USING OBJECT BASED SECURITY FOR CONTROLLING OBJECT SPECIFIC ACTIONS ON A SURFACE BASED COMPUTING DEVICE

• US 20090126010A1
• Filed: 11/13/2007
• Published: 05/14/2009
• Est. Priority Date: 11/13/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: CHAKRA, AL, LYLE, RUTHIE D., HARRIS, MONICA S.
• Granted Patent: US 7,979,902 B2
• Time in Patent Office: Days
• US Class Current: 726/20
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

The present invention discloses a solution for object level security on a surface based computing device that includes software objects and behavior tokens. The behavior tokens can control an extent that users are able to manipulate the software objects using the surface based computing device. Different levels of control can be established on an object-by-object basis for different users. The extent users are able to manipulate the software objects can also depends upon set of users proximate to the surface based computing device.

Claims

1. A method for controlling behavior of software objects used on a surface based computing device comprising:

associating software objects with behavior tokens, which control an extent that users are able to manipulate said software objects using a surface based computing device, wherein different manipulations of said software objects are based upon a set of users proximate to the surface based computing device;

automatically detecting a presence of at least one user proximate to the surface based computing device;

determining at least one of an identity and a privilege group for each detected user, which is used when evaluating an extent that said software objects are able to be manipulated;

receiving an attempt to perform an operation against one of the software objects using the surface based computing device;

ascertaining a set of manipulation rights for the software object based upon details specified within a behavioral token associated with the software object and based upon a set of users proximate to the surface based computing device;

applying said ascertained manipulation rights; and

selectively permitting execution of operations associated with the received attempt in accordance with the applied rights.

2. The method of claim 1, wherein said behavior tokens are defined within metadata of the associated software objects, wherein a one-to-one correspondence exists between software objects and behavior tokens, and wherein manipulation rights are granted on a per-object basis.

3. The method of claim 1, wherein said privileges comprise configurable application level behavioral restrictions upon a use of the software object, wherein one of said application level behavioral restrictions defines restrictions on an amount of zoom that is able to be performed against an image software object by a user.

4. The method of claim 1, further comprising:

detecting a change to a set of users proximate to the surface based computing device;

determining at least one of an identity and a privilege group for a user associated with the detected change; and

dynamically altering a set of rights available for manipulating the software objects based upon the detected change.

5. The method of claim 1, wherein said steps of claim 1 are performed by at least one machine in accordance with at least one computer program stored in a computer readable media, said computer programming having a plurality of code sections that are executable by the at least one machine.

6. A method for controlling software object behavior on a surface based computing device comprising:

detecting a set of users proximate to surface based computing device;

determining privileges that said set of users have for using software objects via the surface based computing device; and

dynamically adjusting usages rules for the software objects in accordance with the determined privileges.

7. The method of claim 6, further comprising:

detecting a change to the set of users proximate to the surface based computing device; and

repeating the determining and dynamically adjusting steps.

8. The method of claim 7, wherein said privileges are established on a per-object basis.

9. The method of claim 8, wherein said privileges vary by a user attempting to use a software object, and wherein said privileges comprise a read, edit, delete, and copy privileges.

10. The method of claim 8, wherein said privileges comprise configurable application level behavioral restrictions upon a use of the software object.

11. The method of claim 8, wherein each software object is associated with at least one behavioral token, wherein said behavioral token controls what operations are able to be performed against the related software object, wherein the controlled operations vary depending upon the set of users proximate to the surface based computing device.

12. The method of claim 11, wherein controlled operations include applying restrictions to application level interactions with the software objects.

13. The method of claim 12, wherein said applied restrictions comprise a restriction of a level of zoom that is able to be applied to an image software object.

14. The method of claim 6, wherein said steps of claim 6 are performed by at least one machine in accordance with at least one computer program stored in a computer readable media, said computer programming having a plurality of code sections that are executable by the at least one machine.

15. A system for object level security on a surface based computing device comprising:

a set of one or more software objects stored on a machine readable medium accessible by a surface based computing device;

a set of one or more behavior tokens stored on a machine readable medium accessible by a surface based computing device, wherein said behavior tokens control an extent that users are able to manipulate said software objects using said surface based computing device, wherein different levels of control are established on an object-by-object basis for different users, wherein the extent users are able to manipulate said software objects depends upon set of users proximate to the surface based computing device.

16. The system of claim 15, further comprising:

a presence detector configured to detect individuals proximate to said surface based computing device and configured to determine an identity of a user attempting to manipulate one of the software objects, wherein user identities determined by said presence detector are matched against user identities specified within the behavior tokens and are used to control manipulations of said software objects via the surface based computing device.

17. The system of claim 16, wherein at least one of said security tokens retract manipulation privileges otherwise granted against at least one of the software objects based upon a presence of an unauthorized user, as determined by the presence detector.

18. The system of claim 16, wherein at least one of the behavior tokens grant manipulation privileges otherwise unavailable for at least one of the software objects based upon a presence of an authorizing user, as determined by the presence detector.

19. The system of claim 16 wherein a behavior token must be associated with each software object before said software object is able to be manipulated by the surface based computing device by surface based computing device users.

20. The system of claim 15, wherein said software objects comprise a plurality of software objects, wherein said behavior tokens comprise a plurality of behavior tokens, and wherein a one-to-one relationship exists between the software objects and the behavior tokens.