Automatic enforcement of obligations according to a data-handling policy

• US 20060143464A1
• Filed: 12/29/2004
• Published: 06/29/2006
• Est. Priority Date: 12/29/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ananthanarayanan, Rema, Joshi, Sachindra, Bhide, Manish Anand, Powers, Calvin Stacy, Gupta, Ajay Kumar, Mohania, Mukesk K
• Granted Patent: US 8,561,126 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Methods, systems and computer program products for automatically enforcing obligations in accordance with a data-handling policy are disclosed. Requests by users for accessing data stored in a data repository are intercepted. A determination is made whether any obligations apply to each data item requested in accordance with the data handling policy. The determination may relate to whether rules having associated obligations identified in the data-handling policy apply to data items requested by a user. The obligations are automatically executed at an appropriate time after access of the data. Association of a data item requested by the user with an obligation may be recorded and tracked to determine the appropriate time for executing the obligation.

Claims

1. A method for automatically enforcing obligations in accordance with a data-handling policy, said method comprising:

intercepting a request by a user for accessing data stored in a data repository;

determining whether any obligations apply to each data item requested by said user in accordance with said data handling policy; and

automatically executing said obligations at an appropriate time after access of said data.

2. The method of claim 1, wherein the of determining process comprises:

identifying rules in said data-handling policy having associated obligations; and

determining whether said rules apply to data items requested by said user.

3. The method of claim 2, wherein the determining process comprises:

recording that said data item requested by said user is associated with an obligation; and

tracking said data item and said associated obligation to determine said appropriate time for executing said obligation.

4. The method of claim 1, comprising:

identifying rules in said data-handling policy having associated obligations; and

generating a list of data access events, based on said rules, for associating data items requested by said user with an obligation.

5. The method of claim 4, wherein said list of data access events comprises one or more categories comprising any of consisting of:

data item categories;

user categories; and

user requests.

6. The method of claim 1, comprising:

validating authority of said user to access said requested data; and

providing said data to said user if said authority of said user has been successfully validated in accordance with said data handling policy.

7. The method of any one of claim 1, wherein a data schema of said data repository remains unmodified.

8. A method for automatically enforcing obligations that apply to access of data items stored in a data repository, said method comprising:

intercepting a request by a user for accessing data stored in said repository;

executing said request on a content of said data repository;

determining whether access of each data item returned in response to said executed request is governed by a rule having an associated obligation;

associating said data items governed by rules with respective ones of said obligations;

automatically tracking data items and associated obligation pairs to determine appropriate times when said obligations are to be executed; and

automatically executing said obligations at said appropriate times.

9. The method of claim 8, wherein said rules comprise privacy rules, said method further comprising:

identifying said privacy rules in a data-handling policy; and

generating a list of data access events based on said privacy rules that have an associated obligation.

10. The method of claim 8, wherein said steps are a data schema of said data repository remains unmodified.

11. The method of claim 8, further comprising:

validating authority of said user to access said data; and

providing said data to said user if said authority of said user has been successfully validated.

12. A system for automatically enforcing obligations in accordance with a data handling policy, said system comprising:

a request interceptor adapted to intercept a request by a user for accessing data stored in a repository;

an event handler adapted to determine whether any obligations apply to each data item requested by said user in accordance with said data handling policy; and

a processing unit adapted to execute said associated obligation at an appropriate time after access of said data.

13. The system of claim 12, wherein said event handler is adapted to determine whether any obligations are associated with rules that apply to data items requested by said user.

14. The system of claim 13, wherein said event handler is adapted to record that a data item requested by said user is-associated with an obligation.

15. The system of claim 12, further comprising a policy translator adapted to:

identify rules in said data-handling policy having associated obligations; and

generate a list of data access events based on said rules for associating data items requested by said user with an obligation.

16. The system of claim 15, wherein said list of data access events comprises one or more categories comprising any of:

data item categories; and

user categories.

17. The system of claim 12, further comprising:

user validation means for validating authority of said user to access said data;

wherein

said request interceptor provides said data to said user if an authority of said user has been successfully validated.

18. The system of claim 12, wherein a data schema of said repository remains unmodified.

19. A system for automatically enforcing obligations that apply to data items stored in a data repository, said system comprising:

means for intercepting a request by a user for accessing data stored in said data repository;

means for executing said request on a content of said data repository;

means for determining whether access of each data item returned in response to said executed request is governed by a rule having an associated obligation;

means for associating said data items governed by rules with respective ones of said obligations;

means for automatically tracking data items and associated obligation pairs to determine when said obligations should be executed; and

means for automatically executing said obligations at appropriate times.

20. The system of claim 19, wherein said rules comprise privacy rules, said system further comprises comprising:

means for identifying said privacy rules in a data-handling policy; and

means for generating a list of events based on said privacy rules that have an associated obligation.

21. The system of claim 19, wherein a data schema of said data repository remains unmodified.

22. The system of claim 19, further comprising:

means for validating authority of said user to access said data; and

means for providing said data to said user if said authority of said user has been successfully validated.

23. A system for automatically enforcing obligations in accordance with a data-handling policy, said system comprising:

a memory unit for storing data and instructions to be performed by a processing unit; and

a processing unit coupled to said memory unit, said processing unit programmed to;

intercept a request by a user for accessing data stored in a repository;

determine whether any obligations apply to each data item requested by said user in accordance with said data handling policy; and

execute said obligations at an appropriate time after access of said data.

24. The system of claim 23, wherein said processing unit is further programmed to:

identify rules in said data-handling policy having associated obligations; and

determine whether said rules apply to data items requested by said user.

25. The system of claim 23, wherein said processing unit is further programmed to:

record that said data item requested by said user is associated with an obligation; and

track said data item and said associated obligation to determine the appropriate time for executing said obligation.

26. The system of claim 23, wherein said processing unit is further programmed to:

identify rules in said data-handling policy having an associated obligation; and

generate a list of data access events, based on said rules, for associating data items requested by said user with an obligation.

27. The system of claim 26, wherein said list comprises one or more categories comprising any of:

data item categories;

user categories; and

user requests.

28. The system of claim 23, wherein said processing unit is further programmed to:

validate authority of said user to access said data; and

provide said data to said user if said user'"'"'s authority of said user has been successfully validated.

29. The system of claim 23, wherein a data schema of said data repository remains unmodified.

30. A system for automatically enforcing obligations that apply to data items stored in a data repository, said system comprising:

a memory unit for storing data and instructions to be performed by a processing unit; and

a processing unit coupled to said memory unit, said processing unit programmed to;

intercept a request by a user for accessing data stored in said repository;

execute said request on a content of said data repository;

determine whether access of each data item returned in response to said executed request is governed by a rule having an associated obligation;

associate said data items governed by rules with respective ones of said obligations;

automatically track data item and associated obligation pairs to determine when said obligations should be executed; and

automatically execute said obligations at appropriate times.

32. The system of claim 30, wherein a data schema of said data repository remains unmodified.

33. The system of claim 30, wherein said processing unit is further programmed to:

validate authority of said user to access said data; and

provide said data to said user if said authority of said user has been successfully validated.

31. The system of claim 31, wherein said rules comprise privacy rules, said processing unit further programmed to:

identify said privacy rules in a data-handling policy; and

generate a list of data access events based on said privacy rules that have an associated obligation.

34. A computer program product comprising a computer readable medium comprising a computer program recorded therein for automatically enforcing obligations in accordance with a data-handling policy, said computer program product comprising:

computer program code for intercepting a request by a user for accessing data stored in said repository;

computer program code for determining whether any obligations apply to each data item requested by said user in accordance with said data handling policy; and

computer program code for automatically executing said associated obligation at an appropriate time after access of said data.

35. The computer program product of claim 34, further comprising:

computer program code for identifying rules in said data-handling policy having associated obligations; and

computer program code for determining whether said rules apply to data items requested by said user.

36. The computer program product of claim 35, further comprising:

computer program code for recording that said data item requested by said user is associated with an obligation; and

computer program code for tracking said data item and said associated obligation to determine said appropriate time for executing said obligation.

37. The computer program product of claim 34 further comprising:

computer program code for identifying rules in said data-handling policy having an associated obligation; and

computer program code for generating a list of data access events, based on said rules, for associating data items requested by said user with an obligation.

38. The computer program product of claim 37, wherein said list of data access events comprises one or more categories comprising any of:

data item categories;

user categories; and

user requests.

39. The computer program product of claim 34, further comprising:

computer program code for validating authority of said user to access said data; and

computer program code for providing said data to said user if said authority of said user has been successfully validated.

40. The computer program product of claim 34, wherein a data schema of said data repository remains unmodified.

41. A computer program product comprising a computer readable medium comprising a computer program recorded therein for automatically enforcing obligations that apply to data items stored in a data repository, said computer program product comprising:

computer program code for intercepting a request by a user for accessing data stored in said repository;

computer program code for executing said request on the a content of said data repository;

computer program code for determining whether access of each data item returned in response to said executed request is governed by a rule having an associated obligation;

computer program code for associating said data items governed by rules with respective ones of said obligations;

computer program code for automatically tracking data item and associated obligation pairs to determine when said obligations should be executed; and

computer program code for automatically executing said obligations at appropriate times.

42. The computer program product of claim 41, wherein said rules comprise privacy rules and said computer program product further comprises:

computer program code for identifying said privacy rules in a data-handling policy; and

computer program code for generating a list of data access events based on said rules that have an associated obligation.

43. The computer program product of claim 41, wherein a data schema of said data repository remains unmodified.

44. The computer program product of claim 41, further comprising:

computer program code for validating authority of said user to access said data; and

computer program code for providing said data to said user if said authority of said user has been successfully validated.