USER-CENTRIC RESOURCE ARCHITECTURE

• US 20100037304A1
• Filed: 08/05/2008
• Published: 02/11/2010
• Est. Priority Date: 08/05/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Canning, Simon G., Tuton, Peter J.K.
• Granted Patent: US 8,276,184 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Some embodiments include a computer-implemented method for controlling access to resources of a platform in a computer system. The method can comprise detecting a request to access a resource, wherein the resource resides in the computer system, and wherein the resource is associated with an owner; requesting a first resource access decision from a first policy decision unit associated with the owner; receiving, from the first policy decision unit, the first resource access decision and first trust information, wherein the first trust information indicates trust of a second policy decision unit; requesting a second resource access decision from the second policy decision unit associated with the virtual universe platform; receiving, from the second policy decision unit, a second resource access decision; and returning the second resource access decision.

Claims

1. A computer-implemented method for controlling access to resources of a platform in a computer system, the method comprising:

detecting a request to access a resource, wherein the resource resides in the computer system, and wherein the resource is associated with an owner;

requesting a first resource access decision from a first policy decision unit associated with the owner;

receiving, from the first policy decision unit, the first resource access decision and first trust information, wherein the first trust information indicates trust of a second policy decision unit;

requesting a second resource access decision from the second policy decision unit associated with the virtual universe platform;

receiving, from the second policy decision unit, a second resource access decision; and

returning the second resource access decision.

2. The computer-implemented method of claim 1, wherein the platform is configured to present one or more virtual universes, wherein the resource resides in the computer system.

3. The computer-implemented method of claim 1, wherein the resource is any one of video files, audio files, documents, blogs, islands, buildings, media files, and presentations.

4. The computer-implemented method of claim 1, wherein the platform includes one or more of operating systems, virtual world applications, programming languages, and websites.

5. The computer-implemented method of claim 1, wherein the owner provided the resource for use on the platform, wherein the platform is configured to present a virtual universe, and wherein the resource is a virtual object in the virtual universe.

6. A computer-implemented method for controlling access to resources of a platform in a computer system, the method comprising:

detecting a request to access a first resource in the computer system, wherein the first resource is associated with a second resource in the computer system, and wherein the first and second resources are associated with separate owners;

requesting a first resource access decision from a first policy decision unit residing in the computer system, wherein the first policy decision unit is associated with the first resource'"'"'s owner;

receiving, from the first policy decision unit, a first trust information, wherein the first trust information indicates trust of a second policy decision unit associated with the second resource'"'"'s owner, a and third policy decision unit associated with the platform in the computer system, and a message indicating unavailability of the first resource access decision;

requesting a second resource access decision from the second policy decision unit, wherein the second policy decision unit resides in the computer system;

receiving, from the second policy decision unit, a second resource access decision;

requesting a third resource access decision from a third policy decision unit, wherein the third policy decision unit resides in the computer system;

receiving, from the third policy decision unit, a third resource access decision; and

returning the third policy decision.

7. The computer-implemented method of claim 6, further comprising granting resource access to the first resource if two or more of the first, second, and third resource access decisions grant access to the first resource.

8. The computer-implemented method of claim 6, wherein the receiving a message indicating the unavailability of the first resource access decision indicates that a resource access decision is not requested from the second and third policy decision units and that access to the first resource is blocked.

9. The computer-implemented method of claim 6, wherein the resource access decisions are based on information including resource user name and id, resource user'"'"'s position in an organization, accessed resource name and type, resource'"'"'s security level, application name, and website'"'"'s Internet Protocol (IP) address.

10. The computer-implemented method of claim 6, wherein the owner provided the resource for use on the platform, wherein the platform is configured to share media content over networks, and wherein the resource is a media file.

11. An apparatus for controlling access to resources of a platform in a computer system, the apparatus comprising:

a platform configured to host one or more resources and run one or more applications;

a policy decision unit (PDU) configured to store policies and determine access to the one or more resources;

a policy enforcement unit (PEU) configured to

detect a request to access a resource from the one or more resources, wherein the resource is associated with an owner;

request a first resource access decision from a first policy decision unit associated with the owner;

receive, from the first policy decision unit, the first resource access decision and first trust information, wherein the first trust information indicates trust of a second policy decision unit;

request a second resource access decision from the second policy decision unit associated with the platform;

receive, from the second policy decision unit, a second resource access decision; and

return the second policy decision unit.

12. The apparatus of claim 11, wherein the platform is configured to host resources including any one or more of video files, audio files, documents, blogs, and virtual universe objects including islands, buildings, audio files, and presentations.

13. The apparatus of claim 11, wherein the platform is a framework on which resources are stored and software applications are run, and includes one or more of operating systems, virtual world systems, programming languages, and websites.

14. The apparatus of claim 11, wherein the owner provided the resource for use on the platform, wherein the platform is configured to present a virtual universe, and wherein the resource is a virtual object in the virtual universe.

15. The apparatus of claim 11, wherein the owner provided the resource for use on the platform, wherein the platform is configured to share media content over networks, and wherein the resource is a media file.

16. An apparatus also comprising:

a platform configured to host one or more resources and run one or more applications;

a policy decision unit (PDU) configured to store policies and determine access to the one or more resources;

a policy enforcement unit configured to

detect a request to access a first resource, wherein the first resource is associated with a second resource, and wherein the first and second resources are associated with separate owners;

request a first resource access decision from a first policy decision unit associated with the first resource'"'"'s owner;

receive, from the first policy decision unit, a first trust information, wherein the first trust information indicates trust of a second policy decision unit associated with the second resource'"'"'s owner, a and third policy decision unit associated with the platform, and a message indicating unavailability of the first resource access decision;

request a second resource access decision from the second policy decision unit;

receive, from the second policy decision unit, a second resource access decision;

request a third resource access decision from a third policy decision unit;

receive, from the third policy decision unit, a third resource access decision; and

return the third policy decision unit.

17. The apparatus of claim 16 further comprising, the policy enforcement unit configured to grant resource access to the first resource if two or more of the first, second, and third resource access decisions grant access to the first resource.

18. The apparatus of claim 16, wherein the receiving a message indicating the unavailability of the first resource access decision indicates that a resource access decision is not requested from the second and third policy decision units and that access to the first resource is blocked.

19. The apparatus of claim 16, wherein the policy decision units are configured to determine the resource access decisions based on information including resource user name and id, resource user'"'"'s position in an organization, accessed resource name and type, resource'"'"'s security level, application name, and website'"'"'s Internet Protocol (IP) address.

20. The apparatus of claim 16, wherein policy decision units are associated with a parameter, and wherein the parameter is used to specify the location of the policy decision unit in memory.

21. One or more machine-readable media having stored therein a program product, which when executed a set of one or more processor units causes the set of one or more processor units to perform operations that comprise:

detecting a request to access a resource, wherein the resource is associated with an owner;

requesting a first resource access decision from a first policy decision unit associated with the owner;

receiving, from the first policy decision unit, the first resource access decision and first trust information, wherein the first trust information indicates trust of a second policy decision unit;

requesting a second resource access decision from the second policy decision unit associated with the platform;

receiving, from the second policy decision unit, a second resource access decision; and

returning the second policy decision unit.

22. The machine-readable media of claim 21, wherein the resource is any one of video files, audio files, documents, blogs, and virtual universe objects including islands, buildings, media files, and presentations.

23. The machine-readable media of claim 21, wherein the platform is a framework on which resources are stored and software applications are run, and includes one or more of operating systems, virtual world systems, programming languages, and websites.

24. The machine-readable media of claim 21, wherein the owner provided the resource for use on the platform, wherein the platform is configured to present a virtual universe, and wherein the resource is a virtual object in the virtual universe.

25. The machine-readable media of claim 21, wherein the owner provided the resource for use on the platform, wherein the platform is configured to share media content over networks, and wherein the resource is a media file.