wherein the determining the at least one additional position signal comprises determining a third and fourth position signals from the first and second authorization authorities, respectively; and

determining whether the third and the fourth position signals are within the third and fourth validity ranges, respectively, wherein the access is granted in response to determining that the first, second, third and fourth position signals are within the first, second, third and fourth validity ranges, respectively.

6. The method of claim 1, wherein the at least one additional module comprises a cloud service center, and wherein granting the service authorization module access comprises granting the service authorization module maintenance access in response to determining that the first, the second, and the at least one additional position signal are within the first, the second, and the at least one additional validity range, respectively.

7. A system in communication with a service authorization module having a first receiver, comprising:

a computing system;

a local authorization extension coupled to the computing system, including;

a second receiver;

a memory including information on a first validity range comprising position coordinates for the service authorization module, a second validity range comprising position coordinates for a location authorization extension, and at least one additional validity range for at least one additional module, wherein the first validity range defines position coordinates of an allowed range for a service technician having the service authorization module, and wherein the second validity range defines position coordinates where the computing system is located when setting-up or installing the computing system;

local authorization extension logic for performing operations, the operations comprising;

determining from a first receiver a first position signal of the service authorization module;

determining from a second receiver a second position signal of the local authorization extension;

determining from the first position signal whether the service authorization module is within the first validity range;

determining whether the second position signal is within the second validity range;

determining at least one additional position signal from at least one additional receiver; and

granting the service authorization module access to the computing system in response to determining that the first, the second, and the at least one additional position signal are within the first, the second, and the at least one additional validity range, respectively.

8. The system of claim 7, wherein the service authorization module comprises a device having the first receiver that is carried by the service technician seeking authorized access to perform maintenance on the computing system.

9. The system of claim 7, wherein the computing system comprises a virtual machine, and wherein the operations of determining whether the first and second position signals are within the first and second validity ranges, respectively, and the granting the service authorization module access are performed by a hypervisor controlling the computing system.

10. The system of claim 9, wherein a service center sends a command to the hypervisor to stop the virtual machine and wherein the operations to determine whether to grant the service authorization module access to the virtual machine are performed in response to receiving the command to stop the virtual machine.

11. The system of claim 9, wherein the operations further comprises:

wherein the at least one additional validity range comprises a third validity range for a first authorization authority and a fourth validity range for a second authorization authority;

wherein the determining the at least one additional position signal comprises determining a third and fourth position signals from the first and second authorization authorities, respectively; and

determining whether the third and the fourth position signals are within the third and fourth validity ranges, respectively, wherein the access is granted in response to determining that the first, second, third and fourth position signals are within the first, second, third and fourth validity ranges, respectively.

12. The system of claim 7, wherein the at least one additional module comprises a cloud service center, and wherein the granting the service authorization module access comprises granting the service authorization module maintenance access in response to determining that the first, the second, and the at least one additional position signal are within the first, the second, and the at least one additional validity range, respectively.

13. The system of claim 7, further comprising:

a bus, wherein the local authorization module communicates with the computing system over the bus.

14. A computer program product accessible from a computer readable storage device including code to implement a location authorization extension for authenticating a service authorization module having a first receiver to access a computing system, wherein the code is in communication with a memory and a second receiver and executed to perform operations, the operations comprising:

storing in memory information on a first validity range comprising position coordinates for the service authorization module, wherein the first validity range defines position coordinates of an allowed range for a service technician having the service authorization module;

storing information in the memory on a second validity range comprising position coordinates for the location authorization extension, wherein the second validity range defines position coordinates where the computing system is located when setting-up or installing the computing system;

storing in the memory information on at least one additional validity range for at least one additional module;

determining from the first receiver a first position signal;

determining from a second receiver of the location authorization extension a second position signal;

determining from the first position signal whether the service authorization module is within the first validity range;

determining from the second position signal whether the local authorization extension is within the second validity range;

determining at least one additional position signal from at least one additional receiver; and

granting the service authorization module access to the computing system in response to determining that the first, the second, and the at least one additional position signal are within the first, the second, and the at least one additional validity range, respectively.

15. The computer program product of claim 14, wherein the service authorization module comprises a device having the first receiver that is carried by the service technician seeking authorized access to perform maintenance on the computing system.

16. The computer program product of claim 14, wherein the computing system comprises a virtual machine, and wherein the operations of determining whether the first and second position signals are within the first and second validity ranges, respectively, and granting the service authorization module access are performed by a hypervisor controlling the computing system.

17. The computer program product of claim 16, wherein a service center sends a command to the hypervisor to stop the virtual machine and wherein the operations to determine whether to grant the service authorization module access to the virtual machine are performed in response to receiving the command to stop the virtual machine.

18. The computer program product of claim 16, further comprising:

wherein the at least one additional validity range comprises a third validity range for a first authorization authority and a fourth validity range for a second authorization authority;

wherein the determining the at least one additional position signal comprises determining a third and fourth position signals from the first and second authorization authorities, respectively; and

determining whether the third and the fourth position signals are within the third and fourth validity ranges, respectively, wherein the access is granted in response to determining that the first, second, third and fourth position signals are within the first, second, third and fourth validity ranges, respectively.

19. The computer program product of claim 14, wherein the at least one additional module comprises a cloud service center, and wherein the granting the service authorization module access comprises granting the service authorization module maintenance access in response to determining that the first, the second, and the at least one additional position signal are within the first, the second, and the at least one additional validity range, respectively.