Security mechanism providing access control for locally-held data

• US 20010007128A1
• Filed: 12/21/2000
• Published: 07/05/2001
• Est. Priority Date: 12/22/1999
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Orchard, James Ronald, Lambert, Howard Shelton
• Application Number:
  US09/745,863
• Publication Number:
  US 20010007128A1
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Methods and data processing apparatuses are provided which enable controlling, from one data processing apparatus, access to data held (for example on a queue) at another data processing apparatus. When a requester wishes to access data held at a local data processing apparatus, a request must be sent to a remote data processing apparatus to determine the security attributes of the data (for example, retrieving queue attributes from a database). The requestor cannot access the data until the security attributes are fully determined at the local data processing apparatus, and since communication with a remote system is required to make this determination the remote apparatus is able to log the requests for data access. The security attributes are preferably an identifier of a cryptor used in compression, a compressor used in compression and an authenticator for authenticating the requestor. The determination of security attributes is preferably required to be repeated for each requester session, with the attributes being deleted from the local data processing apparatus at the end of a session and the requestor being unable to view or save the attributes. This enables session-specific access control.

Claims

1. A method of controlling access to data, comprising:

in response to a request from a requester for access to data stored in an encoded form on a first data processing apparatus, sending a request from a decoding controller on the first data processing apparatus to a second data processing apparatus to determine attributes of a decoding process for accessing the encoded data;

in response to said request to the second data processing apparatus, receiving said determined attributes at said decoding controller;

performing the decoding process in accordance with the determined attributes.

2. A method according to

claim 1

, wherein the requester communicates via an application programming interface with a data access manager which includes the decoding controller, the application programming interface being predefined such that the decoding controller and any received decoding attributes are shielded from the requester.

3. A method according to

claim 1

, wherein received attributes are stored in volatile memory of the first data processing apparatus when received, and are deleted from said memory at the end of a current requester session, such that a request to determine attributes of a decoding process must be repeated for each requester session for which access to encoded data is required.

4. A method according to

claim 1

, wherein the determined attributes of a decoding process include identifiers of one or more of:

a cryptor used in encryption and required for decryption;

a compressor used in compression and required for decompression; and

an authenticator for requestor authentication.

5. A method according to

claim 4

, including the steps, subsequent to receiving said determined attributes, of:

checking whether program code implementing said identified cryptor, compressor and authenticator is stored on the first data processing apparatus; and

, if not, initiating downloading of the respective program code from the second data processing apparatus or another data processing apparatus.

6. A method according to

claim 1

, wherein the determined attributes of a decoding process include program code implementing the decoding process.

7. A method according to

claim 1

, wherein the attributes of a decoding process include one or more decoding keys for use in decryption or authentication.

8. A method according to

claim 1

, including logging at the second data processing apparatus said requests to determine attributes.

9. A method according to

claim 1

, including authenticating the requester to the second data processing apparatus before determining the attributes of the decoding process.

10. A computer program product comprising machine-readable recording medium having recorded thereon computer program code implementing functions for controlling the operation of a data processing apparatus on which the program code runs to perform the following steps of a method for controlling access to encoded data:

in response to a request from a requester for access to data stored in an encoded form on a first data processing apparatus, sending a request from a decoding controller on the first data processing apparatus to a second data processing apparatus to determine attributes of a decoding process for accessing the encoded data;

in response to said request to the second data processing apparatus, receiving said determined attributes at said decoding controller;

performing the decoding process in accordance with the determined attributes.

11. A first data processing apparatus including:

a processing unit;

data storage means;

communication means for sending and receiving communications from data processing systems connectable to said first data processing apparatus via a network; and

a decoding controller, responsive to a request from a requestor for access to data stored in an encoded form in said data storage means, for sending a request via said communication means to a second data processing apparatus to determine attributes of a decoding process for accessing the encoded data and for receiving said determined attributes via said communication means;

wherein the decoding controller is adapted to control the operation of the processing unit to perform the decoding process in accordance with the determined attributes.

12. A data processing apparatus, including:

a processing unit;

data storage means storing attributes of one or more decoding processes, which processes are associated with specific data stored in an encoded form on the data processing apparatus; and

an access controller component, for retrieving the stored attributes from the memory in response to a request from a remote data processing apparatus, and for sending the retrieved attributes to the data processing apparatus.

13. A data processing apparatus according to

claim 12

, including means for logging said requests to determine attributes.

14. A data processing apparatus according to

claim 12

, including means for authenticating the requestor before retrieving the stored attributes of a decoding process.